WO2023221856A1

WO2023221856A1 - Quantum secure communication method and device, quantum password service network, and communication system

Info

Publication number: WO2023221856A1
Application number: PCT/CN2023/093515
Authority: WO
Inventors: 田野; 何申; 粟栗; 杜海涛
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2022-05-16
Filing date: 2023-05-11
Publication date: 2023-11-23
Also published as: CN117118597A

Abstract

Provided in the present disclosure are a quantum secure communication method and device, a quantum password service network, and a quantum secure communication system. The quantum secure communication method comprises: a first device obtains a first quantum key and/or a first quantum random number from a first network, or locally obtains the first quantum key and/or the first quantum random number; the first device provides a second quantum key and/or a second quantum random number for a second device.

Description

Quantum secure communication methods and equipment, quantum cryptography service networks and communication systems

Cross-references to related applications

This application claims priority to Chinese Patent Application No. 202210531198.0 filed in China on May 16, 2022, the entire content of which is incorporated herein by reference.

Technical field

The present disclosure relates to the field of communication technology, and in particular refers to a quantum secure communication method and device, a quantum cryptography service network and a quantum secure communication system.

Background technique

The current user network business applications of quantum secure communication networks are showing a massive, heterogeneous, and diversified development trend. In addition to the traditional basic communication network based on wired methods (for example, divided from different dimensions, it can include: wide area network, metropolitan area network, backbone network, aggregation network, access network, bearer network, transmission network, etc.), quantum secure communication technology needs to be adopted. In addition to realizing high-speed and secure transmission of data information between systems and equipment nodes, based on the fourth generation mobile communication (the ^4th Generation, 4G)/the fifth generation mobile communication (the ^5th Generation, 5G), wireless Mobile communication networks with wireless technologies such as Wireless Fidelity (WiFi) also need to be combined with quantum security technology to achieve confidential communication between base stations/hotspots, mobile terminals, and devices, thereby achieving "end-edge-management- The goal is to achieve high-security data secure transmission on the end-to-end transmission path of the cloud and comprehensively improve the information security level of the network system.

However, how to design the system architecture of quantum secure communication and how to effectively manage the entire life cycle of quantum keys (for example, generation, distribution, negotiation, use, destruction, etc.) of quantum keys to meet the needs of massive and diverse future The demand for the application of quantum cryptography in user services is an urgent problem that needs to be solved.

Contents of the invention

The purpose of this disclosure is to provide a quantum secure communication method and device, a quantum cryptographic service network and a quantum secure communication system to solve the problem that the quantum secure communication method in related technologies cannot meet the application of quantum cryptography by diversified businesses and large-scale users in the future. need.

In order to solve the above problems, embodiments of the present disclosure provide a quantum secure communication method, including:

The first device obtains the first quantum key and/or the first quantum random number from the first network, or obtains the first quantum key and/or the first quantum random number locally;

A second quantum key and/or a second quantum random number are provided to the second device.

Wherein, the method also includes:

The first device determines whether the second device at the destination belongs to a node in this area.

Among them, the first device determines whether the second device at the destination belongs to the node in the local area, including:

The first device receives the first message sent by the second device at the source end; the first message carries device-related information of the second device at the destination end;

Determine whether the second device at the destination belongs to a node in this area according to the device-related information of the second device at the destination.

Wherein, providing the second quantum key and/or the second quantum random number to the second device includes:

A second quantum key and/or a second quantum random number are provided for the second device at the source end and the second device at the destination end.

Wherein, providing a second quantum key and/or a second quantum random number to a plurality of second devices includes:

The first device directly provides the second quantum key and/or the second quantum random number to the second source device and the second destination device;

Or, the first device only provides the second quantum key and/or the second quantum random number to some of the second devices, causing the part of the second devices to send the second quantum key and/or the second quantum key to other second devices participating in the communication. /or second quantum random number.

Wherein, said providing a second quantum key and/or a second quantum random number includes:

Provide the second device with the corresponding second quantum key and/or second quantum random number;

Or, encrypt the second quantum key and/or the second quantum random number corresponding to the second device, and then provide the encrypted second quantum key and/or the second quantum random number.

Wherein, encrypting the second quantum key and/or the second quantum random number corresponding to each second device respectively includes:

Using the first key to encrypt the second quantum key and/or the second quantum random number; Wherein, the first key is a symmetric key between the first device and each second device;

Or, use the public key corresponding to the digital certificate of the second device to encrypt the second quantum key and/or the second quantum random number.

Wherein, the method also includes:

The first device receives the first message sent by the second device at the source end; the first message carries at least one of the following information: device-related information, service-related information, key-related information of the second device at the destination end, first identification;

Obtain the second quantum key and/or the second quantum random number, and the first identification;

A second quantum key and/or a second quantum random number, and the first identification are provided to the second device at the source end and/or the second device at the destination end.

Wherein, the provision of the second quantum key and/or the second quantum random number, and the first identification to the source second device and/or the destination second device include one of the following:

Provide the second quantum key and/or the second quantum random number and the first identification to the source second device, so that the source second device sends the first identification to the destination second device;

Provide the second quantum key and/or the second quantum random number and the first identification to the second device at the destination end, so that the second device at the destination end provides the first identification to the second device at the source end;

A second quantum key and/or a second quantum random number and the first identification are provided to the source-side second device and the destination-side second device.

Wherein, the first device obtains the first quantum key and/or the first quantum random number from the first network, including:

The first device receives a second message sent by the second device at the source end for requesting a quantum key;

Send the fourth message to the first KM in the QKD network;

Receive the first quantum key and/or the first quantum random number sent by the first KM.

Wherein, the first quantum key is obtained by negotiation between the first KM and the second KM after receiving the fourth message.

Wherein, the method also includes:

The first device determines that the first KM is required to provide the first quantum key, or the first device determines that the first quantum key in the current cache pool cannot meet the usage requirements.

Wherein, the second message carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

The first device obtains the second identity according to the second message, or the first device allocates the second identity to this request.

Provide a second quantum key and/or a second quantum random number, and the second identification to the second device at the source end.

Wherein, the method also includes:

Send a third message to a third device that provides a quantum key service for the second device at the destination.

Wherein, the third message carries the second identifier.

Wherein, the third message is used for:

causing the third device to provide the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when the third device receives the fifth message carrying the second identifier sent by the second device at the destination, it provides the second quantum key and/or the second quantum key to the second device at the destination according to the second identifier. Or second quantum random number.

Wherein, the method also includes:

Obtain the first quantum key and/or the first quantum random number from the cache pool.

Wherein, the method also includes:

The first device stores the first quantum key and/or the first quantum random number obtained from the first network to obtain the cache pool;

The first quantum key in the cache pool is obtained through negotiation between the first KM and the second KM in the QKD network.

Wherein, the method also includes:

The first device determines to obtain the first quantum key from the cache pool.

Correspondingly, the method also includes:

The first device obtains the second identity according to the second message, or the first device allocates the second identity for this key service.

Wherein, the method also includes:

Wherein, the third message carries the second identifier.

Wherein, the third message is used for:

Wherein, the third message carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.

Wherein, the third identifier is used for:

The third device is caused to obtain the corresponding first quantum key and/or the first quantum random number from the cache pool according to the third identification.

Wherein, the method also includes:

Receive a third identification sent by a third device, where the third identification is used to identify the first quantum key and/or the first quantum random number.

A second quantum key and/or a second quantum random number are provided to the second device for use by the second device for security applications.

Wherein, the second quantum key and/or the second quantum random number are used as a session key, a key protection key, a root key, a master key, an encrypted storage key, and an authentication key, and are used by the second equipment used.

Wherein, providing the second quantum key and/or the second quantum random number to the second device includes at least one of the following situations:

Send the second quantum key and/or the second quantum random number to the second device online;

Offline filling of the second quantum key and/or the second quantum random number into the second device;

Provide the second quantum key and/or the second quantum random number to the second device in a wired manner;

Provide the second quantum key and/or the second quantum random number to the second device in a wireless manner.

An embodiment of the present disclosure also provides a quantum secure communication device, including:

A processing module, configured to obtain the first quantum key and/or the first quantum random number from the first network, or obtain the first quantum key and/or the first quantum random number locally;

A sending module, configured to provide the second quantum key and/or the second quantum random number to the second device.

An embodiment of the present disclosure also provides a device, including a memory, a processor, and a program stored on the memory and executable on the processor. When the processor executes the program, the above method is implemented.

Embodiments of the present disclosure also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the above method are implemented.

Embodiments of the present disclosure also provide a quantum secure communication method, including;

Receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or obtain the first quantum key and/or the first quantum random number from the buffer pool;

Provide the second quantum key and/or the second quantum random number to the second device at the destination.

Wherein, the receiving the first quantum key and/or the first quantum random number sent by the second KM in the QKD network includes:

Send the seventh message to the second KM in the QKD network, and receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network;

Or, through listening mode, wait for the second KM in the QKD network to send the first quantum key and/or the first quantum random number.

Wherein, the method also includes:

Receive a third message sent by a first device that provides a quantum key service for a second source device.

Wherein, the third message also carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.

Wherein, the method also includes:

The third device obtains the corresponding first quantum key and/or first quantum random number from the buffer pool according to the third identification.

Wherein, the method also includes:

After receiving the third message, a third identification is sent to the first device, where the third identification is used to identify the first quantum key and/or the first quantum random number.

Wherein, providing the second quantum key and/or the second quantum random number to the second device at the destination includes:

Actively provide the second quantum key and/or the second quantum random number to the destination second device;

Or, after receiving the fifth message sent by the second device at the destination, provide the second quantum key and/or the second quantum random number to the second device at the destination.

Wherein, the third message carries the second identifier.

The third device provides the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when receiving the fifth message carrying the second identifier sent by the second device at the destination, the third device provides the second quantum key and/or the second quantum key at the destination according to the second identifier. Second quantum random number.

A receiving unit, configured to receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or to obtain the first quantum key and/or the first quantum random number from the buffer pool;

A sending unit, configured to provide the second quantum key and/or the second quantum random number to the second device at the destination.

Embodiments of the present disclosure also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the method as described above are implemented.

Embodiments of the present disclosure also provide a quantum cryptography service network, including several first devices as described above, and/or several third devices as described above.

Embodiments of the present disclosure also provide a quantum secure communication system, including: the quantum cryptography service network, the first network and the user network as described above.

The above technical solution of the present disclosure has at least the following beneficial effects:

In the quantum secure communication method and device, quantum cryptography service network and quantum secure communication system of the embodiments of the present disclosure, the integration and docking of the user network and the first network are realized in a loosely coupled manner through the first device, thereby meeting the requirements of future networks and services. The demand for diversified and large-scale applications of quantum cryptography.

Description of the drawings

Figure 1 shows a schematic structural diagram of a quantum secure communication network in current technology;

Figure 2 shows one of the step flow charts of the quantum secure communication method provided by the embodiment of the present disclosure;

Figure 3 shows the second step flow chart of the quantum secure communication method provided by the embodiment of the present disclosure;

Figure 4 shows a schematic structural diagram of a quantum secure communication system provided by an embodiment of the present disclosure;

Figure 5 shows a schematic diagram of the service area of the quantum cryptography service center provided by the embodiment of the present disclosure;

Figure 6 shows an example diagram of a quantum secure communication method provided by an embodiment of the present disclosure;

Figure 7 shows the third step flow chart of the quantum secure communication method provided by the embodiment of the present disclosure;

Figure 8 shows a schematic diagram of local quantum cryptography services and quantum secure communication processing in an embodiment of the present disclosure;

Figure 9 shows one of the schematic diagrams of cross-region quantum cryptography service and quantum secure communication processing in an embodiment of the present disclosure;

Figure 10 shows the second schematic diagram of cross-regional quantum cryptography service and quantum secure communication processing in the embodiment of the present disclosure;

Figure 11 shows one of the structural schematic diagrams of the quantum secure communication device provided by an embodiment of the present disclosure;

Figure 12 shows a schematic structural diagram of the first device provided by an embodiment of the present disclosure;

Figure 13 shows the second structural schematic diagram of the quantum secure communication device provided by the embodiment of the present disclosure;

Figure 14 shows a schematic structural diagram of a third device provided by an embodiment of the present disclosure.

Detailed ways

In order to make the technical problems, technical solutions and advantages to be solved by the present disclosure clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

As shown in Figure 1, a current quantum secure communication network consists of a Quantum Key Distribution (QKD) network that provides key distribution capabilities and a user network that uses keys distributed by the QKD network to implement cryptographic applications. The QKD network part includes the quantum layer, key management layer, QKD Network (QKDN, QKDN) control layer and QKDN network management layer. The user network part includes the application layer and the user network management layer.

On the business side, the QKDN key management layer is a bridge connecting the QKD network and the user network (the QKDN network management layer and the user network network management layer are also connected through the Mu reference point, but they belong to the management plane and are not within the scope of this patent). It is responsible for receiving and storing the quantum keys generated by the quantum layer QKD module and managing the entire life cycle; completing the long-distance relay of quantum keys and realizing QKD end-to-end key distribution; passing through the Ak reference point/Ak interface. The quantum keys generated by the QKD network and synchronized at both ends of the communication are provided to the applications of the user network, so that the applications on both sides of the communication can use the quantum keys provided by the QKD network to achieve secure communication. Here, the Ak reference point is very critical. It is responsible for connecting the cryptographic application (Application, APP) and the key supply agent (KSA) function module of the key management layer. Its main function is to be responsible for the communication between the cryptographic application and the KSA. Mutual authentication, and KSA provide quantum keys to cryptographic applications.

However, how to use the Ak interface to manage the entire life cycle of quantum key generation and distribution under this architecture is an issue that needs to be solved urgently.

The embodiment of the present disclosure provides a quantum secure communication method, as shown in Figure 2, including:

S201. The first device obtains the first quantum key and/or the first quantum random number locally;

S202. Provide the second quantum key and/or the second quantum random number to the second device.

Among them, the first device here may be a Key Manager (Key Manager, KM) in the QKD network. In addition, the QKD network here can also be called quantum key distribution QKD network, quantum secure communication network, quantum communication network, quantum network, network layer, etc.

The second device here is a variety of security devices that use quantum keys and/or quantum random numbers to carry out secure communications, secure authentication, secure storage, etc., thereby enabling diversified business applications. In the quantum secure communication network functional architecture model, relative to the quantum key distribution network, the second device belongs to the application layer of the user network. Specific business applications can be, for example, data transmission on backbone lines, off-site disaster recovery in data centers, secure communications for mobile or fixed end users (such as encrypted voice calls, encrypted calls, encrypted voice calls, encrypted video calls, encrypted video calls) , encrypted instant messaging, encrypted intercom, encrypted video conferencing, etc.), Internet digital services between terminals and servers (such as e-government, e-finance, e-energy, etc.), satellite-based integration of air, space, earth and sea in a wide-area environment Secure communication (based on Internet Protocol Security (IPSec), Transport Layer Security (TLS), etc.), secure storage of sensitive information, etc., they will all be further connected with quantum confidential communication, with the help of quantum information technology Improve your own business security capabilities. In some embodiments, sending the quantum key and/or the quantum random number to the second device may also be referred to as sending the quantum key and/or the quantum random number to the second application, the second network element, the second function, the second entity, the second organization, the second The unit, second module, second component, etc. send the quantum key and/or quantum random number, and the principle is to use the quantum key and/or quantum random number provided by the first device for business processing to ensure the security of the information. The second device may be located at the user network layer or application layer of the quantum secure communication network, or at the quantum cryptography application layer.

The sending of the quantum key to the second device here may also be an active push/send, that is, the first device will actively push the second quantum key and/or the second quantum random number to the second device, and further may be periodic. Sexual push or event-triggered push, etc.; of course, it can also be sent passively, that is, the second device will actively obtain the second quantum key and/or the second quantum random number from the first device, and then the first device will send the second quantum key to the second device. Second quantum key and/second quantum random number.

In addition, the key here refers to a certain secret information used to complete cryptographic applications such as encryption, decryption, and integrity verification. In symmetric cryptography, the same key is used for encryption and decryption, so the key needs to be kept secret. In public key cryptography, the keys used for encryption and decryption are different: one is public, called the public key; the other is kept secret, called the private key. Quantum keys are keys generated based on the principles of quantum mechanics and based on the uncertainty of the state of quantum particles. Quantum keys have true randomness. Quantum random numbers are based on the principles of quantum mechanics and are random number sequences generated based on the uncertainty of the state of quantum particles. They are truly random. Quantum random numbers can be transmitted openly in channels in practical applications. In this disclosure, the equivalent of quantum keys and quantum random numbers can be used in various embodiments provided by this disclosure. To simplify the description, quantum keys will be used as examples in the following, but it can be understood that , the content explained with examples is also applicable to quantum random numbers. Furthermore, in the present disclosure, a key may also be called a password, which has the same meaning.

The first quantum key and the second quantum key here may be the same, that is, the quantum key provided locally by the first device is sent to the second device. Specifically, the first device may provide the first quantum key to the second device in real time after obtaining the first quantum key locally; it may also be that the first device locally generates the first quantum key and stores it. , and then provide the stored first quantum key to the second device.

The first quantum key and the second quantum key here can also be different. For different situations, there may be the following: 1) After the first device obtains the first quantum key locally, it performs a verification on the key. The second quantum key is obtained through a series of processes, and then the second quantum key is provided to the second device; 2) It can be understood that multiple first quantum keys can be generated locally, and the first device can generate multiple first quantum keys locally. Select at least one second quantum key from the key, that is, the second quantum key can be a subset of the first quantum key, and the first device then provides the second quantum key to the second device; further, the first After the device generates multiple first quantum keys locally, it can perform key selection in real time to obtain the second quantum key, or it can first store the multiple generated first quantum keys, and then store the first quantum keys in the stored first quantum keys. The second quantum key is obtained by selecting from the key set; 3) It can be a combination of method 1 and method 2, that is, processing first and then selecting, or selecting first and then processing.

The relationship between the first quantum random number and the second quantum random number is similar to the relationship between the first quantum key and the second quantum key, and will not be described again here.

In some embodiments, providing the second quantum key and/or the second quantum random number to the second device in step S202 includes:

S2021. Provide the second quantum key and/or the second quantum random number to the second device, where the second quantum key and/or the second quantum random number are used by the second device for security applications.

Among them, the security applications here can be various applications such as confidential communication, security authentication, and encrypted storage.

Further, the second quantum key and/or the second quantum random number here are used as a session key, a key protection key, a root key, a master key, an encryption storage key, and an authentication key. Two devices are used. That is to say, the role of the second quantum key is determined by the second device according to the specific security application form. The first device is only responsible for providing the second quantum key.

In some embodiments, providing the second quantum key and/or the second quantum random number to the second device in step S202 includes at least one of the following situations:

However, the current quantum secure communication network system technology based on QKD technology mainly focuses on the networking architecture, module functions, operating procedures, communication protocols, equipment and interfaces of the QKD quantum key distribution network, etc., and lacks the user network and business application levels. Research. Since the quantum cryptography application scenario envisioned when designing the QKD network architecture shown in Figure 1 is relatively single, the QKD key management technology solution used is also relatively simple, and is only distinguished based on the identification of the cryptographic application APP and QKD key stream. Different business applications, without dividing and managing businesses and users at different levels and coarse and fine granularity, cannot meet the needs of future business diversification and large-scale development.

In response to the above problems, embodiments of the present disclosure propose a quantum secure communication application service system architecture and method to more effectively meet the application needs of future diversified businesses and large-scale users for quantum cryptography.

The embodiment of the present disclosure provides yet another quantum secure communication method, as shown in Figure 3, including:

S301. The first device obtains the first quantum key and/or the first quantum random number from the first network, or obtains the first quantum key and/or the first quantum random number locally;

S302. Provide the second quantum key and/or the second quantum random number to the second device.

The system architecture to which the method provided by the embodiment of the present disclosure is applied can be shown in Figure 4. Referring to Figure 4, it should be noted that:

(1) The first device can be a quantum key service center, that is, a device that provides quantum key services, or it can have other names, such as quantum key server, quantum key service platform, quantum key service equipment, quantum Key management equipment, quantum key cloud service platform or system, quantum (confidential) communication service center, quantum basic key management center, quantum cryptography server, quantum cryptography service center, quantum cryptography service platform, quantum key management equipment, quantum Basic password management center, etc.;

(2) The first network can be a quantum key distribution QKD network, a quantum secure communication network, a quantum communication network, a quantum network, and can also be called the first network layer or the QKD network layer;

(3) The second device is a security device that uses quantum keys and/or quantum random numbers to carry out various security devices such as secure communication, secure authentication, and secure storage, thereby enabling diversified business applications. In the quantum secure communication network functional architecture model, relative to the quantum key distribution network, the second device belongs to the application layer of the user network. Specific business applications can be, for example, data transmission on backbone lines, off-site disaster recovery in data centers, secure communications for mobile or fixed end users (such as encrypted voice calls, encrypted calls, encrypted voice calls, encrypted video calls, encrypted video calls) , encrypted instant messaging, encrypted intercom, encrypted video conferencing, etc.), Internet digital services between terminals and servers (such as e-government, e-finance, e-energy, etc.), satellite-based integration of air, space, earth and sea in a wide-area environment Secure communications (based on IPSec, TLS, etc.), secure storage of sensitive information, etc., will all be further integrated with quantum confidential communications and improve their business security capabilities with the help of quantum information technology.

In some embodiments, sending the quantum key and/or the quantum random number to the second device may also be referred to as sending the quantum key and/or the quantum random number to the second application, the second network element, the second function, the second entity, the second organization, the second The unit, second module, second component, etc. send the quantum key and/or quantum random number, and the principle is to use the quantum key and/or quantum random number provided by the first device for business processing to ensure the security of the information.

The second device may be located at the user network layer or application layer of the quantum secure communication network, or at the quantum cryptography application layer;

(4) The first device is located between the first network and the second device and can form an independent middle layer to serve as a link between the previous network and the second device. This intermediate layer can be called the quantum cryptography (application) service layer, or the quantum (secrecy) communication application service layer, or the quantum basic key management layer, etc.;

(5) The first device can actively obtain the first quantum key and/or the first quantum random number from the first network. For example, the first device actively requests the first network to obtain the first quantum key and/or the first quantum random number. Further, the first device can obtain it periodically or by event triggering. Acquisition, etc.; of course, it can also be acquired passively, that is, the first network actively pushes the first quantum key and/or the first quantum random number to the first device, or it can be a periodic push or an event-triggered push, etc.;

(6) Sending the quantum key to the second device can also be an active push/send, that is, the first device will actively push the second quantum key and/or the second quantum random number to the second device. Further, it can be Periodic push or event-triggered push, etc.; of course, it can also be sent passively, that is, the second device will actively obtain the second quantum key and/or the second quantum random number from the first device, and then the first device will send the second quantum key to the second device. Send the second quantum key and/or the second quantum random number.

(7) Key refers to a certain secret information used to complete cryptographic applications such as encryption, decryption, and integrity verification. In symmetric cryptography, the same key is used for encryption and decryption, so the key needs to be kept secret. In public key cryptography, the keys used for encryption and decryption are different: one is public, called the public key; the other is kept secret, called the private key. Quantum keys are keys generated based on the principles of quantum mechanics and based on the uncertainty of the state of quantum particles. Quantum keys have true randomness. Quantum random numbers are based on the principles of quantum mechanics and are random number sequences generated based on the uncertainty of the state of quantum particles. They are truly random. Quantum random numbers can be transmitted openly in channels in practical applications.

In this disclosure, the equivalent of quantum keys and quantum random numbers can be used in various embodiments provided by this disclosure. To simplify the description, quantum keys will be used as examples in the following, but it can be understood that , the content explained with examples is also applicable to quantum random numbers.

In this disclosure, a key may also be referred to as a password, which has the same meaning.

(8) The first quantum key is provided by the QKD network to the first device, and the second quantum key is provided by the first device to the second device.

The first quantum key and the second quantum key may be the same, that is, the first device sends the quantum key provided by the QKD network to the second device. Specifically, the first device may provide the first quantum key to the second device in real time after receiving the first quantum key; or the first device may, after receiving the first quantum key, first Store, and then provide the stored first quantum key to the second device.

Of course, the first quantum key and the second quantum key can also be different. For different situations, there may be the following: 1) After the first device obtains the first quantum key from the QKD network, it performs a verification on the key. A series of processes are performed to obtain the second quantum key, and then the second quantum key is provided to the second device; 2) It can be understood that the QKD network will provide multiple first quantum keys to the first device, and the first device obtains the second quantum key from the QKD network. After the network obtains multiple first quantum keys, it selects at least one second quantum key among the multiple first quantum keys. That is, the second quantum key can be a subset of the first quantum keys. The first The device then provides the second quantum key to the second device; further, after acquiring multiple first quantum keys, the first device can perform key selection in real time to obtain the second quantum key, or it can first Store multiple first quantum keys, and select the second quantum key from the stored first quantum key set; 3) It can be a combination of method 1 and method 2, that is, process first and then select, or select first Post-processing. The relationship between the first quantum random number and the second quantum random number is similar to the relationship between the first quantum key and the second quantum key, and will not be described again here.

Among them, for the situation where the first device needs to store multiple first quantum keys to obtain a first quantum key cache pool, this method can effectively ensure that the application requirements of the second device for quantum keys are met.

Specifically, the current QKD network mainly uses single photons as the basic quantum particles, and performs key negotiation between end nodes through the BB84 or GG02 protocol. The performance is very limited. It can only negotiate and generate hundreds to thousands of bits per second. Key amount. However, the upper-layer second device supports a variety of applications, and each application also has different requirements for the number of keys. In order to achieve theoretically absolutely secure information transmission and realize one-time padding, the QKD network needs to be able to support QKD key negotiation capabilities that are greater than the data transmission rate. For example, the voice data rate encoded using the Adaptive Multi-Rate (AMR) method is usually 4.75kbps ~ 23.85kbps. Obviously, the rate of quantum key generation by the QKD network is far less than that between the second device The rate of data transfer. In addition, when the second device has multiple concurrent services or multiple second devices generate concurrent service requests, there will also be an instantaneous large demand for quantum keys. Due to the low quantum key negotiation rate of the QKD network, it cannot meet the real-time demand for quantum keys of concurrent services.

In the embodiment of the present disclosure, this problem is solved by the first device located between the QKD network and the second device. Specifically, one possible scenario is that although the QKD network generates quantum keys at a slow rate, it can always generate keys and continuously send them to the first device. The first device will securely store the multiple first quantum keys received to form a key set or key pool. A large number of quantum keys provided by the QKD network can be pre-stored in the key collection/key pool. The second device does not need the quantum key negotiated in real time by the QKD network to communicate. Therefore, when it is necessary to provide the second device with a quantum key, it can select the pre-negotiated QKD quantum key from the key set or key pool. The key is provided to the second device. In this way, the above problems can be solved.

In summary, the embodiments of this disclosure propose to add an intermediate layer between the quantum key distribution network and the user network layer to realize the integration and docking of the underlying quantum network and upper-layer user applications. The middle layer here can be called the quantum cryptography service layer, or the quantum (secret) communication application service layer, or the quantum basic key management layer, etc. It can be composed of one or more quantum cryptography service centers, cloud service platforms or systems. (Also known as: quantum (secrecy) communication service center, quantum basic key management center, etc.), thereby forming a quantum cryptography service network or a quantum confidentiality communication service network.

The quantum cryptography service layer separates the original tightly coupled QKD quantum network layer and quantum cryptography application layer to reduce the degree of coupling between the two and serve as a link to facilitate the integrated development of QKD networks and applications. On the one hand, it extracts the basic common capabilities of the underlying QKD network, and uniformly encapsulates the common capabilities to form a standard service interface that can be directly called by the upper layer, thus shielding the system architecture, topology, working mechanism, equipment differences, etc. of the underlying quantum QKD network. The impact of implementation details makes the underlying quantum QKD network transparent to upper-layer quantum cryptography applications, simplifying the complexity of upper-layer QKD capability management applications; on the other hand, it manages and controls massive users in different upper-layer networks and business scenarios. Integrate the application requirements of upper-layer quantum cryptography to form unified quantum cryptography application requirements and propose them to the underlying QKD network to facilitate the implementation of the Ak interface, thus avoiding the impact and impact on the underlying quantum network caused by the direct access of massive and diversified services in the upper layer. The impact is conducive to the rapid proliferation and development of various quantum cryptography business applications. Each new business only needs to be connected and adapted with the middle layer to obtain quantum security capabilities. The underlying QKD network is no longer required to adapt to the new business, which reduces the complexity of QKD network and business implementation at the same time.

In addition, referring to Figure 4, the quantum cryptography service center is the core entity of the quantum cryptography service layer. In the southbound direction, it connects to the quantum QKD network through the Ak interface and obtains the symmetric key or quantum random number generated by the QKD network. In the northbound direction, it interfaces with various business applications of the quantum cryptography application layer through the As interface to provide quantum cryptography on demand. At the same time, the quantum cryptography service center can also deploy quantum random number generators locally to generate quantum random numbers and keys for use by various upper-layer business applications.

Each quantum cryptography service center has a certain service scope. It interfaces with the QKD quantum network key management equipment node (for example, quantum key manager (KM)) in the area through the Ak interface to provide Users provide quantum cryptography services, as shown in Figure 5. For example, the quantum cryptography service center deployed in area A (for example, Beijing) allows Beijing's network equipment and business applications (for example, equipment A and B) to access and provide services. The quantum cryptography service center deployed in area B (for example, Shanghai) provides services to users in Shanghai (for example, device C), and so on. Therefore, the quantum cryptography service center manages and maintains users in the area according to service areas and provides quantum cryptography services. Including, completing the registration and activation of upper-level users and services, supporting the change/cancellation of user quantum cryptography services, maintaining user business status information, performing secure identity authentication for access users, authorizing quantum cryptography services, and providing users with quantum cryptography security media ( For example, Universal Serial Bus (USB) Key, Flash (Trans Flash, TF) password card, Subscriber Identity Module (SIM) card, security chip, etc.), to offline The method is to fill the user's security medium with quantum keys, and provide users with quantum cryptography (including quantum random numbers, quantum keys, etc.) or quantum cryptography security services (including encryption, decryption, and integrity based on quantum cryptography) online. Protection/verification, digital signature/signature verification and other password protection), etc.

Quantum cryptography service centers are interconnected to generate quantum keys required for upper-layer user applications through QKD network negotiation. Therefore, multiple (two or more) quantum cryptography service centers can be formed to form a service network, which communicates with the underlying QKD Corresponding to the network, quantum cryptography services are provided to upper-layer users in a wide area.

In some implementations, the method provided by the embodiment of the present disclosure further includes:

S301′ The first device determines whether the second device at the destination belongs to a node in this area.

The domain here refers to the service range in which the first device provides quantum key services. In addition, there is no necessary sequence between the steps of judgment here and the steps of the first device obtaining the first quantum key and/or the first quantum random number from the QKD network.

During the specific implementation, the second device at the source end needs to initiate a quantum confidential communication request to the second device at the destination end. At this time, the second device at the source end needs to initiate a key request to the first device that provides quantum key services to obtain and The quantum key used by the second device at the destination for secure communication. Furthermore, the first device needs to determine whether the second device at the destination belongs to a node in this area, and perform subsequent processing based on the determination result. In addition, the source end can also be called the active end, and the destination end can also be called the passive end.

Further, in step S301', the first device determines whether the second device at the destination belongs to the local node, including:

A) The first device receives the first message sent by the second device at the source end; wherein the first message carries device-related information of the second device at the destination end;

B) Determine whether the second device at the destination belongs to a node in this area according to the device-related information of the second device at the destination.

Specifically, the relevant information of the second device at the destination can be implemented in a variety of ways. For example, it can be the device information (address, identification, etc.) of the second device at the destination, or it can be the belonging information (for the second device at the destination). The second device at the destination provides information about the first device providing quantum key services).

In some implementations, step S302 provides the second quantum key and/or the second quantum random number to the second device, which may include:

S302' provides a second quantum key and/or a second quantum random number to the source-side second device and the destination-side second device.

In actual situations, there may be the following situations:

(1) After judgment, the first device determines that the second device at the destination belongs to this domain (this service area). In this case, the first device provides the second quantum key and/or the second quantum random number to the second source device and the second destination device.

(2) There is only one area (service area) in the area where multiple second devices are located. There is no concept of cross-zone or cross-domain in this case. Therefore, at this time, the first device does not need to determine whether the second device belongs to the local domain, and can directly provide the second quantum key and/or the second quantum random number to the source second device and the destination second device without any judgment.

In addition, in the case of multi-party communication, there may be multiple destination second devices.

In some implementations, there may be many ways to distribute keys to multiple second devices, specifically:

S302a′ The first device directly provides the second quantum key and/or the second quantum random number to the source second device and the destination second device;

Or, S302b′, the first device only provides the second quantum key and/or the second quantum random number to some second devices, so that some second devices send the second quantum key to other second devices participating in the communication. key and/or second quantum random number.

in:

The first situation means that quantum key distribution is performed by the first device, and the first device provides the second quantum key to the second device at the source end or the second device at the destination end (wherein, the second device at the destination end can be one or more);

The second case is that quantum key distribution is performed by the first device and some second devices. The first device first distributes the second quantum key to some second devices (for example, to the source second device). Then some of the second devices forward the second quantum key to other second devices participating in the communication (for example, the source second device sends it to the destination device).

In some implementations, keys distributed for multiple second devices may be processed in multiple situations, specifically as follows:

S302c′ provides the second device with the corresponding second quantum key and/or second quantum random number;

Or, S302d′ separately encrypts the second quantum key and/or the second quantum random number corresponding to the second device, and then provides the encrypted second quantum key and/or the second quantum random number.

in:

The first case is: the first device directly provides the corresponding second quantum key to the second device. In this case, generally speaking, the interaction between the first device and the second device is safe. For example, the first device and the second device are in the same physical security environment.

The second situation is: the second quantum keys corresponding to each second device are respectively encrypted and sent. In this case, generally, in order to ensure the security of communication between the first device and the second device, the second quantum key needs to be encrypted before being sent out.

For the second case, there can be a variety of encryption processing methods. Specifically, the second quantum key and/or the second quantum random number corresponding to each second device are separately encrypted, which can include:

Using a first key to encrypt the second quantum key and/or the second quantum random number; wherein the first key is a symmetric key between the first device and each second device;

For example, the symmetric key between the second device A and the first device is K1 (the symmetric key may also be called a shared key), and the symmetric key between the second device B and the first device is K2. For the second quantum key Ks to be distributed, the first device can encrypt Ks using K1 and encrypt Ks using K2, and then send them to the second device A and the second device B respectively. Then the second device A and the second device B respectively use K1 and K2 to decrypt the received encrypted information to obtain the second quantum key Ks.

Alternatively, the second quantum key and/or the second quantum random number may be encrypted using the public key corresponding to the digital certificate of the second device.

For example, the first device uses the public key corresponding to the digital certificate of the second device A to encrypt and protect the second quantum key Ks, and uses the public key corresponding to the digital certificate of the second device B to encrypt and protect the second quantum key Ks, and then sends them respectively. Give the second device A and the second device B. Then the second device A and the second device B respectively use the private keys corresponding to their respective digital certificates to decrypt the received encrypted information to obtain the second quantum key Ks.

The first device receives the first message sent by the second device at the source end; the first message carries at least one of the following information: device-related information, service-related information, key-related information, first logo;

in,

(1) After receiving the first message, the first device can obtain the second quantum key and/or the second quantum random number and the first identification based on part or all of the content carried in the first message.

(2) "Get" here can be understood as the first device obtaining it from other places, such as obtaining it from the QKD network, it can also be understood as the first device generating it by itself, or it can also be understood as the first device reading the first message. get.

(3) The generation of the first identifier can be completed by the first device or by the second device. Specifically, there are the following situations:

a. The first identifier is generated by the second device at the source end and sent to the first device through the first message. The first device obtains the first identifier by reading the first message;

b. The first identifier is generated by the first device. If the first message sent by the source second device does not contain the first identifier, then the first device will generate the first identifier by itself.

(4) The function of the first identifier is to associate the second quantum key with a transaction. The transaction here refers to a transaction that occurs during a confidential communication between the second device at the source end and the second device at the destination end. For example, make encrypted calls, carry out encrypted message transmission, etc. The first identifier is used to indicate the second quantum key to be used in this transaction. There can be many specific implementations, such as key identification, transaction identification, randomly generated identification, serial number, encoding, etc.

It should be noted that the first identifier mentioned in the embodiment of the present disclosure can be used to indicate the second quantum key to be used for one transaction, or can also be used to indicate the second quantum key to be used for two or more transactions. The key is not specifically limited here.

Furthermore, the provision of the second quantum key and/or the second quantum random number, and the first identification to the source second device and/or the destination second device include one of the following:

(1) Provide the second quantum key and/or the second quantum random number and the first identification to the second device at the source end, so that the second device at the source end sends the first identification to the second device at the destination end;

(2) Provide the second quantum key and/or the second quantum random number and the first identification to the second device at the destination end, so that the second device at the destination end provides the first identification to the second device at the source end;

(3) Provide the second quantum key and/or the second quantum random number and the first identification to the second source device and the second destination device.

In the first case, the second quantum key and the first identifier are provided to the remote second device, and the source second device sends the first identifier to the destination second device. The destination device then obtains the second quantum key from the first device according to the first identification; the second case is similar to the first case and will not be described again.

The third situation is that the first device directly delivers the second quantum key and the first identifier to the second device at the source end and the second device at the destination end.

Subsequently, the second device at the source end and the second device at the destination end will carry the first identifier when conducting quantum secure communication, so that the destination end can learn which second quantum key should be used for this communication based on the first identifier.

The above is the case where the second device at the destination is the local domain, including the method of obtaining the first quantum key from the QKD network in real time in the case of the local domain and providing the second quantum key to the second device, and the method of the first quantum key in the case of the local domain. The device retrieves the first quantum key from the cache pool and provides the second quantum key to the second device.

Next, the situation where the second device at the destination is cross-domain will be explained in detail. In the case of cross-domain, the method of obtaining the first quantum key from the QKD network in real time and providing the second quantum key to the second device, as well as the cross-domain In this case, the first device takes out the first quantum key from the buffer pool and provides the second quantum key to the second device. In order to more clearly display the message sending and receiving situation between various devices in cross-domain situations, please see Figure 6. It should be noted that FIG. 6 shows a schematic diagram of multiple message forwarding situations integrated together, and does not refer to the message sending and receiving situation in a specific situation. That is, for every situation, not all processes in Figure 6 may occur. The label n can correspond to the nth message in the text.

(1) Obtain keys in real time under cross-domain conditions

In some implementations, the first device obtains the first quantum key and/or the first quantum random number from the first network, which may include:

S3011. The first device receives the second message sent by the second device at the source end for requesting the quantum key;

S3012. Send the fourth message to the first KM in the QKD network;

S3013. Receive the first quantum key and/or the first quantum random number sent by the first KM.

The second message is a message used by the second source device to request the key from the first device. The second message may be the same as the first message above, or may be different from the first message.

Further, the first quantum key here is obtained by negotiation between the first KM and the second KM after receiving the fourth message.

The KM here can be key manager, which can be called a key manager or key management platform or key management center. The first KM can provide the KM with the quantum key for the first device in the QKD network through the tenth message, and the second KM can provide the KM with the quantum key for the third device in the QKD network through the eleventh message.

The third device here is a device that provides quantum key services for the second device at the destination, and cooperates with the first device to provide quantum cryptography security services for the application layer of the user network. The first device and the third device may belong to the same network, or may belong to the same layer (specifically, it may be called the quantum cryptography (application) service layer, or the quantum (secrecy) communication application service layer, or the quantum basic key management layer, etc.).

It is not difficult to understand that after the second KM and the first KM complete the key negotiation, the third device also needs to obtain the first quantum key after the negotiation between the first KM and the second KM. There are two ways to obtain the key: the first is for the third device to actively send a request to obtain the key to the second KM, and wait for the second KM to push the first quantum key to the third device after negotiating with the first KM. ; The second is for the third device to pass the listening mode and wait for the first quantum key pushed by the second KM to the third device after negotiating with the first KM.

After receiving the second message in step S3011, the method further includes:

S3011' The first device determines that the first KM is required to provide the first quantum key, or the first device determines that the first quantum key in the current cache pool cannot meet the usage requirements.

This step is actually a judgment step performed by the first device after receiving the second message. The judgment is used to determine whether to obtain the first quantum key from the first KM in real time or to obtain the first quantum key in the current cache pool. The content of the judgment may be "whether it is necessary to obtain the first quantum key from the first KM", or "based on the information carried in the second message (such as business information, key information, etc.) and/or the storage of the current cache pool situation (such as whether the number of currently stored keys is sufficient, whether the generation time of the key is fresh, whether the length of the key can meet the demand, etc.), etc., to determine whether the first quantum key in the current cache pool can meet the demand." .

Of course, this judgment step does not necessarily exist. For example, if the first device does not have a cache pool, or the first device is configured to obtain the first quantum secret from the first KM in real time each time it receives the second message. key, etc. In these cases, this step of judgment does not exist.

Further, the second message carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

S3011″The first device obtains the second identity according to the second message, or the first device allocates the second identity to this request.

That is to say, the second identification can be generated by the first device, specifically, after receiving the second message, the second identification is assigned to this request; it can also be generated by the second device at the source end and passed through the second The message is brought to the first device.

The function of the second identification is to associate the second quantum key with the secure communication transaction. The transaction here refers to the transaction that occurs during confidential communication between the second device at the source end and the second device at the destination end. For example, make encrypted calls, carry out encrypted message transmission, etc. The second identification is used to indicate the second quantum key to be used for the secure communication transaction. There can be many specific implementations, such as key identification, transaction identification, randomly generated identification, serial number, encoding, etc.

It should be noted that the second identifier mentioned in the embodiment of the present disclosure can be used to indicate the second quantum key to be used for one secure communication transaction, or can also be used to indicate the second quantum key to be used for two or more secure communication transactions. The second quantum key is not specifically limited here.

Furthermore, providing the second quantum key and/or the second quantum random number to the second device in step S302 includes: providing the second quantum key and/or the second quantum random number to the source second device, and said Second identification.

Specifically, when the second identifier is generated by the first device, the second source device also needs to know the second identifier, so that it can know which second quantum key is to be used for this transaction. Therefore, when the first device provides the second quantum key to the second device at the source end, it also needs to provide the second identity. That is, the ninth message in Figure 6 provides the second identity while providing the second quantum key. .

When the second identifier is generated by the second source device, and the second device provides the second quantum key to the source second device through the ninth message, the second identifier also needs to be provided to the source second device. It is learned that when performing a transaction corresponding to the second identification, the second quantum key pushed together with the second identification needs to be used.

In addition, the method also includes:

The third message can achieve a variety of functions, for example, it can be used to notify/instruct the third device to provide quantum key services for the second device at the destination, etc. There is no necessary time sequence for sending the third message and sending the fourth message.

Further, the third message may carry the second identifier.

Correspondingly, the third message can be used for:

That is to say, for the third device, the above two situations are to let the second device at the destination know which second quantum key needs to be used when performing the transaction corresponding to the second identification. Its function is to let the source end The second device and the second device at the destination synchronize and use the same key to perform secure communication.

(2) Obtain keys in real time under cross-domain conditions

S301a. The first device receives a second message sent by the second device at the source end for requesting a quantum key;

S301b. Obtain the first quantum key and/or the first quantum random number from the buffer pool.

Among them, the cache pool here is obtained in the following ways:

The first device stores the first quantum key and/or the first quantum random number obtained from the first network to obtain the cache pool; wherein the first quantum key in the cache pool is the first quantum key in the QKD network. obtained through negotiation between the first KM and the second KM.

In addition, in some implementations, the method provided by the embodiment of the present disclosure also includes: the first device determines to obtain the first quantum key from the cache pool.

What I want to talk about here is the judgment process of the first device, that is, it needs to be judged whether to obtain the first quantum key in real time or from the cache pool. Likewise, this judgment step is not necessary. For example, the first device is configured to directly obtain the first quantum key from the buffer pool without making judgment.

Further, the second message in step S301a carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

Furthermore, step S302 provides the second quantum key and/or the second quantum random number to the second device, including:

In addition, the method provided by the embodiment of the present disclosure also includes:

Among them, there is no necessary time sequence between sending the third message and obtaining the first quantum key.

Further, the third message here may carry the second identifier.

Then the third message is used for:

causing the third device to provide the second identity while providing the second quantum key and/or the second quantum random number to the destination second device through the eighth message;

In addition, the third message may also carry a third identifier, where the third identifier is used to identify the first quantum key and/or the first quantum random number.

Then the third identifier is used for:

It can be understood that, like the first device, the third device will also store the first quantum key after receiving the first quantum key sent by the second KM to form a cache pool. The first quantum key here is the first quantum key negotiated by the first KM and the second KM. While pushing the first quantum key to the first device and the third device, the first KM and the second KM will also push the third identifier corresponding to the first quantum key. After the first device sends the third identification to the third device, the third device can select the corresponding first quantum key from the cache pool according to the third identification to achieve key synchronization.

Specifically, the third identifier is used to identify the first quantum key. The main purpose of the third identifier is to synchronize the first device and the third device to obtain the key from the cache pool, that is, through the third device. identification, the first device and the third device can learn which first quantum key the other end has taken out. There are two possible situations here. The first one is as mentioned above. Specifically, the first device determines the third identifier of the first quantum key taken out, and carries the third identifier in the third message to inform the third party. The device needs to select the key corresponding to the third identifier; the second method is for the first device to send a third message. The third message can be to notify the third device to retrieve the key from the cache pool, or to notify the third device that it needs to send the key to the destination. The second device pushes the key. At this time, the third device determines the third identifier of the retrieved first quantum key. That is, the third device determines which key to select from the cache pool and returns the third identifier to the third device. A device used to inform the first device of the selection of the key, so that the first device and the third device can synchronize the extraction of the key.

In some implementations, step S302 provides the second quantum key and/or the second quantum random number to the second device, including:

In some implementations, step S302 provides a second quantum key and/or a second quantum random number to the second device, including at least one of the following situations:

The embodiment of the present disclosure also provides a quantum secure communication method, as shown in Figure 7, including;

S701. Receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or obtain the first quantum key and/or the first quantum random number from the cache pool;

S702. Provide the second quantum key and/or the second quantum random number to the second device at the destination.

In some embodiments, receiving the first quantum key and/or the first quantum random number sent by the second KM in the QKD network in step S701 includes:

S701a. Send the seventh message to the second KM in the QKD network, and receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network;

Or, S701b, wait in the listening mode for the second KM in the QKD network to send the first quantum key and/or the first quantum random number through the eleventh message.

In some implementations, the method provided by the embodiment of the present disclosure further includes: receiving a third message sent by a first device that provides a quantum key service for a second source device. Further, the third message may also carry a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number. Further, the method further includes: the third device obtains the corresponding first quantum key and/or the first quantum random number from the cache pool according to the third identification. This situation is a situation where the first device determines the third identifier.

In some implementations, the method provided by the embodiment of the present disclosure further includes: after receiving the third message, sending a third identification to the first device, the third identification being used to identify the first quantum key and/or Or the first quantum random number. In this case, the third device determines the third identifier. After the third device determines, it will also send the third identifier to the first device through the twelfth message.

In some embodiments, providing the second quantum key and/or the second quantum random number to the destination second device in step S302 includes:

Actively provide the second quantum key and/or the second quantum random number to the destination second device through the eighth message;

In some implementations, the third message may carry the second identifier.

Further, in step S302, providing the second quantum key and/or the second quantum random number to the second device at the destination includes:

Wherein, the second device at the destination obtains the second identification through the sixth message sent by the second device at the source. As mentioned above, the second identifier may be assigned by the second source device, or may be notified by the first device to the source second device after being assigned. After the second device at the source side learns the second identity, the second identity is sent to the second device at the destination end through the sixth message, so that the second device at the destination end can obtain it from the third device according to the second identity for this time. The quantum key of the transaction (you can actively obtain it based on the second identifier, or you can passively wait for the push from the third device, and determine the second quantum key used in this transaction based on the second identifier in the push message).

In order to describe the method provided by the present disclosure more clearly, the overall process of the method is described below by way of example.

When an upper-layer user has a business need to initiate communication, the quantum cryptography service center determines how to provide quantum cryptography services based on the service areas to which both communicating parties belong, that is, whether it is a local service or a cross-region service. For two business applications that communicate within the same service area (for example, quantum cryptography application equipment A and B in Figure 5), the quantum cryptography service center provides local services. It does not need to call the quantum key negotiation capability of the underlying QKD network, but only obtains the quantum random number generated by the local QKD network node device or the local quantum random number generator through the Ak interface, and then generates a symmetric quantum key and provides it to the upper layer. Thereby meeting the cryptographic application requirements of the two communication services. For two business applications belonging to different service areas (for example, quantum cryptography application equipment A and C in Figure 5), the quantum cryptography service center provides cross-regional services. At this time, it needs to interact with the quantum cryptography service center that provides services at the opposite end and obtain the symmetric quantum key through quantum QKD network negotiation, and provide it to the two business applications.

Figure 8 shows the process flow of two quantum cryptography application devices A and B that belong to the same area and obtain services from the same quantum cryptography service center A to achieve quantum confidential communication. Here, the quantum cryptography application device is just an example chosen for convenience of explanation, and it can refer to any network device or business application at the user level. The following processes are similar and will not be described again.

1. When quantum cryptography application devices A and B need to communicate securely based on quantum keys, A sends a quantum secure communication request message to B. The message can carry the identification of the home service center that provides quantum cryptography services for device A and security-related information. Security-related information is used to complete quantum communication encryption negotiations, and can include quantum key-related information (such as key amount, key acquisition method, etc.), encryption-related information (such as encryption method (such as encryption (such as stream encryption, etc.), Block encryption, etc.), integrity protection, etc.), encryption algorithms, etc.).

2. Quantum cryptography application device B returns a quantum confidential communication response message to A, which can carry the quantum cryptography service center identification of device B and the security-related information confirmed by B.

Steps 1 to 2 are the establishment process of quantum secure communication between A and B. This is only a schematic explanation. This establishment process will be different in different applications. It may be an interaction between a business request and a response message, or it may be an interaction between a series of protocol messages. For example, in the quantum encrypted telephone service, the process is to complete the interaction of the call request and the call response message. The message can carry a confidential communication identifier to indicate the security attribute of the service; in the confidential communication service based on the IPSec protocol, the process includes Two stages of message interaction, based on the IPSec protocol, complete identity authentication and quantum encryption service negotiation between the communicating devices; and so on.

3. Quantum cryptography application device A sends a key request to its home quantum cryptography service center A through the As interface, which carries the identification/addresses A and B of the source and destination of the communication, business-related information and key-related information, etc. Business-related information is used to describe the business identifier, type and attributes of this quantum secure communication, and is used to distinguish the diversified services at the upper level. For example, data services, voice services, email services, streaming media services, messaging services, etc. Key-related messages are used to describe the requirements of quantum cryptography application equipment A and B for quantum keys, such as key quantity, key quality of service (QoS) requirements (key transmission rate, provision time requirements, etc.) , transmission mode (such as request, push, etc.), etc. The request message may also carry the identifier of the quantum cryptography service center to which the destination belongs, which is used to determine the service area to which quantum cryptography application device B belongs.

4. After receiving the key request, quantum cryptography service center A determines whether the destination is within the area responsible for this service center based on the identification/address information of the destination device B, or the identification information A of the quantum cryptography service center that the destination belongs to. business node? If so, go to step 5; otherwise, go to the cross-region quantum secure communication processing flow (see Figure 9).

5. Quantum cryptography service center A obtains quantum random numbers locally and generates a transaction identifier (Transaction ID, TID) and quantum key K for this session. The quantum random number can be obtained by calling the quantum random number generator deployed locally in the quantum cryptography service center A, or it can be obtained from the QKD network device node in the local area through the Ak interface. The transaction identifier TID corresponds to the quantum key K and is used to identify the quantum symmetric key corresponding to this session. The quantum key is generated based on the obtained quantum random number. The quantum key K should meet the needs of the business.

6. Return a key response message to quantum cryptography application device A, which carries the transaction identifier TID and quantum key K, and optionally carries key-related information and other content. Key-related information may include system-customized parameter content, such as key generation time, key lifetime, and other information.

7. Quantum cryptography application device A sends a key notification message to B, which carries the transaction identifier TID, which is used to notify the peer to obtain the generated quantum key K.

8. Quantum cryptography application device B sends a key request to its home quantum cryptography service center A, which carries the transaction identifier TID and can carry the identities/addresses A and B of the source and destination of the communication.

9. Based on the transaction identification TID information, the quantum cryptography service center A searches for the corresponding quantum key K and feeds it back to the quantum cryptography application device B through the key response message. The message can also carry key-related information to provide system-customized parameter content, such as key generation time, key lifetime, and other information.

10. After receiving the key response, quantum cryptography application device B returns a key response message to A, informing the peer that the quantum symmetric key K to be used in this communication session has been successfully obtained.

11. Based on the obtained quantum key K, quantum cryptography application equipment A and B can start quantum secure communication.

In the above process, the transaction identifier TID is only one way to realize key notification and acquisition. Other ways can be used in actual system implementation. For example, quantum cryptography service center A can generate a token or ticket and deliver it to device B through quantum cryptography application device A. With the token or ticket, device B can obtain the corresponding quantum key K from service center A to communicate securely with device A. In order to ensure the security of these messages, when issuing TID, token or ticket, the quantum cryptography service center can protect the integrity and/or signature of the key content of the information and add a timestamp to ensure that the information will not be forged by attackers. Tampering, replaying. The following processes are similar and will not be described again.

Figure 9 shows the process flow of two quantum cryptography application devices A and C, which belong to different areas and obtain services from different quantum cryptography service centers A and B, to achieve quantum confidential communication. They adopt the method of real-time key negotiation through the quantum QKD network. way to achieve.

Steps 1 to 2 are the establishment process of quantum secure communication, which is similar to Figure 8 and will not be repeated here. Here, in the quantum secure communication response message returned by quantum cryptography application device C to A, the portable identification of the home quantum cryptography service center is B, which is different from that of quantum cryptography application device A.

3. Quantum cryptography application device A sends a key request to its home quantum cryptography service center A through the As interface, which carries the identification/addresses A and C of the source and destination of the communication, business-related information and key-related information, etc. Business-related information is used to describe the business identifier, type and attributes of this quantum secure communication, and is used to distinguish the diversified services at the upper level. For example, data services, voice services, email services, streaming media services, messaging services, etc. Key-related messages are used to describe the requirements of quantum cryptography application devices A and C for quantum keys, such as key amount, key QoS requirements (key transmission rate, provision time requirements, etc.), transmission mode (e.g., on-demand , push type, etc.) etc. The request message may also carry the identification of the quantum cryptography service center to which the destination belongs, which is used to determine the service area to which the quantum cryptography application device C belongs.

4. After receiving the key request, quantum cryptography service center A determines whether the destination is this service center based on the identification/address information of the destination quantum cryptography application device C, or the identification information B of the destination quantum cryptography service center it carries. Responsible for the business nodes in the region? If so, go to the local quantum secure communication processing flow (see Figure 8); otherwise, go to step 5.

5. Quantum cryptography service center A generates a transaction identifier TID for the cryptographic request of this quantum confidential communication, determines that the destination belongs to the quantum cryptography service center, and sends a quantum cryptography service request message to it. Among them, it carries the identification/address A and C of the source and destination quantum cryptography application equipment, transaction identification TID, business-related information, quantum key-related information, QKD service node information, etc. The transaction identifier TID is used to associate this quantum secure communication service with the quantum key for this service, so that the quantum cryptography service centers at both ends can index and manage user applications and quantum cryptography services. Business-related information is used to describe the business identifier, type and attributes of this quantum secure communication. Key-related messages are used to explain the need for quantum keys in this quantum secure communication. In addition, it can also carry QKD service node information, which is used to inform the opposite end of the quantum QKD network key management device identification/address that provides services for the local end, so that the opposite end can access it.

6. Quantum cryptography service center B returns the quantum cryptography service response message for confirmation. The message includes the transaction identifier TID and QKD service node information. QKD service node information is used to inform the peer of the quantum QKD network key management device ID/address that provides services to the peer for access by the peer.

7. Quantum cryptography service center A sends a QKD key request to the local quantum QKD network key management device A through the Ak interface, and negotiates with the peer through the underlying quantum QKD network to obtain the quantum key. The request includes the destination quantum cryptography service center/quantum QKD network key management device identification, quantum key related information, etc. The identification information is used to identify the underlying QKD network key management equipment that provides services to the destination quantum cryptography service center B for easy access. Information related to quantum keys is used to meet the demand for quantum keys in this cryptographic business.

8. Quantum QKD network key management devices A and B call the QKD network quantum layer capabilities to start key negotiation.

9a/b. After the quantum key negotiation is successful, the QKD network key management equipment provides the generated quantum key K and quantum key related information to the quantum cryptography service center through the Ak interface.

The operations in steps 7 to 9 will actually require different operations if different key negotiation methods (such as request type, push type, etc.) are used. For the sake of completeness of the process, a rough outline of the operation process is given here for reference only.

10. After the negotiation is successful, quantum cryptography service center A returns a key response message to quantum cryptography application device A, which carries the transaction identifier TID and quantum key K, and optionally carries key-related information and other content. Key-related information may include system-customized parameter content, such as key generation time, key lifetime, and other information.

11. Quantum cryptography application device A sends a key notification message to C, which carries the transaction identifier TID, which is used to notify the peer to obtain the negotiated quantum key K.

12. Quantum cryptography application device C sends a key request to its home quantum cryptography service center B, which carries the transaction identifier TID and can carry the identities/addresses A and C of the source and destination of the communication.

13. Based on the transaction identification TID information, the quantum cryptography service center B searches for the corresponding quantum key K and feeds it back to the quantum cryptography application device C through the key response message. The message can also carry key-related information to provide system-customized parameter content, such as key generation time, key lifetime, and other information.

14. After receiving the key response, the quantum cryptography application device C returns a key response message to A, informing the peer that the quantum symmetric key K to be used in this communication session has been successfully obtained.

15. Based on the obtained quantum key K, quantum cryptography application equipment A and C can start quantum secure communication.

Since the key negotiation rate of the underlying quantum QKD network is limited, for cross-regional quantum confidential communication services, the quantum cryptography service center determines the quantum cryptography service method based on the business type or needs of the upper-layer application. For businesses with high security requirements or long-lasting quantum key requirements, stable usage, but small average usage (QKD network performance can meet usage requirements) (such as data off-site disaster recovery, encrypted phone calls, encrypted videos, etc.) , when the quantum cryptography service center receives a request, it can provide it with a quantum key through real-time negotiation on the QKD network (Figure 9). For businesses that are prone to bursts or concurrency (for example, secure access, Internet data transmission, etc.), the QKD real-time negotiation method may not be able to meet the timeliness and large-concurrency cryptographic application requirements. Therefore, the quantum cryptography service center can establish a quantum cryptography service center. Key buffer pool, pre-negotiate and store certain quantum keys to meet the needs of this type of business (Figure 10). When business is idle, the quantum cryptography service center can call QKD network capabilities to negotiate with other quantum cryptography service centers to generate quantum symmetric keys, mark them, and cache them for later use.

Figure 10 shows the process flow of two quantum cryptography application devices A and C, which belong to different areas and obtain services from different quantum cryptography service centers A and B, to achieve quantum confidential communication, using pre-cached quantum keys.

Steps 1 to 4 are the same as in Figure 9 and will not be repeated here.

5. Based on the business-related information and key-related information carried in the key request, quantum cryptography service center A determines whether the quantum secret communication service can use pre-negotiated and cached quantum keys to meet application requirements? If yes, go to step 6; otherwise, go to the quantum QKD real-time negotiation process (see Figure 6).

6. Quantum cryptography service center A generates a transaction identifier TID for the cryptographic request of this quantum confidential communication, determines that the destination belongs to the quantum cryptography service center, and sends a quantum cryptography service request message to it. Among them, it carries the identification/address A and C of the source and destination quantum cryptography application equipment, transaction identification TID, business-related information, quantum key-related information, etc.

7. Quantum cryptography service center B returns the quantum cryptography service response message for confirmation. The message includes the transaction identifier TID.

8. After the negotiation is successful, quantum cryptography service center A returns a key response message to quantum cryptography application device A, which carries the transaction identifier TID and quantum key K, and optionally carries key-related information and other content. Key-related information may include system-customized parameter content, such as key generation time, key lifetime, and other information.

9. Quantum cryptography application device A sends a key notification message to C, which carries the transaction identifier TID, which is used to notify the peer to obtain the negotiated quantum key K.

10. Quantum cryptography application device C sends a key request to its home quantum cryptography service center B, which carries the transaction identifier TID and can carry the identities/addresses A and C of the source and destination of the communication.

11. Based on the transaction identification TID information, the quantum cryptography service center B searches for the corresponding quantum key K and feeds it back to the quantum cryptography application device C through the key response message. The message can also carry key-related information to provide system-customized parameter content, such as key generation time, key lifetime, and other information.

12. After receiving the key response, the quantum cryptography application device C returns a key response message to A, informing the peer that the quantum symmetric key K to be used in this communication session has been successfully obtained.

13. Based on the obtained quantum key K, quantum cryptography application equipment A and C can start quantum secure communication.

It should be noted that the present disclosure provides multiple embodiments, and permutations and combinations of multiple embodiments also fall within the protection scope of the present disclosure.

As shown in Figure 11, an embodiment of the present disclosure also provides a quantum secure communication device, applied to the first device, including:

The processing module 1101 is used to obtain the first quantum key and/or the first quantum random number from the first network, or obtain the first quantum key and/or the first quantum random number locally;

The sending module 1102 is used to provide the second quantum key and/or the second quantum random number to the second device.

As an optional embodiment, the device further includes:

The judgment module is used to judge whether the second device at the destination belongs to the node in this area.

As an optional embodiment, the judgment module includes:

The first sub-module is used to receive the first message sent by the second device at the source end; the first message carries device-related information of the second device at the destination end;

The second submodule is used to determine whether the second device at the destination belongs to a node in this area based on the device-related information of the second device at the destination.

As an optional embodiment, the sending module includes:

The first sending sub-module is used to provide the second quantum key and/or the second quantum random number to the second source device and the second destination device.

As an optional embodiment, the sending sub-module is further used to:

Directly providing the second quantum key and/or the second quantum random number to the source second device and the destination second device;

Or, only provide the second quantum key and/or the second quantum random number to some second devices, so that some second devices send the second quantum key and/or the second quantum random number to other second devices participating in the communication. random number.

As an optional embodiment, providing a second quantum key and/or a second quantum random number includes:

As an optional embodiment, encrypting the second quantum key and/or the second quantum random number corresponding to each second device separately includes:

As an optional embodiment, the device further includes:

A message receiving module, configured to receive the first message sent by the second device at the source end; the first message carries at least one of the following information: device-related information, service-related information, and key-related information of the second device at the destination end. , first identification;

Determining module, used to obtain the second quantum key and/or the second quantum random number, and the first identification;

An information providing module, configured to provide the second quantum key and/or the second quantum random number, and the first identification to the second source device and/or the second destination device.

As an optional embodiment, providing the second quantum key and/or the second quantum random number, and the first identification to the source second device and/or the destination second device include the following: A kind of:

As an optional embodiment, the processing module includes:

The third submodule is used to receive the second message sent by the second device at the source end to request the quantum key;

The fourth sub-module is used to send the fourth message to the first KM in the QKD network;

The fifth sub-module is used to receive the first quantum key and/or the first quantum random number sent by the first KM.

As an optional embodiment, the first quantum key is obtained by negotiation between the first KM and the second KM after receiving the fourth message.

As an optional embodiment, the device further includes:

The third determination module is used to determine that the first KM is required to provide the first quantum key, or the first device determines that the first quantum key in the current buffer pool cannot meet the usage requirements.

As an optional embodiment, the second message carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

As an optional embodiment, the sending module includes:

The second sending submodule is used to provide the second quantum key and/or the second quantum random number, and the second identification to the second source device.

As an optional embodiment, the device further includes:

The fourth sending module is configured to send a third message to a third device that provides quantum key services for the second device at the destination.

As an optional embodiment, the third message carries the second identifier.

As an optional embodiment, the third message is used for:

As an optional embodiment, the device further includes:

A sixth receiving module, configured to receive a second message sent by the second device at the source end to request a quantum key;

An information acquisition module is used to acquire the first quantum key and/or the first quantum random number from the cache pool.

As an optional embodiment, the device further includes:

A third processing module, configured to store the first quantum key and/or the first quantum random number obtained from the first network to obtain the cache pool;

As an optional embodiment, the device further includes:

The fourth determination module is used to determine to obtain the first quantum key from the cache pool.

Correspondingly, the device also includes:

The fourth processing module is configured to obtain a second identity according to the second message, or the first device allocates a second identity to this key service.

As an optional embodiment, the sending module includes:

The third sending sub-module is used to provide the second quantum key and/or the second quantum random number, and the second identification to the second source device.

As an optional embodiment, the device further includes:

The seventh sending module is used to send a third message to a third device that provides quantum key services for the second device at the destination.

As an optional embodiment, the third message carries the second identifier.

As an optional embodiment, the third message is used for:

As an optional embodiment, the third message carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.

As an optional embodiment, the third identifier is used for:

As an optional embodiment, the device further includes:

The eighth receiving module is configured to receive a third identification sent by a third device, where the third identification is used to identify the first quantum key and/or the first quantum random number.

As an optional embodiment, the sending module includes:

The fourth sending sub-module is used to provide the second quantum key and/or the second quantum random number to the second device, and the second quantum key and/or the second quantum random number are used to be used by the second device. Safe application.

As an optional embodiment, the second quantum key and/or the second quantum random number are used as a session key, a key protection key, a root key, a master key, an encryption storage key, and an authentication key. key, used by the second device.

As an optional embodiment, providing the second quantum key and/or the second quantum random number to the second device includes at least one of the following situations:

In the embodiment of the present disclosure, the first device is used to realize the integration and docking of the user network and the first network in a loosely coupled manner, thereby meeting the needs of future networks and services for diversified and large-scale applications of quantum cryptography.

It should be noted that the quantum secure communication device provided by the embodiments of the present disclosure is a device that can perform the above-mentioned quantum secure communication method, then all embodiments of the above-mentioned quantum secure communication method are applicable to this device, and can achieve the same or similar performance. beneficial effects.

As shown in Figure 12, a device according to an embodiment of the present disclosure includes a memory 1210, a processor 1200, and a program stored on the memory 1210 and executable on the processor 1200. The processor 1200 executes the The program implements each process in the quantum secure communication method embodiment as described above, and can achieve the same technical effect. To avoid duplication, it will not be described again here.

Embodiments of the present disclosure also provide a computer-readable storage medium on which a computer program is stored. When executed by a processor, the program implements each process in the quantum secure communication method embodiment as described above, and can achieve the same technology. The effect will not be described here to avoid repetition. Among them, the computer-readable storage medium is such as read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.

As shown in Figure 13, an embodiment of the present disclosure also provides a quantum secure communication device, applied to a third device, including:

The receiving unit 1301 is configured to receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or obtain the first quantum key and/or the first quantum random number from the buffer pool;

The sending unit 1302 is configured to provide the second quantum key and/or the second quantum random number to the second device at the destination.

As an optional embodiment, the sending unit includes:

The first sending subunit is used to send the seventh message to the second KM in the QKD network, and receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network;

Or, it is used to wait for the second KM in the QKD network to send the first quantum key and/or the first quantum random number through the listening mode.

As an optional embodiment, the device further includes:

The first receiving unit is configured to receive the third message sent by the first device that provides quantum key services for the second source device.

As an optional embodiment, the third message also carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.

As an optional embodiment, the device further includes:

An acquisition unit, configured to acquire the corresponding first quantum key and/or first quantum random number from the cache pool according to the third identification.

As an optional embodiment, the device further includes:

The second sending unit is configured to send a third identification to the first device after receiving the third message, where the third identification is used to identify the first quantum key and/or the first quantum random number.

As an optional embodiment, the sending unit is further used to:

As an optional embodiment, the third message carries the second identifier.

As an optional embodiment, the sending unit is further used to:

Provide the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when receiving the fifth message sent by the second device at the destination and carrying the second identifier, provide the second quantum key and/or the second quantum key to the second device at the destination according to the second identifier. random number.

As shown in Figure 14, an embodiment of the present disclosure also provides a device, including a memory 1410, a processor 1400, and a program stored on the memory 1410 and executable on the processor 1400. The processor 1400 executes The program implements each process in the quantum secure communication method embodiment as described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

It should be noted that the quantum cryptography service network can also be called quantum key service network, quantum cryptography/key service (network) layer, quantum cryptography/key (security) service middle layer, quantum cryptography/key security service Network/service layer, quantum cryptography/key based network/service layer, etc.

Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, magnetic disk storage, optical storage, and the like) embodying computer-usable program code therein.

The disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the disclosure. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a A device for realizing the functions specified in one process or processes and/or one block or multiple blocks in the flowchart.

These computer program instructions may also be stored in a computer-readable storage medium capable of directing a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce a paper product including instruction means, The instruction means implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, Causes a sequence of operational steps to be performed on a computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing a process or processes in a flowchart and/or a block diagram The steps for a function specified in a box or boxes.

The above are the preferred embodiments of the present disclosure. It should be noted that those of ordinary skill in the art can also make several improvements and modifications without departing from the principles described in the present disclosure. These improvements and modifications It should also be regarded as the protection scope of this disclosure.

Claims

A quantum secure communication method, including:

The first device obtains the first quantum key and/or the first quantum random number from the first network, or obtains the first quantum key and/or the first quantum random number locally;

A second quantum key and/or a second quantum random number are provided to the second device.
The method of claim 1, further comprising:

The first device determines whether the second device at the destination belongs to a node in this area.
The method according to claim 2, wherein the first device determines whether the second device at the destination belongs to a node in this area, including:

The first device receives the first message sent by the second device at the source end; the first message carries device-related information of the second device at the destination end;

Determine whether the second device at the destination belongs to a node in this area according to the device-related information of the second device at the destination.
The method according to any one of claims 1-3, wherein said providing the second quantum key and/or the second quantum random number to the second device includes:

A second quantum key and/or a second quantum random number are provided for the second device at the source end and the second device at the destination end.
The method of claim 4, wherein providing a second quantum key and/or a second quantum random number to a plurality of second devices includes:

The first device directly provides the second quantum key and/or the second quantum random number to the second source device and the second destination device;

Or, the first device only provides the second quantum key and/or the second quantum random number to some of the second devices, causing the part of the second devices to send the second quantum key and/or the second quantum key to other second devices participating in the communication. /or second quantum random number.
The method according to claim 1, wherein said providing a second quantum key and/or a second quantum random number includes:

Provide the second device with the corresponding second quantum key and/or second quantum random number;

Or, encrypt the second quantum key and/or the second quantum random number corresponding to the second device, and then provide the encrypted second quantum key and/or the second quantum random number.
The method according to claim 6, wherein encrypting the second quantum key and/or the second quantum random number corresponding to each second device respectively includes:

Using a first key to encrypt the second quantum key and/or the second quantum random number; wherein the first key is a symmetric key between the first device and each second device;

Or, use the public key corresponding to the digital certificate of the second device to encrypt the second quantum key and/or the second quantum random number.
The method of claim 1, further comprising:

The first device receives the first message sent by the second device at the source end; the first message carries at least one of the following information: device-related information, service-related information, key-related information of the second device at the destination end, first identification;

Obtain the second quantum key and/or the second quantum random number, and the first identification;

A second quantum key and/or a second quantum random number, and the first identification are provided to the second device at the source end and/or the second device at the destination end.
The method according to claim 8, wherein said providing a second quantum key and/or a second quantum random number to the source second device and/or the destination second device, and the first identification includes: One of the following:

Provide the second quantum key and/or the second quantum random number and the first identification to the source second device, so that the source second device sends the first identification to the destination second device;

Provide the second quantum key and/or the second quantum random number and the first identification to the second device at the destination end, so that the second device at the destination end provides the first identification to the second device at the source end;

A second quantum key and/or a second quantum random number and the first identification are provided to the source-side second device and the destination-side second device.
The method according to any one of claims 1-3, wherein the first device obtains the first quantum key and/or the first quantum random number from the first network, including:

The first device receives a second message sent by the second device at the source end for requesting a quantum key;

Send a fourth message to the first key manager KM in the quantum key distribution QKD network;

Receive the first quantum key and/or the first quantum random number sent by the first KM.
The method according to claim 10, wherein the first quantum key is obtained by negotiation between the first KM and the second KM after receiving the fourth message.
The method of claim 10, further comprising:

The first device determines that the first KM is required to provide the first quantum key, or the first device determines that the first quantum key in the current cache pool cannot meet the usage requirements.
The method according to claim 10, wherein the second message carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

The first device obtains the second identity according to the second message, or the first device allocates the second identity to this request.
The method according to claim 13, wherein said providing the second quantum key and/or the second quantum random number to the second device includes:

Provide a second quantum key and/or a second quantum random number, and the second identification to the second device at the source end.
The method of claim 10, further comprising:

Send a third message to a third device that provides a quantum key service for the second device at the destination.
The method according to claim 15, wherein the third message carries a second identifier.
The method of claim 16, wherein the third message is used for:

causing the third device to provide the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when the third device receives the fifth message carrying the second identifier sent by the second device at the destination, it provides the second quantum key and/or the second quantum key to the second device at the destination according to the second identifier. Or second quantum random number.
The method according to any one of claims 1-3, further comprising:

The first device receives a second message sent by the second device at the source end for requesting a quantum key;

Obtain the first quantum key and/or the first quantum random number from the cache pool.
The method of claim 18, further comprising:

The first device stores the first quantum key and/or the first quantum random number obtained from the first network to obtain the cache pool;

The first quantum key in the cache pool is obtained through negotiation between the first KM and the second KM in the QKD network.
The method of claim 18, further comprising:

The first device determines to obtain the first quantum key from the cache pool.
The method according to claim 18, wherein the second message carries at least one of the following information: device-related information, service-related information, key-related information, and second identification of the second device at the destination;

Correspondingly, the method also includes:

The first device obtains the second identity according to the second message, or the first device allocates the second identity for this key service.
The method according to claim 21, wherein providing the second quantum key and/or the second quantum random number to the second device includes:

Provide a second quantum key and/or a second quantum random number, and the second identification to the second device at the source end.
The method of claim 18, further comprising:

Send a third message to a third device that provides a quantum key service for the second device at the destination.
The method according to claim 23, wherein the third message carries a second identifier.
The method of claim 24, wherein the third message is used for:

causing the third device to provide the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when the third device receives the fifth message carrying the second identifier sent by the second device at the destination, it provides the second quantum key and/or the second quantum key to the second device at the destination according to the second identifier. Or second quantum random number.
The method according to claim 23, wherein the third message carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.
The method of claim 26, wherein the third identification is used for:

The third device is caused to obtain the corresponding first quantum key and/or the first quantum random number from the cache pool according to the third identification.
The method of claim 23, further comprising:

Receive a third identification sent by a third device, where the third identification is used to identify the first quantum key and/or the first quantum random number.
The method according to claim 1, wherein said providing the second quantum key and/or the second quantum random number to the second device includes:

A second quantum key and/or a second quantum random number are provided to the second device for use by the second device for security applications.
The method according to claim 29, wherein the second quantum key and/or the second quantum random number are used as a session key, a key protection key, a root key, a master key, and an encrypted storage key. The key, the authentication key, is used by the second device.
The method according to claim 1, wherein providing the second quantum key and/or the second quantum random number to the second device includes at least one of the following situations:

Send the second quantum key and/or the second quantum random number to the second device online;

Offline filling of the second quantum key and/or the second quantum random number into the second device;

Provide the second quantum key and/or the second quantum random number to the second device in a wired manner;

Provide the second quantum key and/or the second quantum random number to the second device in a wireless manner.
A quantum secure communication device, including:

A processing module, configured to obtain the first quantum key and/or the first quantum random number from the first network, or obtain the first quantum key and/or the first quantum random number locally;

A sending module, configured to provide the second quantum key and/or the second quantum random number to the second device.
A device, including a memory, a processor, and a program stored on the memory and executable on the processor; wherein, when the processor executes the program, the implementation of any one of claims 1-31 is achieved. method described.
A computer-readable storage medium on which a computer program is stored, wherein when the program is executed by a processor, the steps in the method of any one of claims 1-31 are implemented.
A quantum secure communication method including;

Receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or obtain the first quantum key and/or the first quantum random number from the buffer pool;

Provide the second quantum key and/or the second quantum random number to the second device at the destination.
The method of claim 35, wherein receiving the first quantum key and/or the first quantum random number sent by the second KM in the QKD network includes:

Send the seventh message to the second KM in the QKD network, and receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network;

Or, through listening mode, wait for the second KM in the QKD network to send the first quantum key and/or the first quantum random number.
The method of claim 35, further comprising:

Receive a third message sent by a first device that provides a quantum key service for a second source device.
The method according to claim 37, wherein the third message also carries a third identifier, and the third identifier is used to identify the first quantum key and/or the first quantum random number.
The method of claim 38, further comprising:

The third device obtains the corresponding first quantum key and/or first quantum random number from the buffer pool according to the third identification.
The method of claim 37, further comprising:

After receiving the third message, a third identification is sent to the first device, where the third identification is used to identify the first quantum key and/or the first quantum random number.
The method according to claim 35, wherein the providing the second quantum key and/or the second quantum random number to the destination second device includes:

Actively provide the second quantum key and/or the second quantum random number to the destination second device;

Or, after receiving the fifth message sent by the second device at the destination, provide the second quantum key and/or the second quantum random number to the second device at the destination.
The method according to claim 37, wherein the third message carries a second identifier.
The method according to claim 42, wherein providing the second quantum key and/or the second quantum random number to the destination second device includes:

The third device provides the second identification while providing the second quantum key and/or the second quantum random number to the destination second device;

Or, when receiving the fifth message carrying the second identifier sent by the second device at the destination, the third device provides the second quantum key and/or the second quantum key at the destination according to the second identifier. Second quantum random number.
A quantum secure communication device, including:

A receiving unit, configured to receive the first quantum key and/or the first quantum random number sent by the second KM in the QKD network, or to obtain the first quantum key and/or the first quantum random number from the buffer pool;

A sending unit, configured to provide the second quantum key and/or the second quantum random number to the second device at the destination.
A device, including a memory, a processor, and a program stored on the memory and executable on the processor; wherein, when the processor executes the program, the implementation of any one of claims 35-43 is achieved. method described.
A computer-readable storage medium having a computer program stored thereon, wherein the steps of the method according to any one of claims 35-43 are implemented when the program is executed by a processor.
A quantum cryptography service network includes several devices as claimed in claim 33, and/or several devices as claimed in claim 45.
A quantum secure communication system, including: the quantum cryptography service network as claimed in claim 47, a first network and a user network.