CN110971395A - Quantum key distribution method and device - Google Patents

Quantum key distribution method and device Download PDF

Info

Publication number
CN110971395A
CN110971395A CN201811141720.4A CN201811141720A CN110971395A CN 110971395 A CN110971395 A CN 110971395A CN 201811141720 A CN201811141720 A CN 201811141720A CN 110971395 A CN110971395 A CN 110971395A
Authority
CN
China
Prior art keywords
information
transmission
transmission path
sending
equipment
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
CN201811141720.4A
Other languages
Chinese (zh)
Inventor
张锋
李英涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to CN201811141720.4A priority Critical patent/CN110971395A/en
Priority to PCT/CN2019/105391 priority patent/WO2020063350A1/en
Publication of CN110971395A publication Critical patent/CN110971395A/en
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B10/00—Transmission systems employing electromagnetic waves other than radio-waves, e.g. infrared, visible or ultraviolet light, or employing corpuscular radiation, e.g. quantum communication
    • H04B10/70—Photonic quantum communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Electromagnetism (AREA)
  • Optics & Photonics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The application discloses a quantum key distribution method and device. The sending device sends quantum information to the receiving device through a quantum information transmission path, and sends first post-processing information to the receiving device through one or more transmission paths in a transmission network. And the receiving equipment sends the first negotiation information to the sending equipment through one or more transmission paths in the transmission network. The transmission network comprises Z transmission paths from the sending device to the receiving device and Z transmission paths from the receiving device to the sending device. According to the technical scheme, the quantum information transmission path is completely different from the transmission path, so that the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and the safety of the safety key can be improved.

Description

Quantum key distribution method and device
Technical Field
The present application relates to the field of communications technologies, and in particular, to a quantum key distribution method and device.
Background
Quantum Key Distribution (QKD) is an encryption mechanism that guarantees communication security. A typical QKD system is shown in fig. 1 and includes a sending device, a receiving device, and a transmission channel connecting the sending device and the receiving device. In connection with fig. 1, QKD includes two stages of quantum signal communication and post-processing. The transmitting device generates a first key. The receiving device generates a second key. The transmitting device transmits the first key to the receiving device via quantum signal communication. Then, after post-processing, the transmitting device generates a security key on the basis of the first key. The receiving device generates the secure key based on the second key.
The transmission channels shown in fig. 1 include quantum channels and classical channels, among others. And the sending equipment sends information to the receiving equipment through the quantum channel. And the sending equipment and the receiving equipment carry out information interaction in a post-processing stage through the classical channel. Because the transmission paths of the quantum channel and the classical channel are the same, an eavesdropper can easily know the classical channel, so that the eavesdropper can know and tamper the post-processing information, and the safety of the security key is reduced.
Disclosure of Invention
The application provides a QKD method, a device and a system, which can improve the difficulty of an eavesdropper in acquiring a classical channel, thereby improving the security of the security key.
In a first aspect, the present application provides a QKD method, comprising:
the sending equipment generates quantum information according to the first secret key;
the sending equipment sends the quantum information to the receiving equipment through a quantum information transmission path;
the sending device sends first post-processing information to the receiving device through one or more transmission paths in a transmission network, wherein the first post-processing information is determined by the sending device according to a basis vector of the first key, the transmission network comprises Z transmission paths from the sending device to the receiving device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are different from the quantum information transmission paths;
the sending equipment receives first negotiation information, and the first negotiation information is sent by the receiving equipment through the transmission network;
and the sending equipment performs data processing on the information of the first key according to the first negotiation information to obtain first data information, wherein the first data information is related information of a security key.
In the QKD system described herein, a quantum information transmission path and a transmission network are provided between the sending device and the receiving device. And the entity corresponding to the quantum information transmission path is an optical fiber. The transport network may be any suitable transport network for transporting QKD related information. For example, the transport network may specifically be an Optical Transport Network (OTN), a router network, a switch network, or a Synchronous Digital Hierarchy (SDH) network.
The transmission network comprises Z transmission paths from the sending equipment to the receiving equipment, Z is a positive integer greater than or equal to 1, and the Z transmission paths are different from the quantum information transmission paths. The transmitting device transmits quantum information to the receiving device using the quantum information transmission path. And when the sending equipment sends the post-processing information to the receiving equipment, selecting a transmission path from the Z transmission paths for sending.
Therefore, by adopting the implementation mode, the transmission path for sending the quantum information and the transmission path for sending the post-processing information by the sending equipment are completely different, so that the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and the safety of the safety key can be improved.
In an optional design, the sending, by the sending device, the first post-processing information to the receiving device through one or more transmission paths in a transmission network includes:
the sending equipment determines a first transmission path from Z transmission paths included in the transmission network;
the sending device generates a first data frame, where the first data frame includes the first post-processing information and path information of the first transmission path, and the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between all the node devices when the first transmission path is formed;
and the sending equipment sends the first data frame to first node equipment in the transmission network.
Wherein the sending device may transmit the first post-processing information through a transmission path. Specifically, the sending device randomly selects one transmission path from the Z transmission paths. Then, the sending device encapsulates the first post-processing information and the path information of the selected transmission path to obtain a first data frame supporting a transmission protocol of the transmission network. Further, the transmitting device transmits the first data frame to a first node device in the transport network.
By adopting the implementation mode, when the sending equipment sends the post-processing information to the receiving equipment, the sending equipment randomly selects a transmission path from the transmission network, so that the difficulty of acquiring the transmission path by an eavesdropper can be improved.
In an alternative design, the determining, by the sending device, a first transmission path from among Z transmission paths included in the transmission network includes:
the sending equipment determines a first transmission path identifier from Z transmission path identifiers, wherein the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other;
and the sending equipment determines the transmission path corresponding to the first transmission path identifier as the first transmission path.
In an optional design, the sending, by the sending device, the first post-processing information to the receiving device through one or more transmission paths in a transmission network includes:
the sending equipment divides the first post-processing information to obtain M parts of sub information, wherein M is a positive integer greater than or equal to 2;
the sending equipment determines N transmission paths from the Z transmission paths, wherein N is a positive integer less than or equal to M and less than or equal to Z, and each transmission path in the N transmission paths is used for transmitting at least one piece of sub information in the M pieces of sub information;
the sending equipment generates M data frames, wherein the M data frames correspond to the M parts of sub information one by one, each data frame in the M data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the N transmission paths, the sequence number indicates the position of the sub information in the M parts of sub information, the path information comprises equipment identifications of all node equipment contained in the corresponding transmission paths, and the upstream and downstream relations among all the node equipment when the transmission paths are formed;
and the sending equipment sends the M data frames to first node equipment in the transmission network.
In this application, the sending device transmits the first post-processing information through a plurality of transmission paths. Specifically, the sending device divides the first post-processing information into M pieces of sub information. And the sending equipment randomly selects N transmission paths from the Z transmission paths. Further, the transmitting device transmits the M molecule information through the N transmission paths.
By adopting the implementation mode, the sending equipment transmits one piece of post-processing information through a plurality of transmission paths, so that the complexity of the transmission path for transmitting one piece of post-processing information is further improved, the difficulty of capturing the post-processing information by an eavesdropper is further increased, and the safety of the safety key is further ensured.
In an optional design, after obtaining the first data information, the sending device further includes:
in response to the first data information not being the security key, the sending device determining second post-processing information from the first data information;
the sending device generates a second data frame, where the second data frame includes the second post-processing information and the path information of the first transmission path;
and the sending equipment sends the second data frame to the first node equipment in the transmission network.
In an optional design, after obtaining the first data information, the sending device further includes:
in response to the first data information not being the security key, the sending device determining second post-processing information from the first data information;
the sending equipment determines a second transmission path from the Z transmission paths;
the sending device generates a second data frame, where the second data frame includes the second post-processing information and path information of the second transmission path;
and the sending equipment sends the second data frame to the first node equipment in the transmission network.
Wherein the post-processing comprises a plurality of steps. And the sending equipment needs to send different post-processing information to the receiving equipment when executing each step until the security key is obtained. Based on this, if the first data information is not the security key, the sending device further needs to continue sending second post-processing information to the receiving device.
In a first optional implementation manner of this application, the sending device may transmit the second post-processing information using the first transmission path. In a second optional implementation manner of this application, the sending device may further randomly select one transmission path from the Z transmission paths to transmit the second post-processing information. In a third optional implementation manner of the present application, the sending device may divide the second post-processing information into multiple pieces of sub information, and transmit the multiple pieces of sub information through multiple transmission paths.
By adopting the implementation mode, when the sending equipment sends each piece of post-processing information, one or more transmission paths randomly selected from the Z transmission paths can be used for transmission. Therefore, the randomness of the post-processing path is greatly increased, the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and the safety of the security key can be improved.
In an optional design, the receiving, by the sending device, the first negotiation information includes:
the sending equipment receives a third data frame containing the first negotiation information;
the sending equipment acquires the first negotiation information from the third data frame; alternatively, the first and second electrodes may be,
the sending equipment receives K data frames, wherein K is a positive integer greater than or equal to 2, each data frame comprises a piece of sub information of the first negotiation information, and the sub information contained in the K data frames are different;
the sending equipment reads the sub information contained in each data frame of the K data frames and the serial number of the sub information;
and the sending equipment arranges the sub-information corresponding to each serial number in sequence according to the sequence marked by the serial numbers to obtain the first negotiation information.
When sending negotiation information to the sending device, the receiving device also transmits the negotiation information through one or more transmission paths in the transmission network. Based on this, when the sending device receives a data frame containing complete first negotiation information, the sending device reads the first negotiation information from the data frame. And when the sending equipment receives the data frame containing the first negotiation information sub-information, the sending equipment reads each part of sub-information and combines the sub-information to obtain the complete first negotiation information.
In an optional design, before the sending device sends the first post-processing information to the receiving device through one or more transmission paths in the transmission network, the method further includes:
the sending equipment acquires the equipment identification of each node equipment in the transmission network and the connection relation of each node equipment;
the sending equipment determines the Z transmission paths from the sending equipment to the receiving equipment according to the connection relation of each node equipment;
and the sending equipment sets different transmission path identifications for the Z transmission paths respectively.
Before performing the post-processing, the sending device reads the device identifier of each node device in the transmission network and the connection relationship of each node device. Then, the sending device determines Z transmission paths from the sending device to the receiving device according to the connection relationship of the node devices. Thereby providing multiple alternative transmission paths for sending post-processing information.
In a second aspect, the present application provides a QKD method comprising:
the receiving equipment receives the quantum information sent by the sending equipment through a quantum information transmission path;
the receiving equipment receives first post-processing information, and the first post-processing information is sent by the sending equipment through a transmission network;
the receiving device sends first negotiation information to the sending device through one or more transmission paths in the transmission network, the first negotiation information is determined by the receiving device according to a basis vector of a second key and the first post-processing information, the second key is generated by the receiving device, the transmission network comprises Z transmission paths from the receiving device to the sending device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are different from the quantum information transmission paths;
and the receiving equipment performs data processing on the information of the second key according to the first post-processing information to obtain second data information, wherein the second data information is related information of the security key.
In connection with the description of the QKD system in the first aspect, the transmission network includes Z transmission paths from the receiving device to the sending device. Based on this, the receiving device receives the quantum information using the quantum information transmission path. And after receiving the post-processing information, the receiving device determines negotiation information corresponding to the post-processing information. Then, the receiving device selects a transmission path from the Z transmission paths to send the negotiation information to the sending device.
By adopting the implementation mode, the transmission path for receiving the quantum information and the transmission path for sending the negotiation information by the receiving equipment are completely different, so that the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and further, the safety of the safety key can be improved.
In an optional design, the sending, by the receiving device, a first negotiation information transmission path to the sending device through one or more transmission paths in the transmission network includes:
the receiving device reads path information of a first transmission path, where the first transmission path is a transmission channel for transmitting a first data frame, the first data frame includes the first post-processing information, the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between the node devices when the node devices form the first transmission path;
the receiving equipment determines a third transmission path according to the first transmission path information, wherein the transmission direction of the third path is opposite to the transmission direction of the first transmission path;
the receiving device generates a third data frame, where the third data frame includes the first negotiation information and path information of the third transmission path;
and the receiving equipment sends the third data frame to second node equipment in the transmission network.
In an optional design, the sending, by the receiving device, the first negotiation information to the sending device through one or more transmission paths in the transmission network includes:
the receiving device determines a fourth transmission path from the Z transmission paths;
the receiving device generates a third data frame, where the third data frame includes the first negotiation information and path information of the fourth transmission path, and the path information of the fourth transmission path includes device identifiers of all node devices included in the fourth transmission path, and an upstream-downstream relationship between all the node devices when the fourth transmission path is formed;
and the receiving equipment sends the third data frame to second node equipment in the transmission network.
In an alternative design, the determining, by the receiving device, a fourth transmission path from the Z transmission paths includes:
the receiving equipment determines a fourth transmission path identifier from Z transmission path identifiers, wherein the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other;
and the receiving equipment determines the transmission path corresponding to the fourth transmission path identifier as the fourth transmission path.
In an optional design, the sending, by the receiving device, the first negotiation information to the sending device through one or more transmission paths in the transmission network includes:
the receiving equipment divides the first negotiation information into K parts of sub information, wherein K is a positive integer greater than or equal to 2;
the receiving device determines S transmission paths from the Z transmission paths, wherein S is a positive integer less than or equal to K and less than or equal to Z, each transmission path in the S transmission paths is used for transmitting at least one piece of sub information in the K pieces of sub information, and the sub information transmitted by the S transmission paths are different;
the receiving device generates K data frames, wherein the K data frames correspond to the K pieces of sub information one by one, each data frame in the K data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the S transmission paths, the sequence number indicates the position of the sub information in the K pieces of sub information, the path information comprises device identifications of all node devices contained in the corresponding transmission paths, and the upstream and downstream relations among all the node devices when the transmission paths are formed;
and the receiving equipment sends the K data frames to second node equipment in the transmission network. Similar to the sending device sending the first post-processing information, in a first optional implementation manner of this application, the receiving device transmits the first negotiation information through a transmission path reverse to the first transmission path. In a second optional implementation manner of this application, the receiving device may further randomly select one transmission path from the Z transmission paths to transmit the first negotiation information. In a third optional implementation manner of the present application, the receiving device may divide the first negotiation information into multiple pieces of sub information, and transmit the multiple pieces of sub information through multiple transmission paths. The receiving device.
By adopting the implementation mode, the randomness of the post-processing path can be greatly increased, the difficulty of acquiring the post-processing transmission path by an eavesdropper can be further improved, and the safety of the safety key can be improved.
In an alternative design, the receiving device receiving the first post-processing information includes:
the receiving device receives a first data frame containing the first post-processing information;
the receiving device acquires the first post-processing information from the first data frame; alternatively, the first and second electrodes may be,
the receiving device receives M data frames, wherein M is a positive integer greater than or equal to 2, each data frame comprises a piece of sub information of the first post-processing information, and the sub information contained in the M data frames is different;
the receiving equipment reads the sub information contained in each data frame of the M data frames and the serial number of the sub information;
and the receiving equipment arranges the sub information corresponding to each serial number in sequence according to the sequence marked by the serial numbers to obtain the first post-processing information.
In an optional design, before the receiving device sends the first negotiation information to the sending device through one or more transmission paths in the transmission network, the method further includes:
the receiving device obtains the device identification of each node device in the transmission network and the connection relation of each node device;
the receiving equipment determines the Z transmission paths from the receiving equipment to the sending equipment according to the connection relation of each node equipment;
and the receiving equipment sets different transmission path identifications for the Z transmission paths respectively.
With reference to the description of the first aspect, after receiving the second post-processing information, the receiving device determines second negotiation information. Then, the receiving device transmits the second negotiation information to the transmitting device. Wherein a process of the receiving device sending the second negotiation information to the sending device is similar to a process of the receiving device sending the first negotiation information to the sending device.
In a third aspect, the present application provides a QKD device for use as a transmitting device comprising a transmitter, a receiver, and a processor. The transmitter is configured to perform transmission of each piece of information in each implementation manner of the first aspect and the first aspect. The receiver is configured to perform the receiving of the information of the first aspect and the first aspect. The processor is configured to perform operations other than information transceiving in the implementations of the first aspect and the first aspect.
In an alternative design, the emitter includes a quantum emitter and a post-processing information emitter; the quantum transmitter is used for transmitting quantum information to the receiving equipment through a quantum information transmission path; the post-processing information transmitter is configured to send first post-processing information to the receiving device via one or more transmission paths in a transmission network.
In a fourth aspect, the present application provides a QKD device comprising a transmitter, a receiver, and a processor. The transmitter is configured to perform the transmission of each piece of information in the second aspect and each implementation manner of the second aspect. The receiver is configured to perform the second aspect and the receiving of the information of the second aspect. The processor is configured to perform operations other than information transceiving in the implementations of the second aspect and the second aspect.
In an alternative design, the receiver includes a quantum receiver and a post-processing information receiver; the quantum receiver is used for receiving quantum information sent by the sending equipment through a quantum information transmission path; the post-processing information receiver is used for receiving the first post-processing information.
In a fifth aspect, the present application provides a QKD device comprising a transceiver, a processor, and a memory. The transceiver, the processor and the memory can be connected through a bus system. The memory is for storing a program, instructions or code, and the processor is for executing the program, instructions or code in the memory to perform the method of the first aspect, or any one of the possible designs of the first aspect.
In a sixth aspect, the present application provides a QKD device comprising a transceiver, a processor, and a memory. The transceiver, the processor and the memory can be connected through a bus system. The memory is for storing a program, instructions or code, and the processor is for executing the program, instructions or code in the memory to perform the method of the second aspect, or any one of the possible designs of the second aspect.
In a seventh aspect, the present application provides a computer-readable storage medium having stored thereon instructions which, when executed on a computer, cause the computer to perform the method of the first aspect, the second aspect, any of the possible designs of the first aspect, or any of the possible designs of the second aspect.
In order to solve the problem of low security of the security key, the QKD system provided by the application comprises a sending device, a receiving device, and a quantum information transmission path and a transmission network which are connected with the sending device and the receiving device. The transport network provides a plurality of transport paths. Further, the transmitting device transmits quantum information to the receiving device through the quantum information transmission path. And the sending equipment and the receiving equipment carry out interaction of post-processing information through a transmission path provided by the transmission network. Therefore, according to the technical scheme, the quantum information transmission path is completely different from the transmission path, so that the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and the safety of the safety key can be improved.
Drawings
FIG. 1 is a schematic diagram of a typical QKD system of the present application;
FIG. 2 is a schematic diagram of an implementation scenario of the QKD method of the present application;
FIG. 3 is a signaling interaction diagram of one embodiment of the QKD method of the present application;
FIG. 4 is a flow chart of a post-processing operational procedure of the present application;
FIG. 5 is a schematic structural diagram of a first embodiment of the QKD device of the present application;
FIG. 6 is a schematic diagram of a second embodiment of the QKD device of the present application;
FIG. 7 is a schematic structural diagram of a third embodiment of the QKD device of the present application;
fig. 8 is a schematic structural diagram of a fourth embodiment of the QKD device of the present application.
Detailed Description
Quantum cryptography guarantees the security of communications by exploiting quantum mechanical properties. Quantum Key Distribution (QKD) is performed by a QKD system.
As shown in fig. 1, a typical QKD system includes a sending device, a receiving device, and a quantum channel and a classical channel connecting the sending device and the receiving device. Wherein the entity of the sending device and the entity of the receiving device are both QKD terminals. The QKD terminal as the sending device comprises a quantum signal sending module and a first post-processing information transceiving module. The QKD terminal as the receiving device comprises a quantum signal receiving module and a second post-processing information transceiving module. The entity of the quantum channel and the entity of the classical channel are both fiber optic cables in a fiber channel.
In connection with the QKD system shown in fig. 1, a typical QKD method includes:
in a first phase, the sending device generates a first key. The transmitting device generates quantum information from the first key. Then, the transmitting device transmits the quantum information to the receiving device through the quantum signal transmitting module.
The receiving device receives the quantum information through the quantum signal receiving module. The receiving device generates a second key and demodulates the quantum information according to the second key.
And in the second stage, combining the first key and the second key, and performing post-processing information interaction between the sending equipment and the receiving equipment through the classical channel. And the sending equipment generates a security key according to the first key through the post-processing information interaction. And the receiving equipment generates the security key according to the second key through the post-processing information interaction. And the sending equipment carries out post-processing information interaction with the receiving equipment through the first post-processing information transceiving module. And the receiving equipment performs post-processing information interaction with the sending equipment through the second post-processing information transceiving module.
The application provides an embodiment of a QKD method to improve the difficulty of an eavesdropper in acquiring a classical channel, thereby improving the security of the secure key.
The QKD method is applied to the QKD system provided by the application. The QKD system includes a sending device, a receiving device, and a quantum information transmission path and transmission network connecting the sending device and the receiving device. From the sending device to the receiving device, the transport network contains Z transport paths. The present application refers to the Z transmission paths from the sending device to the receiving device as a first set of Z transmission paths. The first group of Z transmission paths are different from each other, and the first group of Z transmission paths are different from the quantum information transmission paths. From the receiving device to the sending device, the transmission network likewise comprises Z transmission paths. The present application refers to the Z transmission paths from the receiving device to the transmitting device as a second set of Z transmission paths. The transmission directions of the second group of Z transmission paths are opposite to the transmission directions of the first group of Z transmission paths. Z is a positive integer of 1 or more.
Wherein, the sending device and the receiving device are as described in the embodiment corresponding to fig. 2. The quantum information transmission path is a transmission path of a quantum channel. The quantum information transmission path is connected with the quantum signal sending module and the quantum signal receiving module. The transport network comprises at least three node devices. The first node device of the three node devices is connected to the transmitting device. The second node device of the three node devices is connected to the receiving device. And the at least three node devices are connected with each other pairwise. The first node device is connected with the first post-processing information transceiver module. And the second node equipment is connected with the second post-processing information transceiver module.
It should be understood that the transmission path refers to a path of information from the first transmission apparatus to the last transmission apparatus. The transmission path includes all transmission devices through which information passes and the transmission relationship of each transmission device.
As shown in fig. 2, in an optional implementation of the implementation scenario of the QKD method described in this application, the sending device, the receiving device, and the quantum channel are described as above. The quantum channel includes the quantum information transmission path. The transmission network includes node device a, node device b, node device c, node device d, node device e, and node device f. The connection relationships among the node device a, the node device b, the node device c, the node device d, the node device e and the node device f are shown by connecting lines in fig. 2 (not described here). The node device f is connected to the transmitting device. The node device e is connected to the receiving device.
It should be understood that two node devices interconnected in the transmission network may transmit information to each other. Based on this, in the transmission network of fig. 2, the transmission paths (first group of transmission paths) from the sending device to the receiving device include: 1. node device f-node device e; 2. node device f-node device d-node device e; 3. node device f-node device a-node device e; 4. node device f-node device a-node device c-node device d-node device e; 5. node device f-node device a-node device b-node device d-node device e; 6. node device f-node device a-node device b-node device c-node device d-node device e. The transmission path (second group of transmission paths) from the reception device to the transmission device includes: 1. node device e-node device f; 2. node device e-node device d-node device f; 3. node device e-node device a-node device f; 4. node equipment e-node equipment d-node equipment c-node equipment a-node equipment f; 5. node equipment e-node equipment d-node equipment b-node equipment a-node equipment f; 6. node device e-node device d-node device c-node device b-node device a-node device f.
In an optional embodiment of the present application, reference numerals "1", "2", and "3" are transmission path identifiers of each transmission path. The symbol "-" between two node apparatuses in each path indicates that information is transmitted from the node apparatus before "-" to the node apparatus after "-". For example, "1" in "1, node device f-node device e" indicates that the transmitting device sets the path id of the transmission path to "1". "-" indicates that information is transmitted from the node apparatus f to the node apparatus e in the one transmission path.
It should be understood that the transport network is any transport network suitable for transporting QKD related information. For example, the transport network may specifically be an Optical Transport Network (OTN), a router network, a switch network, or a Synchronous Digital Hierarchy (SDH) network.
In conjunction with the above implementation scenarios, the present application provides an embodiment of the QKD method. As shown in fig. 3, the QKD method 100 includes the following steps.
Step S101, the sending device sends quantum information to the receiving device through the quantum information transmission path.
Wherein the quantum information comprises the first key.
Specifically, the sending device randomly generates a first bit sequence and a first basis vector. The first bit sequence is used as the first key. The first bit sequence is for example "0100110001 … …". The first basis vector is a bit sequence having a length identical to that of the first key. Said first basis vector is for example "1011001101 … …". The bits of the first basis vector are combined with the bits of the first key one by one, and the resulting two bits of data are used to indicate one voltage phase. For example, a first bit "0" of the first bit sequence is combined with a first bit "1" of the first basis vector to obtain "01". The "01" indicates one voltage phase.
The quantum signal transmitting module transmits light through a laser in the quantum signal transmitting module. And the quantum signal sending module modulates the optical signal according to a plurality of phases formed by the first basis vector and the first bit sequence to obtain the quantum information. The quantum signal sending module sends the quantum information to the receiving device through the quantum information transmission path.
Step S102, the receiving device demodulates the quantum information according to the second key.
Wherein the receiving device generates a second bit sequence and a second basis vector. The second bit sequence is used as the second key. The second bit sequence is for example "000101101 … …". The second basis vector is a bit sequence having the same length as that of the second key. The second basis vector is, for example, "1011010001 … …". The bits of the second basis vector are combined with the bits of the second key one by one, and the resulting two bits of data are used to indicate one voltage phase.
After receiving the quantum information, the receiving device demodulates the quantum information to obtain a phase corresponding to the corresponding quantum information. The phase obtained by demodulation is the phase at the time of the quantum information modulation. Then, the receiving device detects whether the phase obtained by demodulation is the same as the phase of the local terminal corresponding to the corresponding quantum information. And if the phase obtained by demodulation is the same as the phase of the local terminal corresponding to the corresponding quantum information, the quantum signal receiving module records the detection result as 1. And if the phase obtained by demodulation is different from the phase of the local end corresponding to the corresponding quantum information, the quantum signal receiving module marks the detection result as 0.
Further, when the detection result of the quantum signal receiving module is 1, the phase corresponding to the detection result is, for example, "01". If the phase "01" is the phase composed of the third bit in each of the above sequences, the receiving device retains the third bit "0" in the second key and the third bit "1" in the second basis vector. Accordingly, the receiving device transmits the basis vector data "1" in the phase "01" to the transmitting device. The transmitting device determines whether a third bit in the first basis vector is "1". If the third bit in the first basis vector is "1", the transmitting device reserves the third bit in the second basis vector and the third bit in the first basis vector. Correspondingly, when the detection result of the quantum signal receiving module is 0, the transmitting device and the receiving device both discard the bit corresponding to the phase.
Finally, the transmitting device and the receiving device, for example, reserve the third bit, the tenth bit, the twelfth bit, and so on of each bit sequence. The data sequence of the first key retained by the transmitting device is referred to as first basic key data. The data sequence of the second key retained by the receiving device is referred to as second basic key data.
Step S103, the sending device sends first post-processing information to the receiving device through one or more transmission paths of the first group of Z transmission paths.
Wherein the first base key data and the second base key data should theoretically be identical. However, in actual operation, when the phase corresponding to the demodulated quantum information is different from the phase at the time of quantum information modulation, the quantum signal receiving module also has a 50% probability of recording the detection result as 1. Based on this, the sending device should perform a post-processing operation based on the first base key data and finally generate the security key. The receiving device should perform a post-processing operation based on the second base key data and finally generate the secure key.
As shown in fig. 4, the post-processing process described herein includes the following steps.
Step S1, align the base.
And step S2, error estimation.
Step S3, key agreement.
Step S4, error checking.
And step S5, enhancing the secrecy.
Specifically, the sending device sends a base vector corresponding to a part of the first basic key data to the receiving device. For example, the transmitting device transmits a basis vector corresponding to 10% of data before the first basic key data to the receiving device. Then, the sending device receives the basis vector corresponding to 10% of the data before the second basic key data sent by the receiving device. And then, the sending equipment compares the received basis vector data with the basis vector data corresponding to the first basic key data to obtain the error rate. And if the error rate is greater than a first preset threshold value, the sending equipment confirms that the communication is invalid. And the sending equipment sends the quantum information to the receiving equipment again. And if the error rate is less than a first preset threshold value, the sending equipment confirms that the communication is effective. And the sending equipment continues to execute the subsequent operation of the post-processing until the security key is generated according to the first key. The first preset threshold is, for example, 25%.
Correspondingly, after receiving the basis vector of the first 10% of data of the sending device, the receiving device also performs the comparison operation, and obtains the error rate. And is not described in detail herein.
And if the sending equipment confirms that the communication is valid, the sending equipment removes the data of 10 percent of the first basic key data to obtain first residual key data. The transmitting device transmits a basis vector of the first remaining key data to the receiving device. Then, the sending device receives the basis vector sent by the receiving device, and screens out data meeting requirements from the first remaining key data according to the received basis vector to obtain first screened data.
Correspondingly, if the receiving device confirms that the communication is valid, the receiving device acquires second residual key data. And then, the receiving device screens out data meeting the requirements from the second residual key data according to the basis vector of the first residual key data to obtain second screened data.
Then, the sending device negotiates with the basis vector of the receiving device based on the basis vector of the first screening data, and corrects the first screening data by using a series of algorithms according to the negotiation result, so as to finally obtain a first security data sequence. Correspondingly, the receiving device negotiates with the sending device, and performs error correction on the second screening data to finally obtain a second security data sequence.
It is to be understood that the first security data sequence and the second security data sequence are two data sequences having a mutual error rate below a second predetermined threshold. The second preset threshold is, for example, 1%.
Further, the transmitting device negotiates with the receiving device to determine encrypted data. The transmitting device then further encrypts the first secure data sequence using the encrypted data to obtain the secure key. The receiving device further encrypts the second secure data sequence using the encrypted data to obtain the secure key. In the post-processing process shown in fig. 4, any data information sent by the sending device to the receiving device is the first post-processing information.
Before sending the first post-processing information to the receiving device, the sending device reads the device identifier of each node device in the transmission network and the connection relationship of each node device. The device identifier of the node device is identified by "a", "b", etc. as shown in fig. 2. Then, the sending device determines Z transmission paths from the sending device to the receiving device according to the connection relationship of the node devices. The Z transmission paths are corresponding transmission paths in the first set of transmission paths shown in fig. 2. And then, the sending device sets different transmission path identifiers for the Z transmission paths respectively. The transmission path identifier is, for example, identifiers such as "1" and "2" corresponding to the embodiment shown in fig. 2.
In an embodiment of the present application, the sending device transmits the first post-processing information through a transmission path. Specifically, the sending device determines a first transmission path from the first group of Z transmission paths. Then, the sending device encapsulates the first post-processing information and the path information of the first transmission path to obtain a first data frame. Further, the transmitting device transmits the first data frame to the first node device. The path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between all the node devices when the first transmission path is formed. Based on this, after receiving the first data frame, the first node device reads the path information of the first transmission path in the first data frame. Then, the first node device transmits the first data frame to a downstream node device of the first node device indicated by the path information of the first transmission path.
For example, the sending device determines a transmission path "node device f-node device d-node device e" in the embodiment shown in fig. 2 as the first transmission path. And the sending equipment encapsulates the first post-processing information, the node identifications f, d and e and the upstream and downstream relations corresponding to the node identifications f, d and e to obtain a first data frame. Then, the transmitting device transmits the first data frame to a node device f. And the node device f determines that the downstream device of the node device f is the node device d according to the upstream and downstream relation corresponding to the node identifiers f, d and e in the first data frame. The node device f transmits the first data frame to the node device d.
The determining, by the sending device, the first transmission path from the first group of Z transmission paths may specifically be: and the sending equipment determines a first transmission path identifier from the Z transmission path identifiers corresponding to the first group of Z transmission paths. Then, the sending device determines the transmission path corresponding to the first transmission path identifier as the first transmission path.
For example, in this embodiment, the sending device determines a transmission path identifier "2" from six transmission path identifiers from the sending device to the receiving device. Then, the sending device determines a transmission path "node device f-node device d-node device e" corresponding to the transmission path identifier "2" as the first transmission path.
By adopting the implementation mode, when the sending equipment sends the post-processing information to the receiving equipment, the sending equipment randomly selects a transmission path from the transmission network, so that the difficulty of acquiring the transmission path by an eavesdropper can be improved.
In another embodiment of the present application, the sending device transmits the first post-processing information through a plurality of transmission paths. Specifically, the sending device divides the first post-processing information into M pieces of sub information. Then, the transmitting device determines N transmission paths from the first set of Z transmission paths. M is a positive integer of 2 or more, and N is a positive integer of M or less and Z or less. Wherein each transmission path of the N transmission paths is used for transmitting at least one piece of sub information of the M pieces of sub information. And further, the sending device packages each piece of sub information in the M pieces of sub information and path information of a transmission path corresponding to the sub information to obtain M data frames in total. Then, the sending device sends all the M data frames to the first node device. And the first node equipment respectively sends the M data frames to downstream node equipment of the first node equipment indicated by the corresponding transmission paths.
Wherein the M data frames are transmitted through N transmission paths. The transmission delay of each transmission path in the N transmission paths is different, so that the M data frames respectively arrive at the receiving device at different times. And the M parts of sub information are combined according to a certain sequence to obtain the first post-processing information. Based on this, in this embodiment, when the sending device encapsulates the M data frames, the sequence number of the corresponding sub information is added to each data frame of the M data frames. The sequence number is used for indicating the position of the sub information in the M parts of sub information.
For example, the sending device divides the first post-processing information into 3 pieces of sub information. The 3 pieces of sub information include first sub information, second sub information and third sub information. And combining the first sub information, the second sub information and the third sub information according to the sequence of the second sub information, the first sub information and the third sub information to obtain the first post-processing information. The transmitting device determines 3 transmission paths from the first set of Z transmission paths. The 3 transmission paths are respectively the transmission paths labeled "1", "2", and "3" in the first set of transmission paths shown in fig. 2. Wherein the transmission path identified as "1" is used to transmit the first sub information. The transmission path identified as "2" is used to transmit the second sub information. The transmission path identified as "3" is used to transmit the third sub information. Based on this, the sending device encapsulates the first sub information and information of a transmission path "node device f-node device e" to obtain a first data frame. And the sending equipment encapsulates the second sub information and the information of the transmission path 'node equipment f-node equipment d-node equipment e' to obtain a second data frame. And the sending equipment encapsulates the third sub information and the information of the transmission path 'node equipment f-node equipment a-node equipment e' to obtain a third data frame. The sub information sequence number included in the first data frame is, for example, "002". The sub information sequence number included in the second data frame is, for example, "001". The sub information sequence number included in the third data frame is, for example, "003".
For another example, the sending device divides the first post-processing information into 3 pieces of sub information. The 3 pieces of sub information include first sub information, second sub information and third sub information. And combining the first sub information, the second sub information and the third sub information according to the sequence of the second sub information, the first sub information and the third sub information to obtain the first post-processing information. The transmitting device determines 2 transmission paths from the first set of Z transmission paths. The 2 transmission paths are the transmission paths labeled "4" and "5" respectively in the first set of transmission paths shown in fig. 2. Wherein the transmission path marked as "4" is used for transmitting the first sub information and the third sub information. The transmission path identified as "5" is used to transmit the second sub information. Based on this, the sending device encapsulates the first sub-information and the third sub-information with information of a transmission path "node device f-node device a-node device c-node device d-node device e", respectively, to obtain a first data frame and the second data frame. And the sending equipment encapsulates the second sub information and information of a transmission path 'node equipment f-node equipment a-node equipment b-node equipment d-node equipment e' to obtain a third data frame. The sub information sequence number included in the first data frame is, for example, "002". The sub information sequence number included in the second data frame is, for example, "003". The sub information sequence number included in the third data frame is, for example, "001".
In this embodiment, the path information in each data frame of the M data frames is the device identifiers of all the node devices included in the corresponding transmission path, and the upstream and downstream relationships between all the node devices when the transmission path is formed. The manner in which the transmitting terminal determines the N transmission paths is similar to the manner in which the transmitting terminal determines the first transmission path. The present application is not described in detail herein.
By adopting the implementation mode, the sending equipment transmits one piece of post-processing information through a plurality of transmission paths, so that the complexity of the transmission path for transmitting one piece of post-processing information is further improved, the difficulty of capturing the post-processing information by an eavesdropper is further increased, and the safety of the safety key is further ensured.
It should be understood that the transport network should transport data according to a transport protocol supported by the node devices in the transport network. Therefore, the transmission network cannot directly transmit the first post-processing information. Based on this, the sending device encapsulates the first post-processing information into a data frame before transmitting the first post-processing information. The data frame supports a transport protocol of the transport network. In a possible implementation manner of the present application, the transmission network is an OTN network, and the data frame generated by the sending device supports a g.704 or g.709 transmission protocol. In another possible implementation manner of the present application, the transmission network is a router network, and the data frame generated by the sending device supports a Transmission Control Protocol (TCP)/Internet Protocol (IP) protocol.
Further, according to the post-processing operation procedure shown in fig. 4, the data amount of different post-processing information is different. In this case, in this step, the transmission mode of the first post-processing information may be determined according to the data size of the first post-processing information. For example, in an optional implementation manner of the present application, the first post-processing information is a basis vector of the first remaining key data. The basis vector of the first remaining key data includes a plurality of data. The transmitting device may transmit the basis vector of the first remaining key data through a transmission path. The transmitting device may also divide the basis vector of the first remaining key data into M sub-information transmissions. In an optional implementation manner of the present application, the first post-processing information is the encrypted data. The data volume of the encrypted data is small, and the sending device transmits the encrypted data through a transmission path.
Step S104, the receiving device performs data processing on the information of the second key according to the first post-processing information to obtain second data information.
With reference to step S103, in different implementation scenarios, the receiving device receives the first post-processing information in different manners. In an embodiment of the present application, the receiving device receives the first data frame. Then, the receiving device acquires the first post-processing information from the first data frame. In another embodiment of the present application, the receiving device receives the M data frames, and reads sub information and a sequence number of the sub information included in each data frame of the M data frames. Then, the receiving device arranges the sub information corresponding to each sequence number in sequence according to the sequence marked by the sequence number to obtain the first post-processing information.
Further, according to the post-processing operation procedure shown in fig. 4, when the contents of the first post-processing information are different, the receiving device executes different operations according to the first post-processing information. In an alternative embodiment of the present application, the first post-processing information is data 10% of the first base key data. And the receiving equipment compares the first post-processing information with the basis vectors corresponding to the data which is 10% of the second basic key data. In another optional embodiment of the present application, the first post-processing information is the encrypted data. And the receiving equipment uses the encrypted data to perform encryption calculation on the second security data sequence to obtain the security key.
Accordingly, the post-processing process performs operations of a plurality of steps in sequence. The operation of each step in the operation of the plurality of steps is performed on the result obtained in the last step. Therefore, in this step, the second data information is determined based on the first post-processing information. In an alternative embodiment of the present application, the first post-processing information is data 10% of the first base key data, and then the second data information is the second remaining key data. In another optional embodiment of the present application, the first post-processing information is encrypted data determined by the sending device, and then the second data information is the security key.
Step S105, the receiving device sends first negotiation information to the sending device through one or more transmission paths in the second set of Z transmission paths.
Wherein the first negotiation information is determined by the receiving device according to the first post-processing information.
It should be understood that, in the process of processing the information of the second key by the receiving device according to the related information of the first key, the sending device processes the information of the first key according to the related information of the second key. Therefore, after receiving the first post-processing information, the receiving device sends first negotiation information to the sending device. The first negotiation information and the first post-processing information have the same attribute. For example, the first post-processing information is a base vector corresponding to 10% of data before the first basic key data, and the first negotiation information is a base vector corresponding to 10% of data before the second basic key data.
The receiving device reads the device identifier of each node device in the transmission network and the connection relationship of each node device before sending the first negotiation information, which is the same as the sending device. Then, the receiving device determines the second group of Z transmission paths and the transmission path identifiers of the second group of Z transmission paths according to the connection relationship of each node device. And will not be described in detail herein.
It should be understood that the transmission path identifications of the second set of Z transmission paths and the first set of Z transmission paths may be the same or different.
In an embodiment of the present application, the receiving device transmits the first negotiation information through a reverse transmission path of the first transmission path. Specifically, after receiving the first data frame, the receiving device reads path information of a first transmission path. Then, the receiving device determines a third transmission path according to the first transmission path information. The third transmission path is opposite to the first transmission path in transmission direction. And the receiving equipment encapsulates the first negotiation information and the path information of the third transmission path to obtain a third data frame. Further, the receiving device transmits the third data frame to the second node device. And the second node equipment reads the path information of the third transmission path in the third data frame. Then, the second node device transmits the third data frame to a downstream node device of the second node device indicated by the path information of the third transmission path.
The first transmission path is, for example, "node device f-node device d-node device e". The receiving device determines that the third transmission path is "node device e-node device d-node device f". And then, the receiving device encapsulates the first negotiation information, the node identifiers e, d and f and the upstream and downstream relations corresponding to the node identifiers e, d and f to obtain a third data frame. Then, the receiving device transmits the third data frame to a node device e. And the node equipment e determines that the downstream equipment of the node equipment e is the node equipment d according to the upstream and downstream relation corresponding to the node identifications e, d and f in the third data frame. And the node equipment e sends the third data frame to the node equipment d.
In another embodiment of the present application, the receiving device randomly selects one transmission path from the second set of Z transmission paths to transmit the first negotiation information. Specifically, the receiving device determines a fourth transmission path from the second group of Z transmission paths. Then, the sending device encapsulates the first negotiation information and the path information of the fourth transmission path to obtain a third data frame. Further, the receiving device transmits the third data frame to the second node device. And the second node equipment reads the path information of the fourth transmission path in the third data frame. Then, the second node device transmits the third data frame to a downstream node device of the second node device indicated by the path information of the fourth transmission path.
For example, the reception device transmission path "node device e-node device a-node device f" is determined as the fourth transmission path. And the receiving equipment encapsulates the first negotiation information, the node identifications e, a and f and the upstream and downstream relations corresponding to the node identifications e, a and f to obtain a third data frame. Then, the receiving device transmits the third data frame to a node device e. And the node equipment e determines that the downstream equipment of the node equipment e is the node equipment a according to the upstream and downstream relation corresponding to the node identifiers e, a and f in the third data frame. The node device e sends the third data frame to the node device a.
In this embodiment, the receiving device determines the fourth transmission path from the second group of Z transmission paths, which is similar to the transmitting device determining the first transmission path from the first group of Z transmission paths. The receiving device determines a fourth transmission path identification from the identifications of the second set of Z transmission paths. Then, the receiving device determines a transmission path corresponding to the fourth transmission path identifier as the fourth transmission path.
In a third embodiment of the present application, the receiving device transmits the first negotiation information through a plurality of transmission paths. Specifically, the receiving device divides the first negotiation information into K pieces of sub information. The receiving device determines S transmission paths from the second set of Z transmission paths. K is a positive integer of 2 or more, and S is a positive integer of K or less and Z or less. The S transmission paths are used for transmitting at least one piece of sub information in the K pieces of sub information. And then, the receiving device packages each piece of sub information in the K pieces of sub information and the path information of the transmission path corresponding to the sub information to obtain K data frames in total. And then, the receiving equipment sends the K data frames to second node equipment. And the second node equipment respectively sends the K data frames to downstream node equipment of the second node equipment indicated by the corresponding transmission path.
Similar to the M data frames of the first post-processing information, the transmission delays of the K data frames of the first negotiation information are also different. Based on this, when the receiving device packages the K data frames, the serial number of the corresponding sub information is added to each data frame of the K data frames. The sequence number is used for indicating the position of the sub information in the K parts of sub information.
Step S106, the sending device performs data processing on the information of the first key according to the first negotiation information to obtain first data information.
In an embodiment of the present application, the sending device receives the third data frame in conjunction with the description of step S105. Then, the sending device obtains the first negotiation information from the third data frame. In another embodiment of the present application, the sending device receives the K data frames, and reads sub information and a sequence number of the sub information included in each data frame of the K data frames. Then, the sending device arranges the sub-information corresponding to each sequence number in sequence according to the sequence marked by the sequence number to obtain the first negotiation information.
Further, after receiving the first negotiation information, the sending device processes the relevant information of the first key according to the first negotiation information to obtain first data information. In this embodiment, a process of processing, by the sending device, the information related to the first key according to the first negotiation information is the same as a process of processing, by the receiving device, the second key according to the first post-processing information. And the attribute of the first negotiation information is the same as the attribute of the first post-processing information. The corresponding relation between the first data information and the first negotiation information is the same as the corresponding relation between the second data information and the first post-processing information. And will not be described in detail herein.
Wherein the method 100 is only an alternative embodiment of the present application. In actual practice, the execution order of step S104 and step S105 of the method 100 may be interchanged. This is not limited by the present application.
By adopting the technical scheme of the application, the quantum information transmission path and the transmission path between the sending device and the receiving device are completely different. Therefore, the difficulty of acquiring the post-processing transmission path by the eavesdropper can be improved, and the safety of the safety key is further improved.
According to the description of the method 100, if the first data information is not the security key, the sending device further needs to continue sending second post-processing information to the receiving device. Wherein the sending device determines the second post-processing information according to the first data information. For example, the first data information is the first remaining key data, and the second post-processing information is a basis vector of the first remaining key data.
In an optional implementation manner of the present application, the sending device may transmit the second post-processing information using the first transmission path. Specifically, the sending device encapsulates the second post-processing information and the path information of the first transmission path to obtain a second data frame. The transmitting device transmits the second data frame to the first node device. And the first node equipment transmits the second data frame to the downstream node equipment of the first node equipment indicated by the path information of the first transmission path.
For example, when the sending device sends the second post-processing information, the transmission path "node device f-node device d-node device e" is still used. Correspondingly, the sending device encapsulates the second post-processing information, the node identifiers f, d, and e, and the upstream and downstream relations corresponding to the node identifiers f, d, and e, to obtain a second data frame. Then, the transmitting device transmits the second data frame to a node device f. And the node device f determines that the downstream device of the node device f is the node device d according to the upstream and downstream relation corresponding to the node identifiers f, d and e in the second data frame. The node device f transmits the second data frame to the node device d.
In another optional implementation manner of the present application, the sending device may randomly select one transmission path from the first group of Z transmission paths to transmit the second post-processing information. Specifically, the sending device determines a second transmission path from the first group of Z transmission paths. Then, the sending device encapsulates the second post-processing information and the path information of the second transmission path to obtain a second data frame. The transmitting device transmits the second data frame to the first node device. And the first node equipment transmits the second data frame to the downstream node equipment of the first node equipment indicated by the path information of the second transmission path. In this embodiment, the second transmission path is, for example, a transmission path "node device f-node device a-node device c-node device d-node device e".
In a third optional implementation manner of the present application, the sending device may divide the second post-processing information into multiple pieces of sub information, and transmit the multiple pieces of sub information through multiple transmission paths. The implementation manner of this embodiment is similar to the operation process in which the sending device divides the first post-processing information into multiple pieces of sub information and transmits the sub information through multiple transmission paths. And will not be described in detail herein.
It should be understood that the specific operation process of the sending device sending the second post-processing information is similar to the operation process of the sending device sending the first post-processing information, and is not repeated here.
In addition, in combination with the operation manner of the sending device sending the second post-processing information, the receiving device receives the second post-processing information in a similar process to the operation process of the receiving device receiving the first post-processing information. And after receiving the second post-processing information, the receiving device determines second negotiation information. Then, the receiving device transmits the second negotiation information to the transmitting device. Wherein a process of the receiving device sending the second negotiation information to the sending device is similar to a process of the receiving device sending the first negotiation information to the sending device. The present application is not described in detail herein.
Therefore, according to the technical scheme, a quantum information transmission path and a transmission network are arranged between the sending device and the receiving device. The transport network provides a plurality of transport paths. Based on this, when the sending device and the receiving device perform post-processing information interaction, transmission paths are randomly selected from the plurality of transmission paths. Therefore, the randomness of the post-processing path is greatly increased, the difficulty of acquiring the post-processing transmission path by an eavesdropper can be improved, and the safety of the security key can be improved.
Corresponding to the QKD method, the application also provides a QKD device.
In an alternative embodiment of the present application, a QKD device for use as the sending device includes a receiving module, a sending module, and a processing module. The receiving module, the sending module, and the processing module may be configured to perform the method performed by the sending device in the method 100.
The division of the above modules is only a division of logical functions, and in actual implementation, the functions of the transmitting module may be integrated into the transmitter, the functions of the receiving module may be integrated into the receiver, and the functions of the processing module may be integrated into the processor. As shown in fig. 5, the QKD device 500 includes a transmitter 501, a receiver 502, and a processor 503. The transmitter 501 may perform the transmission of various information in the method 100. The receiver 502 may perform the reception of various information in the method 100. The processor 503 may perform operations of the method 100 other than transceiving information.
For example, the transmitter 501 may be used to transmit quantum information to a receiving device through a quantum information transmission path; the device is further configured to send first post-processing information to the receiving device through one or more transmission paths in a transmission network, where the first post-processing information is determined by the sending device according to a basis vector of the first key, where the transmission network includes Z transmission paths from the sending device to the receiving device, where Z is a positive integer greater than or equal to 1, and each of the Z transmission paths is different from the quantum information transmission path; the receiver 502 may be configured to receive first negotiation information, which is sent by the receiving device through the transport network; the processor 503 may be configured to generate quantum information from the first key; the first negotiation information may be further configured to perform data processing on the information of the first key according to the first negotiation information, so as to obtain first data information, where the first data information is related to a security key.
Further, the transmitter 501 may also include a quantum transmitter and a post-processing information transmitter; the quantum transmitter is used for transmitting quantum information to the receiving equipment through a quantum information transmission path; the post-processing information transmitter is configured to transmit the first post-processing information to the receiving device via one or more transmission paths in a transmission network.
For details, reference may be made to the description of relevant parts in the method 100, which is not described herein again.
As shown in fig. 6, from another perspective, the transmitting device 600 may include a processor 601, a transceiver 602, and a memory 603. The memory 603 may be used to store a program/code preinstalled by the transmission apparatus 600, or may store a code or the like used when the processor 601 executes it.
It should be understood that the transmitting device 600 of the present application may correspond to the transmitting device in the method 100 of the present application. The transceiver 602 is configured to perform transceiving of various information performed by the sending device in the method 100, and may also include a quantum transceiver and a post-processing information transceiver, which are respectively responsible for receiving and sending quantum information and post-processing information; the processor 601 is configured to perform other processing except for the transmission and reception of various information by the transmitting apparatus in the method 100. And will not be described in detail herein.
Accordingly, a QKD device for use as the receiving device includes a receiving module, a transmitting module, and a processing module. The receiving module, the sending module and the processing module may be configured to perform the method performed by the receiving device in the method 100.
The division of the above modules is only a division of logical functions, and in actual implementation, the functions of the transmitting module may be integrated into the transmitter, the functions of the receiving module may be integrated into the receiver, and the functions of the processing module may be integrated into the processor. As shown in fig. 7, the QKD device 700 includes a transmitter 701, a receiver 702, and a processor 703. The transmitter 701 may be specifically configured to perform transmission of various information performed by the receiving device in the method 100; the receiver 702 may be specifically configured to perform the receiving of each piece of information performed by the receiving device in the method 100; the processor 703 is specifically configured to perform other processing except for the transceiving of various information by the receiving device in the method 100.
For example, the transmitter 701 may be configured to transmit, to the sending device, first negotiation information through one or more transmission paths in the transmission network, where the first negotiation information is determined by the receiving device according to a basis vector of a second key and the first post-processing information, the second key is generated by the receiving device, the transmission network includes Z transmission paths from the receiving device to the sending device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are all different from the quantum information transmission path; the receiver 702 may be configured to receive quantum information transmitted by a transmitting device via a quantum information transmission path; the first post-processing information sending device is also used for receiving first post-processing information which is sent by the sending device through a transmission network; the processor 703 may be configured to perform data processing on the information of the second key according to the first post-processing information to obtain second data information, where the second data information is related to a security key.
Further, receiver 702 includes a quantum receiver and a post-processing information receiver; the quantum receiver is used for receiving the quantum information sent by the sending equipment through the quantum information transmission path; the post-processing information receiver is used for receiving first post-processing information.
For details, reference may be made to the description of relevant parts in the method 100, which is not described herein again.
As shown in fig. 8, from another perspective, the receiving device 800 may include a processor 801, a transceiver 802, and a memory 803. The memory 803 may be used to store a program/code preinstalled by the receiving apparatus 800, or may store a code or the like used when the processor 801 executes it.
It should be understood that the receiving device 800 of the present application may correspond to the receiving device described in the method 100 of the present application, wherein the transceiver 802 is configured to perform transceiving of various information performed by the receiving device described in the method 100 described above, and may also include a quantum transceiver and a post-processing information transceiver, which are respectively responsible for receiving and transmitting quantum information and post-processing information; the processor 801 is configured to perform other processing of the receiving device in the method 100 except for transceiving information. And will not be described in detail herein.
The application also provides a QKD system. The QKD system includes a sending device, a receiving device, and a transmission network connecting the sending device and the receiving device. Wherein the sending device may be the QKD device provided by the embodiments corresponding to fig. 5 or fig. 6. The receiving device may be a QKD device as provided by the corresponding embodiments of fig. 7 or fig. 8. The transmission network is shown in the implementation scenario depicted in fig. 2. The transport network may be any suitable transport network for transporting QKD related information. The QKD system is configured to perform the QKD method corresponding to method 100.
In specific implementation, the present application also provides a computer storage medium corresponding to the sending device and the receiving device, respectively, where the computer storage medium provided in any device may store a program, and when the program is executed, part or all of the steps in each embodiment of the QKD method provided in fig. 2 to 5 may be implemented. The storage medium in any device may be a magnetic disk, an optical disk, a read-only memory (ROM), a Random Access Memory (RAM), or the like.
In the present application, the processor may be a Central Processing Unit (CPU), a Network Processor (NP), or a combination of the CPU and the NP. The processor may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a Complex Programmable Logic Device (CPLD), a field-programmable gate array (FPGA), a General Array Logic (GAL), or any combination thereof. The memory may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory (flash memory), a hard disk (HDD) or a solid-state drive (SSD); the memory may also comprise a combination of memories of the kind described above.
A bus interface may also be included in fig. 6 and 8, which may include any number of interconnected buses and bridges, with one or more processors represented by a processor and various circuits of memory represented by memory linked together. The bus interface may also link together various other circuits such as peripherals, voltage regulators, power management circuits, and the like, which are well known in the art, and therefore, will not be described any further herein. The bus interface provides an interface. The transceiver provides a means for communicating with various other apparatus over a transmission medium. The processor is responsible for managing the bus architecture and the usual processing, and the memory may store data used by the processor in performing operations.
Those of skill in the art will further appreciate that the various illustrative logical blocks and steps (step) set forth in the embodiments of the present application may be implemented in electronic hardware, computer software, or combinations of both. Whether such functionality is implemented as hardware or software depends upon the particular application and design requirements of the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the embodiments of the present application.
The various illustrative logical units and circuits described in this application may be implemented or operated upon by design of a general purpose processor, a digital signal processor, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration.
The steps of a method or algorithm described in the embodiments herein may be embodied directly in hardware, in a software element executed by a processor, or in a combination of the two. The software cells may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. For example, a storage medium may be coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC, which may be located in a UE. In the alternative, the processor and the storage medium may reside in different components in the UE.
It should be understood that, in the various embodiments of the present application, the size of the serial number of each process does not mean the execution sequence, and the execution sequence of each process should be determined by the function and the inherent logic thereof, and should not constitute any limitation to the implementation process of the embodiments.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims (32)

1. A quantum key distribution, QKD, method, comprising:
the sending equipment generates quantum information according to the first secret key;
the sending equipment sends the quantum information to the receiving equipment through a quantum information transmission path;
the sending device sends first post-processing information to the receiving device through one or more transmission paths in a transmission network, wherein the first post-processing information is determined by the sending device according to a basis vector of the first key, the transmission network comprises Z transmission paths from the sending device to the receiving device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are different from the quantum information transmission paths;
the sending equipment receives first negotiation information, and the first negotiation information is sent by the receiving equipment through the transmission network;
and the sending equipment performs data processing on the information of the first key according to the first negotiation information to obtain first data information, wherein the first data information is related information of a security key.
2. The QKD method of claim 1, wherein the sending device sending first post-processing information to the receiving device over one or more transmission paths in a transmission network comprises:
the sending equipment determines a first transmission path from Z transmission paths included in the transmission network;
the sending device generates a first data frame, where the first data frame includes the first post-processing information and path information of the first transmission path, and the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between all the node devices when the first transmission path is formed;
and the sending equipment sends the first data frame to first node equipment in the transmission network.
3. The QKD method of claim 2, wherein the sending device determining a first transmission path from among Z transmission paths included in the transmission network comprises:
the sending equipment determines a first transmission path identifier from Z transmission path identifiers, wherein the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other;
and the sending equipment determines the transmission path corresponding to the first transmission path identifier as the first transmission path.
4. The QKD method of claim 1, wherein the sending device sending first post-processing information to the receiving device over one or more transmission paths in a transmission network comprises:
the sending equipment divides the first post-processing information to obtain M parts of sub information, wherein M is a positive integer greater than or equal to 2;
the sending equipment determines N transmission paths from the Z transmission paths, wherein N is a positive integer less than or equal to M and less than or equal to Z, and each transmission path in the N transmission paths is used for transmitting at least one piece of sub information in the M pieces of sub information;
the sending equipment generates M data frames, wherein the M data frames correspond to the M parts of sub information one by one, each data frame in the M data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the N transmission paths, the sequence number indicates the position of the sub information in the M parts of sub information, the path information comprises equipment identifications of all node equipment contained in the corresponding transmission paths, and the upstream and downstream relations among all the node equipment when the transmission paths are formed;
and the sending equipment sends the M data frames to first node equipment in the transmission network.
5. The QKD method of claim 2, further comprising, after the sending device obtains the first data information:
in response to the first data information not being the security key, the sending device determining second post-processing information from the first data information;
the sending device generates a second data frame, where the second data frame includes the second post-processing information and the path information of the first transmission path;
and the sending equipment sends the second data frame to the first node equipment in the transmission network.
6. The QKD method of claim 2, further comprising, after the sending device obtains the first data information:
in response to the first data information not being the security key, the sending device determining second post-processing information from the first data information;
the sending equipment determines a second transmission path from the Z transmission paths;
the sending device generates a second data frame, where the second data frame includes the second post-processing information and path information of the second transmission path;
and the sending equipment sends the second data frame to the first node equipment in the transmission network.
7. The QKD method of claim 1, wherein the sending device receiving first negotiation information comprises:
the sending equipment receives a third data frame containing the first negotiation information;
the sending equipment acquires the first negotiation information from the third data frame; alternatively, the first and second electrodes may be,
the sending equipment receives K data frames, wherein K is a positive integer greater than or equal to 2, each data frame comprises a piece of sub information of the first negotiation information, and the sub information contained in the K data frames are different;
the sending equipment reads the sub information contained in each data frame of the K data frames and the serial number of the sub information;
and the sending equipment arranges the sub-information corresponding to each serial number in sequence according to the sequence marked by the serial numbers to obtain the first negotiation information.
8. The QKD method of claim 1, further comprising, before the sending device sends the first post-processing information to the receiving device over one or more transmission paths in the transmission network:
the sending equipment acquires the equipment identification of each node equipment in the transmission network and the connection relation of each node equipment;
the sending equipment determines the Z transmission paths from the sending equipment to the receiving equipment according to the connection relation of each node equipment;
and the sending equipment sets different transmission path identifications for the Z transmission paths respectively.
9. A quantum key distribution, QKD, method, comprising:
the receiving equipment receives the quantum information sent by the sending equipment through a quantum information transmission path;
the receiving equipment receives first post-processing information, and the first post-processing information is sent by the sending equipment through a transmission network;
the receiving device sends first negotiation information to the sending device through one or more transmission paths in the transmission network, the first negotiation information is determined by the receiving device according to a basis vector of a second key and the first post-processing information, the second key is generated by the receiving device, the transmission network comprises Z transmission paths from the receiving device to the sending device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are different from the quantum information transmission paths;
and the receiving equipment performs data processing on the information of the second key according to the first post-processing information to obtain second data information, wherein the second data information is related information of the security key.
10. The QKD method of claim 9, wherein the sending, by the receiving device, first negotiation information to the sending device over one or more transmission paths in the transmission network comprises:
the receiving device reads path information of a first transmission path, where the first transmission path is a transmission channel for transmitting a first data frame, the first data frame includes the first post-processing information, the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between the node devices when the node devices form the first transmission path;
the receiving equipment determines a third transmission path according to the first transmission path information, wherein the transmission direction of the third path is opposite to the transmission direction of the first transmission path;
the receiving device generates a third data frame, where the third data frame includes the first negotiation information and path information of the third transmission path;
and the receiving equipment sends the third data frame to second node equipment in the transmission network.
11. The QKD method of claim 9, wherein the sending, by the receiving device, first negotiation information to the sending device over one or more transmission paths in the transmission network comprises:
the receiving device determines a fourth transmission path from the Z transmission paths;
the receiving device generates a third data frame, where the third data frame includes the first negotiation information and path information of the fourth transmission path, and the path information of the fourth transmission path includes device identifiers of all node devices included in the fourth transmission path, and an upstream-downstream relationship between all the node devices when the fourth transmission path is formed;
and the receiving equipment sends the third data frame to second node equipment in the transmission network.
12. The QKD method of claim 11, wherein the receiving device determining a fourth transmission path from among the Z transmission paths includes:
the receiving equipment determines a fourth transmission path identifier from Z transmission path identifiers, wherein the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other;
and the receiving equipment determines the transmission path corresponding to the fourth transmission path identifier as the fourth transmission path.
13. The QKD method of claim 9, wherein the sending, by the receiving device, first negotiation information to the sending device over one or more transmission paths in the transmission network comprises:
the receiving equipment divides the first negotiation information into K parts of sub information, wherein K is a positive integer greater than or equal to 2;
the receiving device determines S transmission paths from the Z transmission paths, wherein S is a positive integer less than or equal to K and less than or equal to Z, each transmission path in the S transmission paths is used for transmitting at least one piece of sub information in the K pieces of sub information, and the sub information transmitted by the S transmission paths are different;
the receiving device generates K data frames, wherein the K data frames correspond to the K pieces of sub information one by one, each data frame in the K data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the S transmission paths, the sequence number indicates the position of the sub information in the K pieces of sub information, the path information comprises device identifications of all node devices contained in the corresponding transmission paths, and the upstream and downstream relations among all the node devices when the transmission paths are formed;
and the receiving equipment sends the K data frames to second node equipment in the transmission network.
14. The QKD method of claim 9, wherein the receiving device receiving first post-processing information includes:
the receiving device receives a first data frame containing the first post-processing information;
the receiving device acquires the first post-processing information from the first data frame; alternatively, the first and second electrodes may be,
the receiving device receives M data frames, wherein M is a positive integer greater than or equal to 2, each data frame comprises a piece of sub information of the first post-processing information, and the sub information contained in the M data frames is different;
the receiving equipment reads the sub information contained in each data frame of the M data frames and the serial number of the sub information;
and the receiving equipment arranges the sub information corresponding to each serial number in sequence according to the sequence marked by the serial numbers to obtain the first post-processing information.
15. The QKD method of claim 9, further comprising, before the receiving device sends the first negotiation information to the sending device over one or more transmission paths in the transmission network:
the receiving device obtains the device identification of each node device in the transmission network and the connection relation of each node device;
the receiving equipment determines the Z transmission paths from the receiving equipment to the sending equipment according to the connection relation of each node equipment;
and the receiving equipment sets different transmission path identifications for the Z transmission paths respectively.
16. A quantum key distribution QKD device comprising a transmitter, a receiver, and a processor, wherein,
the processor is used for generating quantum information according to the first secret key;
the transmitter is used for transmitting the quantum information to the receiving equipment through the quantum information transmission path; the device is further configured to send first post-processing information to the receiving device through one or more transmission paths in a transmission network, where the first post-processing information is determined by the sending device according to a basis vector of the first key, where the transmission network includes Z transmission paths from the sending device to the receiving device, where Z is a positive integer greater than or equal to 1, and each of the Z transmission paths is different from the quantum information transmission path;
the receiver is configured to receive first negotiation information, where the first negotiation information is sent by the receiving device through the transmission network;
the processor is further configured to perform data processing on the information of the first key according to the first negotiation information to obtain first data information, where the first data information is related to a security key.
17. The QKD device of claim 16,
the processor is specifically configured to determine a first transmission path from Z transmission paths included in the transmission network; generating a first data frame, where the first data frame includes the first post-processing information and path information of the first transmission path, and the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between the node devices when the node devices form the first transmission path;
the transmitter is specifically configured to transmit the first data frame to a first node device in the transport network.
18. The QKD device of claim 17,
the processor is specifically configured to determine a first transmission path identifier from Z transmission path identifiers, where the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other; and determining the transmission path corresponding to the first transmission path identifier as the first transmission path.
19. The QKD device of claim 16,
the processor is specifically configured to divide the first post-processing information to obtain M pieces of sub information, where M is a positive integer greater than or equal to 2; determining N transmission paths from the Z transmission paths, wherein N is a positive integer less than or equal to M and less than or equal to Z, and each transmission path in the N transmission paths is used for transmitting at least one piece of sub information in the M pieces of sub information; generating M data frames, wherein the M data frames correspond to the M parts of sub information one by one, each data frame in the M data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the N transmission paths, the sequence number indicates the position of the sub information in the M parts of sub information, the path information comprises equipment identifications of all node equipment contained in the corresponding transmission path, and an upstream-downstream relationship between the node equipment and the transmission path;
the transmitter is specifically configured to send all the M data frames to a first node device in the transmission network.
20. The QKD device of claim 16,
the processor further includes, in response to the first data information not being the secure key, determining second post-processing information from the first data information; generating a second data frame, wherein the second data frame comprises the second post-processing information and the path information of the first transmission path;
the transmitter is further configured to transmit the second data frame to a first node device in the transport network.
21. The QKD device of claim 16,
the processor further includes, in response to the first data information not being the secure key, determining second post-processing information from the first data information; determining a second transmission path from the Z transmission paths; and generating a second data frame, wherein the second data frame comprises the second post-processing information and the path information of the second transmission path.
22. The QKD device of claim 16,
the receiver is specifically configured to receive a third data frame including the first negotiation information; the device is further used for receiving K data frames, wherein K is a positive integer greater than or equal to 2, each data frame comprises a piece of sub-information of the first negotiation information, and the sub-information contained in the K data frames are different;
the processor is configured to obtain the first negotiation information from the third data frame; the data reading device is also used for reading sub information contained in each data frame of the K data frames and the serial number of the sub information; and sequentially arranging the sub information corresponding to each serial number according to the sequence marked by the serial numbers to obtain the first negotiation information.
23. The QKD device of claim 16,
the processor is further configured to obtain a device identifier of each node device in the transmission network and a connection relationship between the node devices; determining the Z transmission paths from the sending equipment to the receiving equipment according to the connection relation of each node equipment; and respectively setting different transmission path identifications for the Z transmission paths.
24. A quantum key distribution QKD device comprising a transmitter, a receiver, and a processor, wherein,
the receiver is used for receiving the quantum information sent by the sending equipment through a quantum information transmission path; the first post-processing information is also used for receiving first post-processing information, and the first post-processing information is sent by the sending equipment through a transmission network;
the transmitter is configured to transmit first negotiation information to the transmitting device through one or more transmission paths in the transmission network, where the first negotiation information is determined by the receiving device according to a basis vector of a second key and the first post-processing information, the second key is generated by the receiving device, the transmission network includes Z transmission paths from the receiving device to the transmitting device, Z is a positive integer greater than or equal to 1, and the Z transmission paths are all different from the quantum information transmission paths;
and the processor is used for performing data processing on the information of the second key according to the first post-processing information to obtain second data information, wherein the second data information is related information of a security key.
25. The QKD device of claim 24,
the processor is specifically configured to read path information of a first transmission path, where the first transmission path is a transmission channel for transmitting a first data frame, the first data frame includes the first post-processing information, and the path information of the first transmission path includes device identifiers of all node devices included in the first transmission path, and an upstream-downstream relationship between the node devices when the node devices form the first transmission path; determining a third transmission path according to the first transmission path information, wherein the transmission direction of the third transmission path is opposite to the transmission direction of the first transmission path; generating a third data frame, where the third data frame includes the first negotiation information and path information of the third transmission path;
the transmitter is specifically configured to send the third data frame to a second node device in the transport network.
26. The QKD device of claim 24,
the processor is specifically configured to determine a fourth transmission path from the Z transmission paths; generating a third data frame, where the third data frame includes the first negotiation information and path information of the fourth transmission path, and the path information of the fourth transmission path includes device identifiers of all node devices included in the fourth transmission path, and an upstream-downstream relationship between all the node devices when the fourth transmission path is formed.
27. The QKD device of claim 26,
the processor is specifically configured to determine a fourth transmission path identifier from Z transmission path identifiers, where the Z transmission path identifiers identify the Z transmission paths one by one, and the Z transmission path identifiers are different from each other; and determining the transmission path corresponding to the fourth transmission path identifier as the fourth transmission path.
28. The QKD device of claim 24,
the processor is specifically configured to divide the first negotiation information into K pieces of sub information, where K is a positive integer greater than or equal to 2; determining S transmission paths from the Z transmission paths, wherein S is a positive integer less than or equal to K and less than or equal to Z, each transmission path in the S transmission paths is used for transmitting at least one piece of sub information in the K pieces of sub information, and the sub information transmitted by the S transmission paths is different from each other; generating K data frames, wherein the K data frames correspond to the K pieces of sub information one by one, each data frame in the K data frames comprises corresponding sub information, a sequence number of the sub information and path information of one transmission path in the S transmission paths, the sequence number indicates the position of the sub information in the K pieces of sub information, the path information comprises equipment identifications of all node equipment contained in the corresponding transmission paths, and the upstream and downstream relations between all the node equipment when the transmission paths are formed;
the transmitter is specifically configured to send all the K data frames to a second node device in the transmission network.
29. The QKD device of claim 24,
the receiver is specifically configured to receive a first data frame including the first post-processing information; the device is further used for receiving M data frames, wherein M is a positive integer greater than or equal to 2, each data frame comprises a piece of sub information of the first post-processing information, and the sub information contained in the M data frames are different;
the processor is configured to obtain the first post-processing information from the first data frame; the M data frames are used for receiving the sub information and the serial numbers of the sub information; and sequentially arranging the sub information corresponding to each serial number according to the sequence marked by the serial numbers to obtain the first post-processing information.
30. The QKD device of claim 24,
the processor is further configured to obtain a device identifier of each node device in the transmission network and a connection relationship between the node devices; determining the Z transmission paths from the receiving equipment to the sending equipment according to the connection relation of each node equipment; and respectively setting different transmission path identifications for the Z transmission paths.
31. A quantum key distribution QKD device, the device comprising a processor and a memory, wherein:
the memory to store program instructions;
the processor, configured to invoke and execute program instructions stored in the memory to cause the transmitting device to perform the QKD method of any of claims 1-8.
32. A quantum key distribution QKD device, the device comprising a processor and a memory, wherein:
the memory to store program instructions;
the processor, configured to invoke and execute program instructions stored in the memory to cause the transmitting device to perform the QKD method of any of claims 9-15.
CN201811141720.4A 2018-09-28 2018-09-28 Quantum key distribution method and device Withdrawn CN110971395A (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201811141720.4A CN110971395A (en) 2018-09-28 2018-09-28 Quantum key distribution method and device
PCT/CN2019/105391 WO2020063350A1 (en) 2018-09-28 2019-09-11 Quantum key distribution method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811141720.4A CN110971395A (en) 2018-09-28 2018-09-28 Quantum key distribution method and device

Publications (1)

Publication Number Publication Date
CN110971395A true CN110971395A (en) 2020-04-07

Family

ID=69950014

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811141720.4A Withdrawn CN110971395A (en) 2018-09-28 2018-09-28 Quantum key distribution method and device

Country Status (2)

Country Link
CN (1) CN110971395A (en)
WO (1) WO2020063350A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112825499A (en) * 2019-11-21 2021-05-21 科大国盾量子技术股份有限公司 QKD system data transmission method and system based on TCP multi-link

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5288087B2 (en) * 2007-06-11 2013-09-11 日本電気株式会社 Encryption key management method and apparatus in a secret communication network
CN105553648B (en) * 2014-10-30 2019-10-29 阿里巴巴集团控股有限公司 Quantum key distribution, privacy amplification and data transmission method, apparatus and system
CN105162584B (en) * 2015-07-28 2018-11-27 中国科学技术大学 A kind of quantum key distribution system and method
CN107508671B (en) * 2017-08-18 2020-06-12 北京邮电大学 Business communication method and device based on quantum key distribution

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112825499A (en) * 2019-11-21 2021-05-21 科大国盾量子技术股份有限公司 QKD system data transmission method and system based on TCP multi-link
CN112825499B (en) * 2019-11-21 2023-01-31 科大国盾量子技术股份有限公司 QKD system data transmission method and system based on TCP multi-link

Also Published As

Publication number Publication date
WO2020063350A1 (en) 2020-04-02

Similar Documents

Publication Publication Date Title
US10187209B2 (en) Cumulative schemes for network path proof of transit
RU2736870C1 (en) Complex for secure data transmission in digital data network using single-pass quantum key distribution system and method of keys adjustment during operation of system
US10182039B2 (en) Encrypted and authenticated data frame
US9306734B2 (en) Communication device, key generating device, and computer readable medium
RU2636109C2 (en) Using general key networking device and its configuration
US12003629B2 (en) Secure server digital signature generation for post-quantum cryptography key encapsulations
CN110690961B (en) Quantum network function virtualization method and device
US20140023192A1 (en) Communication device, communication method, and communication system
WO2020254177A1 (en) Authenticated lattice-based key agreement or key encapsulation
WO2022067132A1 (en) System and methods for secure communication using post-quantum cryptography
WO2014066252A1 (en) Linked identifiers for multiple domains
CN112994839A (en) Flexible Ethernet overhead multiframe receiving method, device, equipment and medium
EP1406412B1 (en) Shared data refining device and shared data refining method
US20190294417A1 (en) Method and system for deriving deterministic prime number
CN110971395A (en) Quantum key distribution method and device
CN102694652B (en) A kind of method using symmetric cryptographic algorithm to realize light-weight authentication encryption
US20150086015A1 (en) Cryptographically Protected Redundant Data Packets
CN112787803B (en) Method and equipment for secure communication
Auten et al. Impact of resource-constrained networks on the performance of NIST round-3 PQC candidates
WO2021048599A1 (en) Verification and/or certification along a service chain
US20030223587A1 (en) Classified communication system which classifies the signal between interfaces and supports a media transport encoding scheme for a direct current balanced stream simultaneously
CN116633698B (en) Data transmission method, apparatus, computer device, storage medium, and program product
Zhang Network coding based on Chinese remainder theorem
CN113557706B (en) Method and system for transmitting data packets, transmitting node and receiving node
Marksteiner An approach to securing IPsec with Quantum Key Distribution (QKD) using the AIT QKD software

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WW01 Invention patent application withdrawn after publication

Application publication date: 20200407

WW01 Invention patent application withdrawn after publication