CN114374510A - Network system and method for key buffer negotiation comparison - Google Patents

Network system and method for key buffer negotiation comparison Download PDF

Info

Publication number
CN114374510A
CN114374510A CN202111626856.6A CN202111626856A CN114374510A CN 114374510 A CN114374510 A CN 114374510A CN 202111626856 A CN202111626856 A CN 202111626856A CN 114374510 A CN114374510 A CN 114374510A
Authority
CN
China
Prior art keywords
key
module
kmn
data
negotiation
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202111626856.6A
Other languages
Chinese (zh)
Other versions
CN114374510B (en
Inventor
郭邦红
胡敏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
National Quantum Communication Guangdong Co Ltd
Original Assignee
National Quantum Communication Guangdong Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by National Quantum Communication Guangdong Co Ltd filed Critical National Quantum Communication Guangdong Co Ltd
Publication of CN114374510A publication Critical patent/CN114374510A/en
Application granted granted Critical
Publication of CN114374510B publication Critical patent/CN114374510B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852Quantum cryptography
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a network system and a method for key buffer negotiation comparison in a quantum key management terminal. And the random key management terminal caches the key sent by the random QKD to the local machine, optimizes strategy grouping, and negotiates and compares with the corresponding key management terminal, thereby finally realizing the storage of the same security key by both sides. The method reduces the interaction times among the key management terminals, and is beneficial to reducing the CPU occupancy rate of the server and network communication resources. By processing multiple groups of keys simultaneously, the system efficiency can be greatly improved, and potential safety hazards in network transmission are reduced.

Description

Network system and method for key buffer negotiation comparison
Technical Field
The invention relates to the field of quantum secret communication, in particular to a network system and a method for key buffer negotiation comparison in a quantum key management terminal.
Background
The actual quantum secure communication network at present mainly comprises a quantum key distribution device QKD, a key management terminal (KM) device and a Key Management Server (KMs).
The quantum key distribution device (QKD) has a main function of generating a symmetric quantum key, and is not responsible for storing a large number of quantum keys, but periodically uploading the generated quantum keys to the key management terminal KM connected with the quantum key distribution device.
The key management terminal device has the main functions of carrying out verification and negotiation comparison processing on the received quantum key and carrying out encryption storage on the key which passes the verification and negotiation comparison.
Because quantum key transmission is limited by distance, when long-distance secure communication is carried out, a plurality of relay nodes are needed to complete, so a large number of nodes exist in a quantum secure communication network with a large scale, the nodes mainly comprise user end nodes, relay nodes and backbone network nodes, and in order to realize secure communication among all the user end nodes in the network, a large number of nodes in the quantum secure communication network are needed to generate keys and negotiate and compare the keys among KM before the keys are stored.
As shown in fig. 1, the current key sending and storing steps are as follows:
1. the QKD1 periodically transmits the generated quantum key to the key management terminal KM 1;
2. after receiving the key, KM1 processes the key according to a certain rule;
3. the QKD2 periodically transmits the generated quantum key to the key management terminal KM 2;
4. after receiving the key, KM2 processes the key according to a certain rule;
5. the KM1 sends the own processing result to the KM 2;
6. the KM2 sends the own processing result to the KM 1;
7. after receiving the processing result of KM2, KM1 compares it with its own processing result, and if it is consistent, stores the key in encrypted form
8. After receiving the processing result of KM1, KM2 compares it with its own processing result, and if it is consistent, stores the key in encrypted form
Although the method is simple and direct, the following problems exist:
1. data interaction between KMs is frequent, so that CPU scheduling is frequent, and other functional modules are possibly influenced;
2. data interaction between KM results in more occupied network resources and increased network safety hidden danger.
3. In the prior art, due to the unreasonable utilization of CPU resources and network resources, the quantum key generated by the QKD has a packet loss phenomenon.
Therefore, it is necessary to provide a method for efficient key buffer negotiation comparison in a quantum key management terminal.
Disclosure of Invention
In order to solve the above technical problem, a network system and a method for key buffer negotiation comparison in a quantum key management terminal are provided.
In order to achieve the purpose, the technical scheme adopted by the invention is as follows: a network system for key buffering negotiation comparison comprises a plurality of KM ends and a plurality of QKD ends, wherein any one of the KM ends is correspondingly connected with one of the QKD ends, and any two adjacent QKD ends are connected through a classical network;
the KM end at least comprises a main control module, a key buffering module and a key negotiation comparison module;
the key buffer module and the key negotiation comparison module are respectively connected with the main control module through electric signals;
the main control module is used for controlling the key buffer module and the key negotiation comparison module;
the key negotiation comparison module is used for comparing the received key data with locally stored key data and making a judgment;
the key buffer module is used for receiving the key data and buffering and storing the key data in a queue form;
any two adjacent KM terminals carry out communication interaction through the mutual key negotiation comparison module.
Preferably, the system further comprises a key storage module and a processing result interaction module;
the key storage module and the processing result interaction module are connected with the main control module through electric signals;
the key storage module is used for storing the encryption key after successful matching;
and the processing result interaction module is used for sending the encrypted and stored key.
A method for key buffer negotiation comparison is applied in the above network system for key buffer negotiation comparison, and comprises the following steps:
step S1: any one QKD end QKDn periodically sends the generated quantum key to the KMn correspondingly communicated with the QKD end QKDn;
step S2: the KMn receives the key and stores the key in a buffer queue through a key buffer module;
step S3: the QKDn +1 adjacent to the QKDn periodically transmits the generated quantum key to the KMn +1 correspondingly communicated with the QKDn;
step S4: the KMn +1 receives the key and stores the key in a buffer queue through a key buffer module;
step S5: the KMn sequentially groups the obtained keys according to the byte sequence, every 256 bytes are used as a group, and multiple groups of keys are selected from the obtained keys;
step S6: the KMn distributes the selected multiple groups of keys to multiple threads in a thread pool for processing, so that the multiple groups of keys are simultaneously subjected to hash to generate multiple groups of data DATAN with fixed length;
step S7: the KMn +1 generates a plurality of sets of fixed-length data DATAn +1 in the same operation as the KMn steps S5 and S6;
step S8: the KMn transmits the data DATAN to the KMn +1 through a processing result interaction module;
step S9: the KMn +1 transmits the data DATAN +1 to the KMn through a processing result interaction module;
step S10: the KMn compares the received data DATAN +1 with multiple groups of key processing result data thereof, and encrypts and stores the data DATAN +1 if the data are consistent;
step S11: the KMn +1 compares the received data DATAN with multiple groups of key processing result data DATAN +1, and encrypts and stores the data DATAN if the data are consistent.
Preferably, the QKDn periodicity is such that the quantum key to be generated has a period T1 of 1-10 s.
Preferably, the QKDn +1 periodicity is such that the quantum key to be generated has a period T2 of 1-10 s.
The invention has the beneficial technical effects that:
the network framework reduces direct data interaction between KMs, thereby reducing the occupation time of CPU resources and the frequency of using network resources;
the method can simultaneously process a plurality of groups of received keys, thereby improving the utilization rate of the CPU; the occupied network resources are reduced, and the potential safety hazard in network transmission is reduced.
Drawings
FIG. 1 is a schematic diagram of the original key sending and storing steps;
FIG. 2 is a diagram illustrating a step of sending and storing an original key according to an embodiment;
FIG. 3 is a block diagram of a key management terminal according to the present invention;
FIG. 4 is a block diagram of the structure of the key management terminal and QKD in the present invention;
FIG. 5 is a flowchart of key caching and negotiation comparison in the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is further described in detail with reference to the following embodiments, but the scope of the present invention is not limited to the following embodiments.
As shown in fig. 1 to 5, a network system for key buffering negotiation comparison includes a plurality of KM (key management terminals) and a plurality of QKD (quantum key distribution devices) terminals, where any one of the KM terminals is correspondingly connected to one or more QKD terminals, and any two adjacent QKD terminals are connected through a subnetwork. Any two adjacent KM terminals carry out communication interaction through the mutual key negotiation comparison module.
The KM (key management terminal) comprises a main control module, a key relay, a key service, a key storage, equipment authentication, a network management interface, a key receiving and buffering module, a key negotiation comparison processing module and a processing result interaction module. The main control module is responsible for coordinating work and system operation among all the sub-modules, and the key relay, the key service, the key storage, the equipment authentication, the network management interface, the key receiving and buffering module, the key negotiation comparison processing module and the processing result interaction module are all connected with the main control module through an internally defined interface.
The main control module is used for controlling the key buffer module and the key negotiation comparison module;
the key negotiation comparison module is used for comparing the received key data with locally stored key data and making a judgment;
the key buffer module is used for receiving the key data generated by the QKD and buffering and storing the key data in a queue form;
the key storage module is used for storing the encryption key after successful matching;
the processing result interaction module is mainly used for receiving and sending the processing result of the key negotiation comparison module.
The key relay encrypts and decrypts the relay key by using the quantum key shared between two adjacent KM, so that the remote transmission of the relay key is realized, and finally the relay key reaches a target user.
The key service provides a functional interface module for a user to use a quantum key.
The equipment authentication is mainly to obtain the public key information of other equipment through a digital certificate and verify whether the message signature value submitted by the equipment is legal or not by using the public key so as to identify the equipment identity.
The network management interface collects and stores management information through a Management Information Base (MIB), and allows the network management system to obtain the information through SNMP (simple network management protocol).
A method for key buffer negotiation comparison is applied in the above network system for key buffer negotiation comparison, and comprises the following steps:
step S1: any one QKD end QKDn periodically sends the generated quantum key to the KMn correspondingly communicated with the QKD end QKDn;
step S2: the KMn receives the key and stores the key in a buffer queue through a key buffer module;
step S3: the QKDn +1 adjacent to the QKDn periodically transmits the generated quantum key to the KMn +1 correspondingly communicated with the QKDn;
step S4: the KMn +1 receives the key and stores the key in a buffer queue through a key buffer module;
step S5: the KMn sequentially groups the obtained keys according to the byte sequence, every 256 bytes are used as a group, and multiple groups of keys are selected from the obtained keys;
step S6: the KMn distributes the selected multiple groups of keys to multiple threads in a thread pool for processing, so that the multiple groups of keys are simultaneously subjected to hash to generate multiple groups of data DATAN with fixed length;
step S7: the KMn +1 generates a plurality of sets of fixed-length data DATAn +1 in the same operation as the KMn steps S5 and S6;
step S8: the KMn transmits the data DATAN to the KMn +1 through a processing result interaction module;
step S9: the KMn +1 transmits the data DATAN +1 to the KMn through a processing result interaction module;
step S10: the KMn compares the received data DATAN +1 with multiple groups of key processing result data thereof, and encrypts and stores the data DATAN +1 if the data are consistent;
step S11: the KMn +1 compares the received data DATAN with multiple groups of key processing result data DATAN +1, and encrypts and stores the data DATAN if the data are consistent.
Preferably, the QKDn periodicity is the period T1(1< ═ T1< ═ 10, optimal value is 5, units: seconds) of the generated quantum key.
Preferably, the QKDn +1 periodicity is to generate a quantum key with a period T2(1< ═ T2< ═ 10, optimal value is 5, unit: second).
As shown in fig. 3, in the embodiment, the network framework is selected from QKD1, QKD2, KM1 and KM2, and the method for performing the key buffer agreement comparison comprises the following steps:
step S1: the QKD1 periodically transmits the generated quantum key to the key management terminal KM 1;
step S2: KM1 receives the key and stores in a buffer queue;
step S3: the QKD2 periodically transmits the generated quantum key to the key management terminal KM 2;
step S4: KM2 also needs to be stored in a buffer queue after receiving the key;
step S5: KM1 is grouped in turn according to the byte sequence of the acquired keys, every 256 bytes are used as a group, and a plurality of groups of keys are selected from the group (generally according to the principle of queue form, first-in first-out);
step S6: the KM1 distributes a plurality of groups of keys to a plurality of threads in a thread pool for processing, macroscopically and simultaneously hashes the plurality of groups of keys (MD 5 hash algorithm of hash function standard), and generates a plurality of groups of DATA1 with fixed length;
step S7: KM2 selects multiple groups of keys (generally in a queue form, first-in first-out principle) from the cached quantum keys according to the same strategy as KM 1;
step S8: the KM2 distributes a plurality of groups of keys to a plurality of threads in a thread pool for processing, macroscopically enables the keys to carry out hash processing simultaneously, and generates a plurality of groups of DATA DATA2 with fixed length;
step S9: the KM1 transmits a plurality of groups of DATA1 with fixed length to the KM2 through a network at one time;
step S10: the KM2 transmits a plurality of groups of data with fixed length to the KM1 through a network at one time;
step S11: after receiving the plurality of groups of DATA2 with fixed length of KM2, KM1 compares the DATA with the own plurality of groups of DATA1 with fixed length, and if the DATA1 are consistent, the DATA1 is encrypted and stored;
step S12: after KM2 receives KM1 sets of fixed length DATA DATA1, it compares the DATA with its own set of fixed length DATA DATA2 results, and if they match, it stores DATA1 in encrypted form.
The network framework reduces direct data interaction between KMs, thereby reducing the occupation time of CPU resources and the frequency of using network resources;
the method can simultaneously process a plurality of groups of received keys, thereby improving the utilization rate of the CPU; the occupied network resources are reduced, and the potential safety hazard in network transmission is reduced.
Variations and modifications to the above-described embodiments may occur to those skilled in the art, which fall within the scope and spirit of the above description. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and variations of the present invention should fall within the scope of the claims of the present invention. Furthermore, although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims (5)

1. A network system for key buffer negotiation comparison is characterized by comprising a plurality of KM ends and a multi-user QKD end, wherein any one KM end is correspondingly connected with one QKD end, and any two adjacent QKD ends are connected through a subnetwork;
the KM end at least comprises a main control module, a key buffering module and a key negotiation comparison module;
the key buffer module and the key negotiation comparison module are respectively connected with the main control module through electric signals;
the main control module is used for controlling the key buffer module and the key negotiation comparison module;
the key negotiation comparison module is used for comparing the received key data with locally stored key data and making a judgment;
the key buffer module is used for receiving the key data and buffering and storing the key data in a queue form;
any two adjacent KM terminals carry out communication interaction through the mutual key negotiation comparison module.
2. The network system for key buffer negotiation comparison of claim 1, further comprising a key storage module and a processing result interaction module;
the key storage module and the processing result interaction module are connected with the main control module through electric signals;
the key storage module is used for storing the encryption key after successful matching;
and the processing result interaction module is used for sending the encrypted and stored key.
3. A method for key buffer negotiation comparison, applied in the network framework of any one of claims 1-2, the method comprising the steps of:
step S1: any one QKD end QKDn periodically sends the generated quantum key to the KMn correspondingly communicated with the QKD end QKDn;
step S2: the KMn receives the key and stores the key in a buffer queue through a key buffer module;
step S3: the QKDn +1 adjacent to the QKDn periodically transmits the generated quantum key to the KMn +1 correspondingly communicated with the QKDn;
step S4: the KMn +1 receives the key and stores the key in a buffer queue through a key buffer module;
step S5: the KMn sequentially groups the obtained keys according to the byte sequence, every 256 bytes are used as a group, and multiple groups of keys are selected from the obtained keys;
step S6: the KMn distributes the selected multiple groups of keys to multiple threads in a thread pool for processing, so that the multiple groups of keys are simultaneously subjected to hash to generate multiple groups of data DATAN with fixed length;
step S7: the KMn +1 generates a plurality of sets of fixed-length data DATAn +1 in the same operation as the KMn steps S5 and S6;
step S8: the KMn transmits the data DATAN to the KMn +1 through a processing result interaction module;
step S9: the KMn +1 transmits the data DATAN +1 to the KMn through a processing result interaction module;
step S10: the KMn compares the received data DATAN +1 with multiple groups of key processing result data thereof, and encrypts and stores the data DATAN +1 if the data are consistent;
step S11: the KMn +1 compares the received data DATAN with multiple groups of key processing result data DATAN +1, and encrypts and stores the data DATAN if the data are consistent.
4. The method of claim 3, wherein the QKDn period is 1-10s with a quantum key generation period T1.
5. The method of claim 3, wherein the QKDn +1 periodicity is such that the quantum key is generated with a period T2 of 1-10 s.
CN202111626856.6A 2020-12-30 2021-12-28 Network system and method for key buffer negotiation comparison Active CN114374510B (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2020116157662 2020-12-30
CN202011615766 2020-12-30

Publications (2)

Publication Number Publication Date
CN114374510A true CN114374510A (en) 2022-04-19
CN114374510B CN114374510B (en) 2023-05-16

Family

ID=81141576

Family Applications (2)

Application Number Title Priority Date Filing Date
CN202111626856.6A Active CN114374510B (en) 2020-12-30 2021-12-28 Network system and method for key buffer negotiation comparison
CN202123445740.0U Active CN218336050U (en) 2020-12-30 2021-12-28 Network system for key buffer negotiation comparison

Family Applications After (1)

Application Number Title Priority Date Filing Date
CN202123445740.0U Active CN218336050U (en) 2020-12-30 2021-12-28 Network system for key buffer negotiation comparison

Country Status (1)

Country Link
CN (2) CN114374510B (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106301769A (en) * 2015-06-08 2017-01-04 阿里巴巴集团控股有限公司 Quantum key output intent, storage consistency verification method, Apparatus and system
CN108206738A (en) * 2016-12-16 2018-06-26 山东量子科学技术研究院有限公司 A kind of quantum key output method and system
CN108228730A (en) * 2017-12-11 2018-06-29 深圳市买买提信息科技有限公司 Data lead-in method, device, computer equipment and readable storage medium storing program for executing
CN109194471A (en) * 2018-09-14 2019-01-11 北京信息科技大学 A kind of quantum group cipher key negotiation method towards quantum key distribution network

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106301769A (en) * 2015-06-08 2017-01-04 阿里巴巴集团控股有限公司 Quantum key output intent, storage consistency verification method, Apparatus and system
CN108206738A (en) * 2016-12-16 2018-06-26 山东量子科学技术研究院有限公司 A kind of quantum key output method and system
CN108228730A (en) * 2017-12-11 2018-06-29 深圳市买买提信息科技有限公司 Data lead-in method, device, computer equipment and readable storage medium storing program for executing
CN109194471A (en) * 2018-09-14 2019-01-11 北京信息科技大学 A kind of quantum group cipher key negotiation method towards quantum key distribution network

Also Published As

Publication number Publication date
CN114374510B (en) 2023-05-16
CN218336050U (en) 2023-01-17

Similar Documents

Publication Publication Date Title
CN109412794B (en) Quantum key automatic charging method and system suitable for power business
CN104486316B (en) A kind of quantum key graduation offer method for improving electric power data transmission security
CN103763099A (en) Electric power security communication network based on quantum key distribution technology
CN106452741A (en) Communication system for realizing information encryption/decryption transmission based on quantum network and communication method
CN108540436B (en) Communication system and communication method for realizing information encryption and decryption transmission based on quantum network
CN108847928B (en) Communication system and communication method for realizing information encryption and decryption transmission based on group type quantum key card
CN110932854B (en) Block chain key distribution system and method for Internet of things
CN208986966U (en) A kind of ciphering terminal and corresponding data transmission system
CN203851153U (en) Electric power security communication network based on quantum key distribution technology
CN100440775C (en) Encryption communication method and device
WO2021082077A1 (en) Asymmetric cryptographic terminal based on quantum random number, and communication system and method
CN101552792B (en) A method and apparatus for transmitting information with dynamic secondary cipher key
CN109756328A (en) Key generation method and client based on the adjustment of bit error rate parameter adaptive
CN111342952A (en) Safe and efficient quantum key service method and system
CN100388849C (en) Method of cipher key management, distribution, and transfer during subscriber switch in digital cellular mobile communication system
CN114070579A (en) Industrial control service authentication method and system based on quantum key
CN114374510B (en) Network system and method for key buffer negotiation comparison
CN114401085B (en) Network architecture and key storage method of quantum secret communication network
CN108260125B (en) Secret key distribution method of content distribution application based on D2D communication
CN114362936A (en) Secret key relay method in communication network based on quantum secrecy
CN115065474A (en) Identity certificateless intelligent vehicle networking heterogeneous signcryption system under block chain-cloud edge fusion
CN114071461A (en) 5G communication module based on quantum key encryption
CN113810187A (en) High-speed quantum key distribution system and method
CN117896379B (en) Data transmission method and device for energy storage equipment
CN107040921A (en) One kind is based on point-to-point SMS encryption system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
PE01 Entry into force of the registration of the contract for pledge of patent right
PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: A Network System and Method for Key Buffering Negotiation and Comparison

Effective date of registration: 20230921

Granted publication date: 20230516

Pledgee: Bank of China Limited Dongshan Branch of Guangzhou

Pledgor: NATIONAL QUANTUM COMMUNICATION (GUANGDONG) Co.,Ltd.

Registration number: Y2023980057930

PP01 Preservation of patent right

Effective date of registration: 20240513

Granted publication date: 20230516