WO2021000328A1 - 可抗共谋的量子密钥协商方法、计算机终端及存储装置 - Google Patents

可抗共谋的量子密钥协商方法、计算机终端及存储装置 Download PDF

Info

Publication number
WO2021000328A1
WO2021000328A1 PCT/CN2019/094732 CN2019094732W WO2021000328A1 WO 2021000328 A1 WO2021000328 A1 WO 2021000328A1 CN 2019094732 W CN2019094732 W CN 2019094732W WO 2021000328 A1 WO2021000328 A1 WO 2021000328A1
Authority
WO
WIPO (PCT)
Prior art keywords
quantum
sequence
state
message sequence
key
Prior art date
Application number
PCT/CN2019/094732
Other languages
English (en)
French (fr)
Inventor
孙志伟
成荣
Original Assignee
深圳职业技术学院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳职业技术学院 filed Critical 深圳职业技术学院
Priority to PCT/CN2019/094732 priority Critical patent/WO2021000328A1/zh
Publication of WO2021000328A1 publication Critical patent/WO2021000328A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the invention belongs to the technical field of information security, and in particular relates to a collusion-resistant quantum key agreement method.
  • Quantum Key Agreement (Quantum Key Agreement, QKA) is the use of quantum mechanics theory to achieve key agreement tasks. Quantum key agreement, as an emerging research field of quantum cryptography, solves the key sharing problem of group organization activities in the network.
  • QKA can be divided into two categories.
  • One is the QKA protocol under the weak security definition, in which two or more parties negotiate a key through an open channel.
  • the QKA protocol is the well-known Quantum Key Distribution (QKD) protocol.
  • QKA Quantum Key Distribution
  • QKA not only requires all users to participate in the key generation process through an open channel, but also must generate a shared key in a fair and reciprocal way (to solve the fairness requirement).
  • QKD since one party can completely control the final key, it is not a fair and equal key agreement protocol. Inability to resist external attackers and internal attacks by dishonest participants.
  • the technical problem to be solved by the present invention is to provide a collusion-resistant quantum key agreement method, which aims to solve the problems that the existing quantum key distribution protocol cannot resist external attackers and internal attacks by dishonest participants.
  • the present invention is implemented as follows:
  • a collusion-resistant quantum key agreement method including a third-party interaction terminal and N negotiation interaction terminals P i , 0 ⁇ i ⁇ N-1, and the secret information of each negotiation interaction terminal is K 0 , K 1 , ...,k N-1 ⁇ 0,1 ⁇ m , m is the number of qubits, P i is in the key negotiation process, and the subscript is modN operation.
  • the negotiation methods include the following:
  • Step S1 The third-party interactive terminal prepares N quantum sequences ⁇ S 0 ,...,S N-1 ⁇ , which are called message sequences. Each message sequence S i contains m ordered qubits. The third-party interactive terminal Send each S i to the corresponding P i ;
  • Step S2 the first cycle: P i own secret information K i S i to the message sequence while randomly generated P i m quantum decoy-state coding in accordance with coding rule, and randomly inserted into the encoded message sequence In, get a new sequence P i send Give P i+1 ;
  • Step S3 Eavesdropping detection: P i+1 and P i are based on And the initial quantum state information of the decoy state for channel security detection, if it is judged to be safe, execute step S4, otherwise return to step S1;
  • Step S4 the second cycle: Pi +1 will receive Decoy-state is removed, to obtain the message sequence encoding a P i that, P i + 1 own secret information encoded into the K i + 1 via the message sequence encoding the P i, and the m random quantum prepared according to the encoding rules Decoy state, and then insert it into the message sequence encoded by Pi +1 to get a new message sequence P i+1 send Give P i+2 ;
  • Step S5. Eavesdropping detection: Pi +2 and Pi +1 are based on And the initial quantum state information of the decoy state prepared by P i+1 for channel security detection, if it is judged to be safe, execute the next cycle of the same step S4 until the Nth cycle is completed, otherwise return to step S1;
  • Step S6 The third-party interaction terminal sends the quantum base information of each qubit in each message sequence S i to Pi -1 , and each negotiation interaction terminal P i-1 compares the message sequence S i with the quantum base information Measure and get the message sequence Based on this, Pi -1 calculates the final negotiated key as P i through all 0 ⁇ i ⁇ N-1, were calculated from the final negotiated keys.
  • the method further includes: performing security detection on the channel between Pi and the third-party interactive terminal.
  • the method for performing security detection on the channel between Pi and a third-party interaction terminal includes:
  • the third-party interactive terminal prepares N decoy state sequences, ⁇ C 0 ,...,C N-1 ⁇ , each decoy state sequence C i contains m ordered qubits, and the third-party interactive terminal will deceive state sequences C i is randomly inserted into the message sequence S i to obtain a new sequence S i ', and S i 'is sent to P i , and then the position of C i in the S i ' sequence and the quantum base it is located on are disclosed to P i , P i of S i 'in the sequence of measured quantum states C i in the corresponding quantum group, then half of the measurement result of random disclosed to a third party interactive terminal, the interactive terminal is disclosed to third initial other half of the P i C i quantum state information, P i to interact with third-party terminal detects the security channel and the measurement results of the initial quantum state information
  • each qubit is randomly selected from ⁇
  • the encoding rule is:
  • the step S3 comprises: P i to P i + 1 of each disclosed The position of the decoy state in the sequence and its quantum basis, P i+1 pair Sequence decoy-state was measured at the corresponding quantum group, and randomly disclosed half measurements to P i, then the initial quantum state information P i disclosed in the other half of decoy state to P i + 1, P i and P i + 1 Based on the measurement results and the initial quantum state information, the channel is safely detected.
  • a computer terminal is used for N negotiation interaction terminals to perform multi-party quantum key negotiation.
  • the computer terminal includes a processor and a memory communicatively connected with the processor.
  • the memory stores a computer program, and the processor calls all
  • the computer program implements the above-mentioned collusion-resistant quantum key agreement method.
  • a storage device for N negotiation interaction ends to perform multi-party quantum key agreement.
  • the storage device stores a computer program that, when executed, realizes the collusion-resistant quantum key agreement method described above .
  • the present invention has the beneficial effect that: in the multi-party quantum key agreement method of the present invention, the initial quantum state is prepared by a third party (ThirdParty, TP).
  • TP ThirdParty
  • the role of TP is to prepare the initial quantum state, send the quantum state to the user, and announce the initial quantum state information at the end of the agreement, which can prevent internal colluders from obtaining the exclusive OR information of other legally negotiated interaction ends during the key theft phase.
  • the key rollover stage controls the final shared key.
  • Participant P i is subscripted as modN operation in the key negotiation process, that is, the N-bit participants in the key negotiation process follow the order P i ⁇ Pi +1 ⁇ ... ⁇ P N-1 ⁇ P N-2 ⁇ ... ⁇ P i-1 ⁇ P i negotiate in sequence.
  • the negotiation methods include the following:
  • Step S1 The third-party interactive terminal prepares N quantum sequences ⁇ S 0 ,...,S N-1 ⁇ , which are called message sequences. Each message sequence S i contains m ordered qubits. The third-party interactive terminal each S i corresponds to a respective P i.
  • the initial message sequence quantum state i.e., prepared from TP, and the sequence S i corresponding to each message sent to the corresponding P i. Since the internal attacker's attack is divided into two processes: the key stealing phase and the key flipping phase. In the key stealing stage, internal conspirators can obtain the exclusive OR information of other legitimate users' keys. Then they can control the final shared key during the key reversal phase, so that the final shared key is not generated by all participants in a fair and common manner. The reason why the colluder can obtain the exclusive OR information of the legal user's key is that the colluder generates the initial quantum state, that is, the above message sequence, and the colluder shares all the information of the initial quantum state.
  • the initial quantum state is prepared by TP with higher quantum preparation ability.
  • the role of TP is to prepare the initial quantum state, send the quantum state to the user, and announce the initial quantum state information at the end of the agreement. Preparing the initial quantum state through TP can prevent internal conspirators from obtaining the key exclusive OR information of other legally negotiated interaction ends during the key theft phase, and then control the final shared key during the key reversal phase.
  • security detection can be performed on the channel between Pi and the third-party interaction terminal TP to further improve the security of key negotiation.
  • the embodiment of the channel security detection between Pi and the third-party interaction terminal TP provided by the present invention is as follows: N quantum sequences ⁇ C 0 ,..., C N-1 ⁇ can be prepared from TP, which is called decoy State sequence, each decoy state sequence C i contains m ordered qubits.
  • each qubit can be randomly selected from ⁇
  • P i when the received receipt S i ', S i received may be transmitted to the TP' of.
  • the N users TP receives receipt information, to the TP P i S i in each disclosed sequence information of a position and a quantum group 'C i in which it is.
  • Step S2 the first cycle: P i own secret information K i S i to the message sequence while P i generates m random quantum states according to the coding rule decoy, and randomly inserted into the encoded message sequence In, get a new sequence P i send Give Pi +1 .
  • ; first when the K i j ⁇ ⁇ 1, ..., m ⁇ significant bit is 1, then the j-th bit unitary operations performed quantum state sequence S i of the message U
  • the present invention provides a method for detecting security channel between the two ends of interactions as follows: P i to P i + 1 of each disclosed The position of the decoy state in the sequence and its quantum basis information, P i+1 pair Sequence decoy-state was measured at the corresponding quantum group, and randomly disclosed half measurements to P i, then the initial quantum state information P i disclosed in the other half of decoy state to P i + 1, P i and P i + 1 Perform a security check on the channel.
  • each P i is disclosed in The position of the decoy state in the sequence and its quantum basis information.
  • P i + 1 pair of The decoy states in the sequence are measured under the corresponding quantum basis, and the measurement results are recorded.
  • P i discloses decoy half the initial state to the quantum state information P i + 1.
  • the error rate is calculated. If the error rate exceeds a threshold value set in advance, P i and P i + 1 acknowledgment channel eavesdropping, and terminate the communication, and returns to step S1, the protocol again performs; when all N quantum channel all the security, then the next step.
  • Step S4 the second cycle: Pi +1 will receive Decoy-state is removed, to obtain the message sequence encoding a P i that, P i + 1 own secret information encoded into the K i + 1 via the message sequence encoding the P i, and the m random quantum prepared according to the encoding rules Decoy state, and then insert it into the message sequence encoded by Pi +1 to get a new message sequence P i+1 send Give Pi +2 .
  • Step S5. Eavesdropping detection: Pi +2 and Pi +1 are based on And the initial quantum state information of the decoy state prepared by P i+1 for channel security detection, if it is judged to be safe, execute the next cycle of the same step S4 until the Nth cycle is completed, otherwise return to step S1;
  • Step S4 is the same as step S2, and step S5 is the same as step S3, respectively corresponding to different rounds of quantum key agreement cycles and different rounds of eavesdropping detection, which will not be repeated in the present invention.
  • Step S6 The third-party interaction terminal sends the quantum base information of each qubit in each message sequence S i to Pi -1 , and each negotiation interaction terminal P i-1 performs the message sequence S i under the corresponding base. Measure, get a string of m-bit message sequence Based on this, Pi -1 calculates the final negotiated key as P i through all 0 ⁇ i ⁇ N-1, were calculated from the final negotiated keys.
  • Pi -1 After performing the last round of information encoding and eavesdropping detection, Pi -1 receives the message sequence sent by Pi-2 Message sequence S is obtained after the detection of eavesdropping security coded i, P i-1 may send a message to the TP, confirm the end of the cycle. At this time, TP sends the quantum base information of each qubit in each message sequence S i to the corresponding P i-1 , and each negotiation interaction terminal P i-1 measures the message sequence S i under the corresponding base, Get a sequence of m-bit messages Then, Pi -1 calculates the final negotiated key as At this time, all N users can use the same method to calculate the same negotiation key K.
  • the part of the technical solution of the present invention that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium and includes several instructions to make a A computer terminal (which may be a personal computer, a server, or a network device, etc.) executes all or part of the steps of the method in each embodiment of the present invention.
  • the aforementioned storage devices include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .
  • m quantum decoy states are used between any two user channels to detect attacks.
  • the decoy state technology is one of the main detection and eavesdropping technologies in quantum cryptography. This method was first proposed in the BB84 protocol, and the security of this method has been proved. Any eavesdropping on the quantum channel will be detected. Using this eavesdropping detection technology, the existing various attack methods, such as interception and replay attacks, measurement replay attacks, and entanglement measurement attacks, will all be invalid.
  • the initial quantum state is prepared by TP with higher quantum preparation ability.
  • the role of TP is to prepare the initial quantum state, send the quantum state to the user, and announce the initial quantum state information at the end of the agreement.
  • TP is a semi-honest user, that is, TP executes the agreement honestly as required and does not collude with any user, but he can obtain some beneficial information through the agreement process.
  • TP will not collude with any participants. Therefore, TP can be seen as a more capable external attacker. We have analyzed external attacks before, and we know that any external attackers' attacks will be detected. Therefore, TP attacks will also be discovered with great probability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

本发明提供了一种可抗共谋的量子密钥协商方法、计算机终端及存储装置，包括第三方交互端TP和N个协商交互端Pi，由TP制备N个消息序列{S0，...，SN-1}，每个消息序列Si包含m个有序的量子比特，TP将每个Si对应发送给相应的Pi；N个协商交互端均将自己的秘密信息Ki根据编码规则编码到消息序列Si中，同时Pi随机产生m个量子诱骗态，并将其随机插入到编码后的消息序列中，得到新的序列Si i+1 ，Pi发送 Si i+1 给Pi+1；然后进行窃听检测，直到完成第N轮循环，再由TP发送Si中每个量子比特所在的量子基信息给Pi-1，Pi-1在相应的基下对消息序列Si进行测量，并计算出最终的协商密钥。本方法可以防止内部共谋者在密钥窃取阶段获取其他合法协商交互端的密钥异或信息，进而在密钥翻转阶段对最终的共享密钥进行控制。

Description

可抗共谋的量子密钥协商方法、计算机终端及存储装置 技术领域
本发明属于信息安全技术领域，尤其涉及一种可抗共谋的量子密钥协商方法。
背景技术
量子密钥协商(Quantum Key Agreement，QKA)是利用量子力学理论来实现密钥协商任务。量子密钥协商作为量子密码的新兴研究领域，解决了网络中群组织活动的密钥分享问题。
在不同的安全定义下，QKA可以分为两类。一种是弱安全定义下的QKA协议，两方或多方通过公开信道协商一个密钥。在该弱安全定义下，QKA协议就是我们所熟知的量子秘钥分发(Quantum Key Distribution，QKD)协议。在强安全定义下，QKA不仅要求所有的用户通过公开信道参与密钥生成过程，而且必须以公平、对等的方式(解决公平性需求)来产生共享密钥。在QKD中，由于一方能够完全地控制最终的密钥，因此它不是一个公平、对等的密钥协商协议。无法抵抗外部攻击者，以及不诚实参与者的内部攻击。
因此，现有技术还有待发展。
技术问题
本发明所要解决的技术问题在于提供一种可抗共谋的量子密钥协商方法，旨在解决现有的量子秘钥分发协议无法抵抗外部攻击者，以及不诚实参与者的内部攻击的问题。
技术解决方案
为解决上述技术问题，本发明是这样实现的：
一种可抗共谋的量子密钥协商方法，包括第三方交互端和N个协商交互端P i，0≤i≤N-1，每个协商交互端的秘密信息分别为K 0,K 1,...,k N-1∈{0,1} m，m为量子比特个数，P i在密钥协商过程中，下标为modN运算，协商方法包括如下：
步骤S1、第三方交互端制备N个量子序列{S 0,...,S N-1}，称为消息序列，每个消息序列S i包含m个有序的量子比特，第三方交互端将每个S i对应发送给相应的P i；
步骤S2、第一轮循环：P i将自己的秘密信息K i根据编码规则编码到消息序列S i中，同时P i随机产生m个量子诱骗态，并将其随机插入到编码后的消息序列中，得到新的序列
Figure PCTCN2019094732-appb-000001
P i发送
Figure PCTCN2019094732-appb-000002
给P i+1；
步骤S3、窃听检测：P i+1与P i根据
Figure PCTCN2019094732-appb-000003
及所述诱骗态的初始量子态信息进行信道安全检测，若判断为安全则执行步骤S4，否则返回步骤S1；
步骤S4、第二轮循环：P i+1将收到的
Figure PCTCN2019094732-appb-000004
去除诱骗态，得到经P i编码后的消息序列，P i+1根据所述编码规则将自己的秘密信息K i+1编码到经P i编码后的消息序列中，并随机制备m个量子诱骗态，然后将其插入到经P i+1编码后的消息序列中，得到新的消息序列
Figure PCTCN2019094732-appb-000005
P i+1发送
Figure PCTCN2019094732-appb-000006
给P i+2；
步骤S5、窃听检测：P i+2与P i+1根据
Figure PCTCN2019094732-appb-000007
及P i+1制备的所述诱骗态的初始量子态信息进行信道安全检测，若判断为安全则执行同步骤S4的下一个循环，直到完成第N轮循环，否则返回步骤S1；
步骤S6、第三方交互端发送每个消息序列S i中每个量子比特所在的量子基信息给P i-1，每一个协商交互端P i-1根据所述量子基信息对消息序列S i进行测量，得到消息序列
Figure PCTCN2019094732-appb-000008
据此，P i-1计算出最终的协商密钥为
Figure PCTCN2019094732-appb-000009
P i遍历所有的0≤i≤N-1，均计算出所述最终的协商密钥。
进一步地，在所述步骤S1和所述步骤S2之间还包括：对P i与第三方交互端之间的信道进行安全检测。
进一步地，所述对P i与第三方交互端之间的信道进行安全检测的方法包括：
第三方交互端制备N个诱骗态序列，{C 0,...,C N-1}，每个诱骗态序列C i分别包含m个有序的量子比特，第三方交互端将诱骗态序列C i随机地插入到消息序列S i中，得到新的序列S i'，并将S i'发送给P i，然后向P i公开S i'序列中C i的位置以及其所在的量子基，P i对S i'序列中的C i量子态在相应的量子基下进行测量，然后向第三方交互端随机公开一半的测量结果，第三方交互端向P i公开另一半C i的初始量子态信息，P i与第三方交互端根据测量结果及初始量子态信息对信道进行安全检测。
进一步地，诱骗态序列C i中，每个量子比特随机的从{|+y>,|-y>,|+>,|->}选取；其中|+y>,|-y>,|+>,|->表示不同的量子态，
Figure PCTCN2019094732-appb-000010
进一步地，在所述步骤S2中，所述编码规则为：
当K i的第j∈{1,...,m}位比特为0，则对消息序列S i的第j位量子态 执行酉操作I＝|0><0|+|1><1|；当K i的第j∈{1,...,m}位比特为1，那么对消息序列Si的第j位量子态执行酉操作U＝|0><1|-|1><0|。
进一步地，所述步骤S3包括：P i向P i+1公开每个
Figure PCTCN2019094732-appb-000011
序列中诱骗态的位置及其所在的量子基，P i+1对
Figure PCTCN2019094732-appb-000012
序列中的诱骗态在相应的量子基下进行测量，并随机公开一半的测量结果给P i，然后P i公开另一半诱骗态的初始量子态信息给P i+1，P i与P i+1根据测量结果及初始量子态信息对信道进行安全检测。
进一步地，消息序列S i中，每个量子比特从{|0>,|1>,|+>,|->}中选取，其中|0>,|1>,|+>,|->表示不同的量子态，|0>,|1>相互正交，
Figure PCTCN2019094732-appb-000013
一种计算机终端，用于N个协商交互端进行多方量子密钥协商，所述计算机终端包括：处理器、与处理器通信连接的存储器，所述存储器存储有计算机程序，所述处理器调用所述计算机程序时实现如上所述的可抗共谋的量子密钥协商方法。
一种存储装置，用于N个协商交互端进行多方量子密钥协商，所述存储装置存储有计算机程序，所述计算机程序被执行时实现如上所述的可抗共谋的量子密钥协商方法。
有益效果
本发明与现有技术相比，有益效果在于：本发明的多方量子密钥协商方法中，初始量子态由第三方交互端(ThirdParty，TP)制备。TP的作用就是制备初始量子态，发送量子态给用户，在协议最后公布初始量子态的信息，可以防止内部共谋者在密钥窃取阶段获取其他 合法协商交互端的密钥异或信息，进而在密钥翻转阶段对最终的共享密钥进行控制。
本发明的实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
本发明中多用户在密钥协商过程中，假定经典信道与量子信道均已被认证，并且没有噪音和信息的丢失。N位参与方分别通过N个协商交互端P i(0≤i≤N-1)，进行密钥协商。半诚实的第三方(ThirdPart y，TP)通过第三方交互端，忠实的按照协议的流程帮助N位参与者完成协议过程。所谓半诚实的第三方是指允许第三方TP通过计算结果推算参与者的秘密信息，但是不允许第三方TP与任何密钥协商参与者共谋。假设每个协商交互端的秘密信息分别为K 0,K 1,...,k N-1∈{0,1} m，m为量子比特个数，并且N位参与者共同协商获得最终的密钥：
Figure PCTCN2019094732-appb-000014
参与者P i在密钥协商过程中，下标为modN运算，即N位参与方在密钥协商过程中是按照顺序P i→P i+1→…→P N-1→P N-2→…→P i-1→P i依次进行协商。
协商方法包括如下：
步骤S1、第三方交互端制备N个量子序列{S 0,...,S N-1}，称为消息序列，每个消息序列S i包含m个有序的量子比特，第三方交互端将每个S i对应发送给相应的P i。
具体的，消息序列S i中，每个量子比特可以从{|0>,|1>,|+>,|->}中 选取，其中|0>,|1>,|+>,|->表示不同的量子态，|0>,|1>相互正交，
Figure PCTCN2019094732-appb-000015
初始量子态即消息序列，由TP制备，并将每个消息序列S i对应发送给相应的P i。由于内部攻击者的攻击分为两个过程：密钥窃取阶段和密钥翻转阶段。在密钥窃取阶段，内部共谋者可以获取其他合法用户的密钥异或信息。然后他们可以在密钥翻转阶段对最终的共享密钥进行控制，使得最终的共享秘钥不在由全体参与者共同公平的生成。之所以共谋者可以获得合法用户密钥的异或信息，在于共谋者生成初始量子态，即上述消息序列，并且共谋者共享该初始量子态的所有信息。有了初始态的信息，处于两个特殊位置的用户就可以顺利测量获得中间合法用户的密钥异或信息。为了阻止该共谋的发生，初始量子态由拥有更高量子制备能力的TP制备。TP的作用就是制备初始量子态，发送量子态给用户，在协议最后公布初始量子态的信息。通过TP制备初始量子态可以防止内部共谋者在密钥窃取阶段获取其他合法协商交互端的密钥异或信息，进而在密钥翻转阶段对最终的共享密钥进行控制。
可选的，可以对P i与第三方交互端TP之间的信道进行安全检测，以进一步提高密钥协商的安全性。本发明提供的一种P i与第三方交互端TP之间的信道安全检测实施例如下：可以由TP制备N个量子序列{C 0,...,C N-1}，称之为诱骗态序列，每个诱骗态序列C i分别包含m个有序的量子比特，具体的，每个量子比特可以随机的从{|+y>,|-y>,|+>,|->}中选取；其中|+y>,|-y>,|+>,|->表示不同的量子 态，
Figure PCTCN2019094732-appb-000016
TP将诱骗态序列C i随机地插入到消息序列S i中，得到新的序列S i'，并将S i'发送给P i。对于所有的i＝0,1,...,N-1，当P i接收到S i'，可以向TP发送收到S i'的回执。当TP收到所有N个用户的回执信息后，TP向P i公开在每个S i'序列中C i的位置以及其所在的量子基信息。通过TP的公开信息，P i对S i'序列中的C i量子态在相应的量子基下进行测量，并记录测量结果。然后P i随机的公开一半的测量结果给TP；相应地，TP公开另一半C i的初始量子态信息给P i。P i与TP对信道进行安全检测，计算出错误率。如果错误率超过预先设定的阈值，P i与TP确认信道有窃听，并终止此次通信，返回第最开始，重新执行；当所有的N个量子信道全部安全，则协议进入下一步。
步骤S2、第一轮循环：P i将自己的秘密信息K i根据编码规则编码到消息序列S i中，同时P i随机产生m个量子诱骗态，并将其随机插入到编码后的消息序列中，得到新的序列
Figure PCTCN2019094732-appb-000017
P i发送
Figure PCTCN2019094732-appb-000018
给P i+1。
具体的，对于所有的i＝0,1,...,N-1，P i收到TP发送的消息序列S i后，将自己的秘密信息K i编码到消息序列S i。可以通过酉操作编码规则进行编码。例如，当K i的第j∈{1,...,m}位比特为0，那么对消息序列S i的第j位量子态执行酉操作I＝|0><0|+|1><1|；当K i的第j∈{1,...,m}位比特为1，那么对消息序列S i的第j位量子态执行酉操作U＝|0><1|-|1><0|。然后，按照步骤S1，P i随机产生m个量子诱骗态，随机的将其插入到编码后的消息序列，产生的新的序列标注为
Figure PCTCN2019094732-appb-000019
P i发送
Figure PCTCN2019094732-appb-000020
给P i+1。
步骤S3、窃听检测：P i+1与P i根据
Figure PCTCN2019094732-appb-000021
及所述诱骗态的初始量子态 信息进行信道安全检测，若判断为安全则执行步骤S4，否则返回步骤S1。
本发明提供了两个交互端之间的信道安全检测方法如下：P i向P i+1公开每个
Figure PCTCN2019094732-appb-000022
序列中诱骗态的位置及其所在的量子基信息，P i+1对
Figure PCTCN2019094732-appb-000023
序列中的诱骗态在相应的量子基下进行测量，并随机公开一半的测量结果给P i，然后P i公开另一半诱骗态的初始量子态信息给P i+1，P i与P i+1对信道进行安全检测。
上述检测更为具体的步骤是：对于所有的i＝0,1,...,N-1，当确定P i+1接收到
Figure PCTCN2019094732-appb-000024
后，P i和P i+1开始检测量子信道中的窃听，P i公开在每个
Figure PCTCN2019094732-appb-000025
序列中诱骗态的位置以及其所在的量子基信息。通过P i的公开信息，P i+1对
Figure PCTCN2019094732-appb-000026
序列中的诱骗态在相应的量子基下进行测量，并记录测量结果。然后随机的公开一半的测量结果给P i；相应地，P i公开另一半诱骗态的初始量子态信息给P i+1。P i与P i+1对信道进行安全检测，即比较测量结果与诱骗态的初始量子态信息，计算出错误率。如果错误率超过预先设定的阈值，P i与P i+1确认信道有窃听，并终止此次通信，并返回步骤S1，协议重新执行；当所有的N个量子信道全部安全，则执行下一步。
步骤S4、第二轮循环：P i+1将收到的
Figure PCTCN2019094732-appb-000027
去除诱骗态，得到经P i编码后的消息序列，P i+1根据所述编码规则将自己的秘密信息K i+1编码到经P i编码后的消息序列中，并随机制备m个量子诱骗态，然后将其插入到经P i+1编码后的消息序列中，得到新的消息序列
Figure PCTCN2019094732-appb-000028
P i+1发送
Figure PCTCN2019094732-appb-000029
给P i+2。
步骤S5、窃听检测：P i+2与P i+1根据
Figure PCTCN2019094732-appb-000030
及P i+1制备的所述诱骗态的初始量子态信息进行信道安全检测，若判断为安全则执行同步骤S4的下一个循环，直到完成第N轮循环，否则返回步骤S1；
步骤S4同步骤S2，步骤S5同步骤S3，分别对应着不同轮次量子密钥协商循环和不同轮次窃听检测，本发明不再赘述。
步骤S6、第三方交互端发送每个消息序列S i中每个量子比特所在的量子基信息给P i-1，每一个协商交互端P i-1在相应的基下对消息序列S i进行测量，得到一串m比特的消息序列
Figure PCTCN2019094732-appb-000031
据此，P i-1计算出最终的协商密钥为
Figure PCTCN2019094732-appb-000032
P i遍历所有的0≤i≤N-1，均计算出所述最终的协商密钥。
在执行完最后一轮信息编码和窃听检测后，P i-1接收到P i-2发送来的消息序列
Figure PCTCN2019094732-appb-000033
窃听检测后获得安全的编码后的消息序列S i，P i-1可以发送消息给TP，确认循环结束。此时TP发送每个消息序列S i中每个量子比特所在的量子基信息给对应的P i-1，每一个协商交互端P i-1在相应的基下对消息序列S i进行测量，得到一串m比特的消息序列
Figure PCTCN2019094732-appb-000034
然后，P i-1计算出最终的协商密钥为
Figure PCTCN2019094732-appb-000035
此时所有的N个用户都可以采用同样的方法计算出相同的协商密钥K。
本发明的技术方案对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机终端(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所 述方法的全部或部分步骤。而前述的存储装置包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
协议的安全性
对于本协议的安全性分析，主要分析两种方式的攻击。一种是外部攻击：外部攻击者试图获取用户的秘密信息和最终的协商密钥；一种是内部攻击：参与者试图控制最终的密钥生成。TP是一个特殊的内部攻击者，他拥有比其他用户更强的攻击能力。攻击分析过程如下：
(1)外部攻击
本协议中，为了检测外部攻击，任意两个用户信道之间，使用m个量子诱骗态来检测攻击。诱骗态技术是量子密码主要的检测窃听技术之一，该方法最早在BB84协议中被提出，并且该方法的安全性证明已经被证明。任何对量子信道的窃听行为，都将被检测到。利用该窃听检测技术，现在已有的各种攻击手段，如拦截重放攻击、测量重放攻击、纠缠测量攻击等，将全部无效。
(2)内部攻击
内部参与者比外部攻击者拥有更多的资源，可以通过在协议过程中说谎来获得经济利益。因此，所有的QKA协议必须可以抵抗内部攻击者的攻击。内部攻击者的攻击可以分为两个过程：密钥窃取阶段和密钥翻转阶段。在密钥窃取阶段，内部共谋者可以获取其他合法用户的密钥异或信息。然后他们可以在密钥翻转阶段对最终的共享密钥进 行控制，使得最终的共享秘钥不在由全体参与者共同公平的生成。之所以共谋者可以获得合法用户密钥的异或信息，在于共谋者生成初始量子态，并且共谋者共享该初始量子态的所有信息。有了初始态的信息，处于两个特殊位置的用户就可以顺利测量获得中间合法用户的密钥异或信息。为了阻止该共谋的发生，初始量子态由拥有更高量子制备能力的TP制备。TP的作用就是制备初始量子态，发送量子态给用户，在协议最后公布初始量子态的信息。协议中，假设TP为半诚实用户，即TP按要求诚实执行协议，不与任何用户共谋，但是他可以通过协议过程获得某些有利的信息。
考虑最坏情况下，仅有一个诚实用户P t,t∈{0,...,N-1}，其他N-1个用户共谋。在此情况下，如果共谋攻击成功，N-1个用户需要在协议结束之前获得P t的密钥K t，具体描述为，TP发送量子序列S t+1给用户P t+1，然后其他N-2个用户依次进行窃听检测操作而不进行任何信息编码操作。当P t-1接收到用户P t-2发送来的量子序列S t+1，他将
Figure PCTCN2019094732-appb-000036
编码到序列S t+1，并安全发送给P t。通过协议过程，可以计算，P t获得的共享密钥为K'。其中K'为N-1个共谋用户控制的密钥。
然而，在协议过程中P t的密钥K t不会泄露给任何人。主要原因在于TP制备初始量子态，并且他不会与任何参与者共谋，共谋者想要获得P t的密钥K t，唯一的方法就是通过测量量子信道。然而利用诱骗量子态检测技术，任何的测量窃听行为都会被合法用户检测到。因此该攻击不可行，协议可安全抵抗内部攻击者。
(3)TP攻击：TP试图获取参与者的共享密钥
由于在该半诚实模型下，TP不会与任何参与者共谋。因此，TP可看做一个能力更强的外部攻击者。前面已经对外部攻击作出分析，我们知道，任何外部攻击者的攻击行为都将被检测到。因此TP的攻击也将被极大的概率被发现。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (9)

  1. 一种可抗共谋的量子密钥协商方法，其特征在于，包括第三方交互端和N个协商交互端P i，0≤i≤N-1，每个协商交互端的秘密信息分别为K 0,K 1,...,k N-1∈{0,1} m，m为量子比特个数，P i在密钥协商过程中，下标为modN运算，协商方法包括如下：步骤S1、第三方交互端制备N个量子序列{S 0,...,S N-1}，称为消息序列，每个消息序列S i包含m个有序的量子比特，第三方交互端将每个S i对应发送给相应的P i；
    步骤S2、第一轮循环：P i将自己的秘密信息K i根据编码规则编码到消息序列S i中，同时P i随机产生m个量子诱骗态，并将其随机插入到编码后的消息序列中，得到新的序列
    Figure PCTCN2019094732-appb-100001
    P i发送
    Figure PCTCN2019094732-appb-100002
    给P i+1；
    步骤S3、窃听检测：P i+1与P i根据
    Figure PCTCN2019094732-appb-100003
    及所述诱骗态的初始量子态信息进行信道安全检测，若判断为安全则执行步骤S4，否则返回步骤S1；
    步骤S4、第二轮循环：P i+1将收到的
    Figure PCTCN2019094732-appb-100004
    去除诱骗态，得到经P i编码后的消息序列，P i+1根据所述编码规则将自己的秘密信息K i+1编码到经P i编码后的消息序列中，并随机制备m个量子诱骗态，然后将其插入到经P i+1编码后的消息序列中，得到新的消息序列
    Figure PCTCN2019094732-appb-100005
    P i+1发送
    Figure PCTCN2019094732-appb-100006
    给P i+2；
    步骤S5、窃听检测：P i+2与P i+1根据
    Figure PCTCN2019094732-appb-100007
    及P i+1制备的所述诱骗态的初始量子态信息进行信道安全检测，若判断为安全则执行同步骤S4的下一个循环，直到完成第N轮循环，否则返回步骤S1；
    步骤S6、第三方交互端发送每个消息序列S i中每个量子比特所在的量子基信息给P i-1，每一个协商交互端P i-1根据所述量子基信息对消息序列S i进行测量，得到消息序列
    Figure PCTCN2019094732-appb-100008
    据此，P i-1计算出最终的协商密钥为
    Figure PCTCN2019094732-appb-100009
    P i遍历所 有的0≤i≤N-1，均计算出所述最终的协商密钥。
  2. 如权利要求1所述的可抗共谋的量子密钥协商方法，其特征在于，在所述步骤S1和所述步骤S2之间还包括：对P i与第三方交互端之间的信道进行安全检测。
  3. 如权利要求2所述的可抗共谋的量子密钥协商方法，其特征在于，所述对P i与第三方交互端之间的信道进行安全检测的方法包括：
    第三方交互端制备N个诱骗态序列，{C 0,...,C N-1}，每个诱骗态序列C i分别包含m个有序的量子比特，第三方交互端将诱骗态序列C i随机地插入到消息序列S i中，得到新的序列S i'，并将S i'发送给P i，然后向P i公开S i'序列中C i的位置以及其所在的量子基，P i对S i'序列中的C i量子态在相应的量子基下进行测量，然后向第三方交互端随机公开一半的测量结果，第三方交互端向P i公开另一半C i的初始量子态信息，P i与第三方交互端根据测量结果及初始量子态信息对信道进行安全检测。
  4. 如权利要求3所述的可抗共谋的量子密钥协商方法，其特征在于，诱骗态序列C i中，每个量子比特随机的从{|+y>,|-y>,|+>,|->}选取；其中|+y>,|-y>,|+>,|->表示不同的量子态，
    Figure PCTCN2019094732-appb-100010
    Figure PCTCN2019094732-appb-100011
  5. 如权利要求1所述的可抗共谋的量子密钥协商方法，其特征在于，在所述步骤S2中，所述编码规则为：
    当K i的第j∈{1,...,m}位比特为0，则对消息序列S i的第j位量子态执行酉操作I＝|0><0|+|1><1|；当K i的第j∈{1,...,m}位比特为1，那么对消息序列S i的第j位量子态执行酉操作U＝|0><1|-|1><0|。
  6. 如权利要求1所述的可抗共谋的量子密钥协商方法，其特征 在于，所述步骤S3包括：P i向P i+1公开每个
    Figure PCTCN2019094732-appb-100012
    序列中诱骗态的位置及其所在的量子基，P i+1对
    Figure PCTCN2019094732-appb-100013
    序列中的诱骗态在相应的量子基下进行测量，并随机公开一半的测量结果给P i，然后P i公开另一半诱骗态的初始量子态信息给P i+1，P i与P i+1根据测量结果及初始量子态信息对信道进行安全检测。
  7. 如权利要求1-6任一所述的可抗共谋的量子密钥协商方法，其特征在于，消息序列S i中，每个量子比特从{|0>,|1>,|+>,|->}中选取，其中|0>,|1>,|+>,|->表示不同的量子态，|0>,|1>相互正交，
    Figure PCTCN2019094732-appb-100014
  8. 一种计算机终端，其特征在于，用于N个协商交互端进行多方量子密钥协商，所述计算机终端包括：处理器、与处理器通信连接的存储器，所述存储器存储有计算机程序，所述处理器调用所述计算机程序时实现如权利要求1-7任一项所述的可抗共谋的量子密钥协商方法。
  9. 一种存储装置，其特征在于，用于N个协商交互端进行多方量子密钥协商，所述存储装置存储有计算机程序，所述计算机程序被执行时实现如权利要求1-7任一项所述的可抗共谋的量子密钥协商方法。
PCT/CN2019/094732 2019-07-04 2019-07-04 可抗共谋的量子密钥协商方法、计算机终端及存储装置 WO2021000328A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/094732 WO2021000328A1 (zh) 2019-07-04 2019-07-04 可抗共谋的量子密钥协商方法、计算机终端及存储装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/094732 WO2021000328A1 (zh) 2019-07-04 2019-07-04 可抗共谋的量子密钥协商方法、计算机终端及存储装置

Publications (1)

Publication Number Publication Date
WO2021000328A1 true WO2021000328A1 (zh) 2021-01-07

Family

ID=74100141

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/094732 WO2021000328A1 (zh) 2019-07-04 2019-07-04 可抗共谋的量子密钥协商方法、计算机终端及存储装置

Country Status (1)

Country Link
WO (1) WO2021000328A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100293380A1 (en) * 2008-01-25 2010-11-18 Qinetiq Limited Quantum cryptography apparatus
CN105846999A (zh) * 2016-06-14 2016-08-10 泰山学院 基于单向传输回路的多方量子密钥协商方法
CN109450590A (zh) * 2018-08-24 2019-03-08 浙江九州量子信息技术股份有限公司 用于qkd的基于准循环ldpc的自适应密钥协商方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100293380A1 (en) * 2008-01-25 2010-11-18 Qinetiq Limited Quantum cryptography apparatus
CN105846999A (zh) * 2016-06-14 2016-08-10 泰山学院 基于单向传输回路的多方量子密钥协商方法
CN109450590A (zh) * 2018-08-24 2019-03-08 浙江九州量子信息技术股份有限公司 用于qkd的基于准循环ldpc的自适应密钥协商方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CHEN, HUI ET AL.: "Security Analysis of Decoy-State Quantum Key Distribution System", INFORMATION SECURITY AND COMMUNICATIONS PRIVACY, 10 August 2011 (2011-08-10), DOI: 20200319100858A *
SUN, ZHIWEI ET AL.: "Efficient Multiparty Quantum Key Agreement With a Single d -Level Quantum System Secure Against Collusive Attack", IEEE ACCESS ( VOLUME: 7 ), 29 June 2019 (2019-06-29), DOI: 20200319100332A *

Similar Documents

Publication Publication Date Title
WO2021000329A1 (zh) 一种多方量子秘钥协商方法、计算机终端及存储装置
CN108809644B (zh) 基于高能级bell态的无序高容量多方量子密钥协商方法
CN109327308B (zh) 一种具有双向身份认证功能的量子密钥分发方法及系统
CN105553648B (zh) 量子密钥分发、隐私放大及数据传输方法、装置及系统
CN106888085B (zh) 一种基于最大纠缠ghz态的多方量子对话方法
CN108632261B (zh) 多方量子求和方法及系统
CN105245332B (zh) 基于四粒子χ态的两方量子密钥协商协议
CN108173654B (zh) 一种基于半量子技术的两方密钥协商方法及系统
CN110213060A (zh) 一种基于量子行走的无纠缠的量子盲签名方法及系统
CN113141252A (zh) 一种量子密钥分发方法、量子通信方法及装置和系统
CN111082937B (zh) 一种基于单光子的双向身份认证方法
Yen et al. Quantum direct communication with mutual authentication
CN110365477B (zh) 可抗共谋的量子密钥协商方法、计算机终端及存储装置
KR20120071883A (ko) 양자 비밀 공유 프로토콜을 위한 양자 인증 방법 및 장치
CN113114456B (zh) 一种带认证的多用户量子隐私查询方法
CN109617686A (zh) 一种改进的基于格的密钥交换协议算法
CN111404691B (zh) 基于量子行走的具有可信认证的量子秘密共享方法
US20230188222A1 (en) Measurement device independent quantum secure direct communication with user authentication
WO2021000328A1 (zh) 可抗共谋的量子密钥协商方法、计算机终端及存储装置
CN114362945B (zh) 一种基于纠缠交换的量子秘密共享方法
CN109039477B (zh) 一种基于无消相干子空间的可容错量子对话方法
CN115189868A (zh) 一种基于Bell态的可认证的多方量子密钥协商方法及系统
CN109711932B (zh) 一种基于量子隐形传态的多群电子商务签名方法
CN110336659A (zh) 一种多方量子秘钥协商方法、计算机终端及存储装置
CN107968685B (zh) 量子通信掷硬币方法及中继系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19936217

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19936217

Country of ref document: EP

Kind code of ref document: A1