WO2022016593A1 - 基于业务安全等级的量子密钥分发保护方法及系统 - Google Patents

基于业务安全等级的量子密钥分发保护方法及系统 Download PDF

Info

Publication number
WO2022016593A1
WO2022016593A1 PCT/CN2020/105536 CN2020105536W WO2022016593A1 WO 2022016593 A1 WO2022016593 A1 WO 2022016593A1 CN 2020105536 W CN2020105536 W CN 2020105536W WO 2022016593 A1 WO2022016593 A1 WO 2022016593A1
Authority
WO
WIPO (PCT)
Prior art keywords
quantum key
path
quantum
protection
service request
Prior art date
Application number
PCT/CN2020/105536
Other languages
English (en)
French (fr)
Inventor
陈伯文
马维克
沈纲祥
高明义
向练
陈虹
Original Assignee
苏州大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州大学 filed Critical 苏州大学
Publication of WO2022016593A1 publication Critical patent/WO2022016593A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/22—Alternate routing

Definitions

  • the invention relates to the technical field of optical network quantum key distribution, in particular to a quantum key distribution protection method and system based on a business security level.
  • optical networks have gradually become larger, more intelligent, and more widely used.
  • the security of optical network transmission data has attracted more and more attention.
  • the loss of optical network transmission data security may affect a large number of users and services.
  • the optical network is the infrastructure for the transmission of data services. Because of the inherent isolation of the optical signal inside the optical fiber medium, the optical fiber transmission network is considered to be a very secure network.
  • optical networks have suffered more and more eavesdropping and interception.
  • Data encryption is an effective way to enhance the security of communications because it prevents eavesdroppers from accessing data.
  • the quantum key distribution technology based on the quantum non-cloning theorem and Heisenberg's uncertainty theorem can encrypt messages exchanged between two endpoints through a randomly generated shared secure quantum key, thereby greatly improving data service transmission. security.
  • Quantum key distribution generates a shared random quantum key. Only both users know the encrypted and decrypted data information, and the single-photon quantum state encodes the key information. Through the quantum channel, potential eavesdroppers can be detected.
  • the technical problem to be solved by the present invention is to overcome the problem of high failure risk in the data transmission process in the prior art, thereby providing a method to reduce the failure risk existing in the data transmission process and ensure that the service request is in the transmission process.
  • a quantum key distribution protection method based on a service security level of the present invention includes: setting a network topology, initializing network parameters in the network topology; establishing a service request, and generating a service Request security level; according to the source node and destination node of the connection request, calculate multiple candidate paths from the source node to the destination node, select the optimal path as the working path, and allocate resources to the working path; set the quantum key
  • the maximum protection threshold according to the security requirement degree of the service request and the quantum key sharing degree, establishes a protection path that does not intersect with the quantum channel, and allocates resources to the protection path; completes the assignment of the corresponding wavelengths of the working path and the protection path.
  • the initialization and update of quantum keys completes the establishment of business requests.
  • a network topology structure is set, and a method for initializing network parameters in the network topology structure is: configuring the network topology structure in the optical network, link status in the optical network, network optical switching nodes The number of fiber links, the number of wavelengths in the link, and the number of time slots in the wavelength.
  • the method for generating the security level of the service request is: pre-classifying the service request, determining the quantum key update time, and prioritizing and restoring the quantum key service order according to the encrypted quantum key update time.
  • K shortest path algorithms are used to establish traditional working, quantum signal, and public interactive channel paths. If the path is established successfully, the next step is performed, otherwise, it is considered that A business request is blocked.
  • the method for allocating resources to the working path is as follows: in the selected working path, according to the first hit algorithm, wavelengths are allocated to the working path, quantum channel, and common interaction channel; according to the first hit algorithm , allocate time slots in the specific wavelengths of the quantum channel and the public interaction channel, which are respectively used for the initialization of the quantum key and clock synchronization; in the specific wavelength of the quantum channel, the quantum key is updated according to the required number of generated time slots. time slot allocation.
  • the quantum key sharing degree threshold of each protection path is determined.
  • the shortest path algorithm is used to establish a protection path that does not intersect with the quantum working channel.
  • the method for allocating resources to the protection path is: according to the first hit algorithm, under the principle of wavelength continuity in the link, allocating wavelengths to the quantum key protection path; Algorithm, according to the quantum key requirements and quantum key update time of each service request, allocate corresponding time slots to initialize and update quantum keys.
  • the working path, the quantum channel, the public interaction channel and the protection path are selected for the connection request, and After the quantum channel allocates quantum key resources, the link state is updated.
  • the present invention also provides a quantum key distribution protection system based on business security level, comprising: a network initialization module for setting a network topology structure and initializing network parameters in the network topology structure; a business request module for using It is used to establish a service request and generate the security level of the service request; the working path module is used to calculate multiple candidate paths from the source node to the destination node according to the source node and the destination node of the connection request, and select the optimal path as the working path.
  • a network initialization module for setting a network topology structure and initializing network parameters in the network topology structure
  • a business request module for using It is used to establish a service request and generate the security level of the service request
  • the working path module is used to calculate multiple candidate paths from the source node to the destination node according to the source node and the destination node of the connection request, and select the optimal path as the working path.
  • a protection path module is used to establish a protection path that does not intersect with the quantum channel according to the security requirement degree of the service request and the quantum key sharing degree, and allocate resources to the protection path; resource allocation The module is used for allocating the corresponding wavelength and quantum key resources to the working path and the protection path to complete the establishment of the service request.
  • the quantum key of each business needs to provide a job path and a protection path.
  • the quantum key on the working path can be switched to the protection path, which solves the survivability of the quantum key, ensures more secure and transmission of data, and improves the security and stability of the business.
  • the sequence of service quantum key recovery is determined, and the survivability of quantum keys in optical networks and the problem of quantum key utilization are solved.
  • Fig. 1 is the flow chart of the quantum key distribution protection method based on business security level of the present invention
  • Fig. 2 is the topological structure diagram of the optical network of the present invention.
  • Fig. 3a is a schematic diagram of wavelength assignment of working path, quantum, and common interactive channel of the present invention.
  • Fig. 3b is the schematic diagram of wavelength assignment of protection working path, quantum, and public interactive channel of the present invention.
  • Fig. 3c is the initialization and update schematic diagram of the quantum key of the present invention.
  • Fig. 3d is a schematic diagram of the time slot allocation of the quantum protection channel when the quantum key sharing degree of the present invention is 1;
  • 3e is a schematic diagram of time slot allocation of quantum protection channel when the quantum key sharing degree of the present invention is 2;
  • FIG. 4 is a schematic diagram of the quantum key distribution protection system based on the service security level of the present invention.
  • this embodiment provides a quantum key distribution protection method based on service security level.
  • Step S1 set a network topology, and initialize network parameters in the network topology;
  • step S2 establish a service request, and generate a service request security level;
  • Step S3 Calculate multiple candidate paths from the source node to the destination node according to the source node and the destination node of the connection request, select the optimal path as the working path, and perform the operation on the working path.
  • Step S4 Set the maximum protection threshold of the quantum key, establish a protection path that does not intersect with the quantum channel according to the security requirement degree of the service request and the quantum key sharing degree, and allocate resources to the protection path;
  • Step S5 Complete the assignment of the corresponding wavelengths of the working path and the protection path and the initialization and update of the quantum key, and complete the establishment of the service request.
  • a network topology structure is set, and network parameters in the network topology structure are initialized, which is beneficial to the operation of the service;
  • the step In S2 a service request is established, and a service request security level is generated, which is beneficial to realize the protection and recovery of damaged services, and ensure the service quality of the service request in the transmission process;
  • the step S3 according to the source node and destination node of the connection request , calculate a plurality of candidate paths from the source node to the destination node, select the optimal path as the working path, and allocate resources to the working path, which is beneficial to ensure the safe transmission of data and improve the security and stability of the business;
  • the step In S4 the maximum protection threshold of the quantum key is set, and according to the security requirement of the service request and the quantum key sharing degree, a protection path that does not intersect with the quantum channel is established, and resources are allocated to the protection path, and the protection technology has faster
  • the step S5 the corresponding
  • quantum keys and the initialization and update of quantum keys complete the establishment of business requests. Since quantum key resources are reserved for each connection request on the protection path, when the network fails, the quantum keys on the working path can be switched to On the protection path, solve the survivability of quantum keys, ensure more security and transmission of data, and improve the security and stability of business.
  • the network topology structure is set, and the method for initializing the network parameters in the network topology structure is: configuring the network topology structure in the optical network, the link status in the optical network, the number of network optical switching nodes, the optical fiber
  • the number of links, the number of wavelengths in the link, and the number of time slots in the wavelength are beneficial to ensure the stable operation of the service.
  • N is the set of nodes
  • L is the set of directed links
  • S k ⁇ s 1 , s 2 , s 3 ,... ⁇ is the quantum density in the optical network
  • the quantum key sharing degree is defined as the number of quantum keys that can be shared by each time slot.
  • a network topology diagram consisting of 6 nodes and 8 links.
  • Each fiber link is bidirectional, the number of wavelengths in each link is 40, and there are 100 time slots in each wavelength.
  • the quantum channel and the public interaction channel are each allocated 4 wavelengths, the traditional channel for service request transmission is allocated 28 wavelengths, and 4 wavelengths are reserved between the quantum channel and the public interaction channel as a protection bandwidth.
  • step S2 when establishing a service request, set the number of traditional work, quantum, and public interactive channel wavelengths to be allocated for each service, and the number of time slots required for quantum key distribution and quantum key update for each service.
  • connection requests are generated according to the uniform distribution of source nodes and destination nodes, and information such as the number of connection requests, the source nodes and destination nodes of different connection requests, and bandwidth requirements are configured.
  • the service request is represented by R(s,d,n,t), which represents the service request from the source node s to the destination node d.
  • the number of quantum keys used to encrypt the service request is n time slots, where t is the update time of the quantum key. Set the number of wavelengths of traditional work, quantum, and public interaction channels that need to be allocated for each service, and the number of time slots required for quantum key distribution and quantum key update for each service.
  • the method of generating the security level of the service request is as follows: pre-classify the service request, determine the quantum key update time, and prioritize and restore the quantum key service order according to the encrypted quantum key update time, which is beneficial to ensure that the data is encrypted with the quantum key. Survival quality of service.
  • the invention divides the quantum key priority according to the security service requirement of each connection request, matches the corresponding quantum key update time, and provides a quantum signal channel protection method for each connection request according to the security service requirement degree of different services.
  • the network can quickly determine the priority of recovering data, reduce the risk of failure in the transmission process of business requests, and ensure the quality of service of business requests during the transmission process.
  • the method for pre-classifying the service request is: dividing the security level of the service request, and pre-classifying the service request according to the quantum key update time.
  • the business request generates the corresponding quantum key update time.
  • the shorter the quantum key update time the higher the security requirements of the business request.
  • priority is given to recovering quantum keys with high levels.
  • the same protection time slot resource is given priority to restore service requests with high security requirements, which is conducive to the protection and restoration of damaged services.
  • the security level is divided and sorted according to the key update time of the service request, wherein the two service requests R 1 (1, 3, 2 , 20) and R 2 (1, 3, 2, 30), because R The key update time of 1 is shorter, the security requirements of business requests are higher, and when a failure occurs, the priority of R 1 recovery is higher.
  • K shortest path algorithms are used to establish traditional work, quantum signal, and public interactive channel paths. If the path is established successfully, the next step is performed, otherwise, A business request is considered to be blocked.
  • the K shortest path algorithm is used to calculate the classical data working path, quantum channel, and common interaction channel.
  • the working path, quantum channel, and common interaction channel selected by the service request R 1 (1, 3, 2, 20) are path I (1-2-3).
  • the method for allocating resources to the working path is: according to the first hit algorithm in the selected working path, assign wavelengths to the working path, the quantum channel, and the common interactive channel; Time slots are allocated in specific wavelengths, which are respectively used for the initialization of quantum keys and clock synchronization; in specific wavelengths of quantum channels, time slots for quantum key update are allocated according to the required number of time slots generated.
  • the quantum key information used for encryption between two users is constantly changed, making it difficult for eavesdroppers to crack.
  • the quantum key update time generated by the service request in the specific wavelength of the quantum channel, the corresponding time slot is allocated for the update of the quantum key resource.
  • the working path I (1-2-3) According to the wavelength requirements and quantum key requirements of the service request service, it is necessary to find 28 consecutive wavelengths in the path I (1-2-3) for the service request.
  • find 4 consecutive wavelengths to establish a quantum channel 4 consecutive wavelengths are used to establish a common interactive channel for clock synchronization of quantum keys; and find two wavelengths allocated by the quantum channel Consecutive time slots are used for the initialization of quantum keys. After 20 time slots of the update time, on the specific wavelength of the quantum channel, find two free continuous time slots for the update of the quantum key.
  • step S4 when establishing a protection path that does not intersect with the quantum channel, when the quantum key sharing degree in the optical network is set to 1, the quantum channel protection path is a dedicated protection path; if the quantum key sharing degree in the optical network is a dedicated protection path; When the setting of is greater than 1, multiple service requests share the same protection path.
  • the shortest path algorithm is used to establish a protection path that does not intersect with the quantum working channel.
  • the quantum channel protection path is a dedicated protection path, and when Sk > 1, multiple service requests can share the same protection path. If the path is established successfully, go to the next step, otherwise the service request will be blocked.
  • the quantum key service fails, it can adaptively select the protection path according to the security requirement priority level of the business request and the quantum key sharing degree, so as to perform the automatic recovery function of the damaged key, and form a fast protection switch to restore the affected key. loss of quantum channel.
  • the thresholds of different quantum key sharing degrees are set.
  • the threshold of quantum key sharing degree reflects the maximum sharing capability of quantum key resources, so that the threshold of quantum key sharing degree can be properly adjusted according to user security service quality requirements, and the efficiency of quantum key resources can be improved.
  • the present invention introduces the concept of quantum key sharing degree, and also needs to determine the quantum key sharing degree threshold of each protection path.
  • the maximum protection threshold of the key can reduce the vicious competition caused by the failure of multiple quantum key distributions at the same time, and alleviate the high blocking rate caused by the improvement of security performance.
  • the method for allocating resources to the protection path is: according to the first hit algorithm, under the principle of satisfying wavelength continuity in the link, assign wavelengths to the quantum key protection path; according to the first hit algorithm, according to the quantum of each service request. Key requirements and quantum key update time, allocate corresponding time slots to initialize and update quantum keys.
  • quantum channel in the working path, quantum channel, and common interactive channel, it is necessary to search for wavelength resources that meet the frequency band, reduce the impact of physical layer damage, and ensure that the allocated wavelength resources can meet the continuity conditions.
  • the corresponding protection bandwidth needs to be allocated between the quantum channel and the public interaction channel to ensure the optimal state of quantum signal transmission and secure key generation rate.
  • the security degree of the service request is sorted according to the update time of the quantum key.
  • the first hit method is used to find the idle time slot resources in the wavelength, and the quantum key is initialized and updated.
  • connection request data After the connection request data is encrypted and transmitted, first release the quantum key resources on each time slot in the quantum channel and the corresponding protection channel; release the wavelength resources allocated by the working path, quantum channel, and public interaction channel; finally, put this The working path, quantum channel, and common interaction channel established by the connection request are removed.
  • the threshold size of the quantum key sharing degree is set.
  • S 1 1 at this time the shared protection is converted into dedicated protection, and the available protection wavelengths ⁇ 1 , ⁇ 2 , ⁇ 3 , ⁇ 4 ⁇ are searched according to the first hit method and wavelength continuity as the specific wavelength for distributing quantum key resources .
  • the available protection time slot resources that is, the reserved time slot number is ⁇ t 1 , t 2 ⁇ as the service request R 1 (1,3,2,20) protected quantum key initialization and update resources.
  • step S5 the working path, the quantum channel, the public interaction channel and the protection path are selected for the connection request, and after the quantum key resource is allocated in the quantum channel, the link state is updated, the service request is established successfully, and the task is ended.
  • the service request R 1 (1, 3, 2, 20) is successfully established.
  • the above steps S2-S5 may be repeated for the next service request.
  • the service request R 2 (1,3,2,30) can repeat the above steps S2-S5, in the working path, quantum channel, common interaction channel I (1-2-3), quantum protection channel II (1 -4-5-3) respectively reserve the corresponding wavelength and time gap for the initialization and update of the quantum key.
  • the selected working path, quantum, and wavelength assignment of the common interactive channel are shown in Fig. 3a, and the initialization and update of the quantum key are shown in Fig. 3c.
  • the selected quantum guard channel wavelength and time slot resource allocation are shown in Fig. 3b and Fig. 3d.
  • this embodiment provides a quantum key distribution protection system based on business security level, and the principle of solving the problem is similar to the quantum key distribution protection method based on business security level. , and the repetition will not be repeated.
  • This embodiment provides a quantum key distribution protection system based on a business security level, including:
  • a network initialization module 10 configured to set a network topology, and initialize network parameters in the network topology
  • a service request module 20 configured to establish a service request and generate a service request security level
  • the working path module 30 is configured to calculate a plurality of candidate paths from the source node to the destination node according to the source node and the destination node of the connection request, select the optimal path as the working path, and allocate resources to the working path;
  • the protection path module 40 is used to set the maximum protection threshold of the quantum key, establish a protection path that does not intersect with the quantum channel according to the security requirement degree of the service request and the quantum key sharing degree, and allocate resources to the protection path;
  • the resource allocation module 50 is used to complete the allocation of the corresponding wavelengths of the working path and the protection path, and the initialization and update of the quantum key, and complete the establishment of the service request.
  • a threshold setting module may also be included, for setting the threshold of the quantum key sharing degree according to the security requirements of the service request. According to user security requirements, the threshold of quantum key sharing is appropriately adjusted.
  • the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Optical Communication System (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明涉及一种基于业务安全等级的量子密钥分发保护方法及系统,包括：设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；建立业务请求，并生成业务请求安全等级；根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；完成所述工作路径和保护路径相应波长的分配及量子密钥资源初始化及更新。本发明减少业务请求在传输过程中存在的故障风险，保证业务请求在传输过程的服务质量。

Description

基于业务安全等级的量子密钥分发保护方法及系统 技术领域
本发明涉及光网络量子密钥分发的技术领域，尤其是指一种基于业务安全等级的量子密钥分发保护方法及系统。
背景技术
随着光网络不断发展，光网络逐步变得容量更大、更智能、应用更广泛。在军事，经济等领域中，光网络传输数据的安全性，越来越受到人们的关注，光网络传输数据安全性的丢失，可能会影响到大量的用户与服务。如今，光网络是数据业务传输的基础设施，因为光纤介质内部的光信号固有的隔离性，光纤传输网络被认为是一个非常安全的网络。然而，随着越来越多对于光纤的攻击事件的发生，光网络遭受了越来越多的窃听与拦截。
数据加密是增强通信安全性的一种有效方法，因为它可以防止窃听者访问数据。基于量子不可克隆定理以及海森堡不确定性定理的量子密钥分发技术，可以通过随机产生的共享的安全量子密钥对两个端点之间交换的消息进行加密，从而极大提高数据业务传输的安全性。量子密钥分发产生一个共享的随机量子密钥，只有用户双方知道加密和解密的数据信息，并且单光子量子态编码关键信息，通过量子信道，可以检测出潜在的窃听者。
在目前关于量子密钥分发加密数据的光网络中，有的方案提出增加一层量子密钥分发层的光网络结构，用于量子密钥的分配，也有提出一些量子密钥分配的方案来确保业务数据传输的安全性。然而，大部分的研究主要聚焦于传统数据业务的传输，量子信道中量子密钥的产生、传输以及数据的加密，而忽略了光网络中极其重要的量子密钥保护。在量子密钥分发确保的光网络中，即使是一个简单的链路失效，也会对服务的传输和量子密钥的处理造成 巨大的中断。因此，用户的数据传输将会产生安全隐患。
发明内容
为此，本发明所要解决的技术问题在于克服现有技术中在数据传输过程中存在故障风险高的问题，从而提供一种降低数据在传输过程中存在的故障风险，保证业务请求在传输过程的服务质量的基于业务安全等级的量子密钥分发保护方法及系统。
为解决上述技术问题，本发明的一种基于业务安全等级的量子密钥分发保护方法，包括：设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；建立业务请求，并生成业务请求安全等级；根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；设定量子密钥最大保护阈值，根据业务请求的安全需求程度与量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；完成所述工作路径和保护路径相应波长的分配及量子密钥的初始化与更新，完成业务请求的建立。
在本发明的一个实施例中，设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化的方法为：在光网络中配置网络拓扑结构，光网络中链路状态、网络光交换节点数、光纤链路数、链路中波长个数、波长中时间隙个数。
在本发明的一个实施例中，建立业务请求时，设置每个业务需要分配的传统工作、量子、公共交互信道波长数，每个业务分配量子密钥及量子密钥更新需要的时间隙个数。
在本发明的一个实施例中，生成业务请求安全等级的方法为：对业务请求进行预先分类，确定量子密钥更新时间，根据加密的量子密钥更新时间来划分优先恢复量子密钥服务顺序。
在本发明的一个实施例中，选择最优的路径作为工作路径时，使用K条最短路径算法建立传统工作、量子信号、公共交互信道路径，若路径建立成功，则执行下一步，否则，认为业务请求发生阻塞。
在本发明的一个实施例中，对所述工作路径进行资源分配的方法为：在所选的工作路径中根据首次命中算法，为工作路径、量子信道、公共交互信道分配波长；根据首次命中算法，在量子信道、公共交互信道的特定波长中分配时间隙，分别用于量子密钥的初始化与时钟同步；在量子信道的特定波长中，根据生成的时间隙需求个数进行量子密钥更新的时间隙分配。
在本发明的一个实施例中，选择最优的路径作为保护路径时，确定每个保护路径的量子密钥共享度阈值。按照业务请求的安全需求程度，使用最短路径算法建立与量子工作信道不相交的保护路径。
在本发明的一个实施例中，对所述保护路径进行资源分配的方法为：根据首次命中算法，在链路中满足波长连续性的原则下，为量子密钥保护路径分配波长；根据首次命中算法，依据每个业务请求的量子密钥需求及量子密钥更新时间，分配相应的时间隙进行量子密钥的初始化及更新。
在本发明的一个实施例中，完成所述工作路径和保护路径相应波长的分配及量子密钥资源初始化及更新时，在为连接请求选择工作路径、量子信道、公共交互信道及保护路径，并在量子信道分配量子密钥资源后，更新链路状态。
本发明还提供了一种基于业务安全等级的量子密钥分发保护系统，包括：网络初始化模块，用于设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；业务请求模块，用于建立业务请求，并生成业务请求安全等级；工作路径模块，用于根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；保护路径模块，用于根据业务请求的安全需求程度与量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；资源分配模块，用于对所述工作路径和保护路径分配相应的波长及量子密钥资源，完成业务请求的建立。
本发明的上述技术方案相比现有技术具有以下优点：
本发明所述的基于业务安全等级的量子密钥分发保护方法及系统，对于 每一个业务，为了减少量子密钥在传输过程中发生故障造成的影响，每个业务的量子密钥需要提供一条工作路径和一条保护路径。当网络发生故障时，能够把工作路径上的量子密钥倒换到保护路径上，解决量子密钥的生存性，确保数据的更加安全与传输，提高业务的安全稳定性。对于每一个连接业务请求，通过业务安全程度划分，量子密钥共享度的设置，确定业务量子密钥恢复顺序，解决光网络中量子密钥的生存性，以及量子密钥利用率问题。
附图说明
为了使本发明的内容更容易被清楚的理解，下面根据本发明的具体实施例并结合附图，对本发明作进一步详细的说明，其中
图1是本发明基于业务安全等级的量子密钥分发保护方法流程图；
图2是本发明光网络的拓扑结构图；
图3a是本发明工作路径、量子、公共交互信道波长分配示意图；
图3b是本发明保护工作路径、量子、公共交互信道波长分配示意图；
图3c是本发明量子密钥的初始化及更新示意图；
图3d是本发明量子密钥共享度为1时量子保护信道时间隙分配示意图；
图3e是本发明量子密钥共享度为2时量子保护信道时间隙分配示意图；
图4是本发明基于业务安全等级的量子密钥分发保护系统的示意图。
具体实施方式
实施例一
如图1所示，本实施例提供一种基于业务安全等级的量子密钥分发保护方法，步骤S1：设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；步骤S2：建立业务请求，并生成业务请求安全等级；步骤S3：根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；步骤S4：设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥 共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；步骤S5：完成所述工作路径和保护路径相应波长的分配及量子密钥初始化及更新，完成业务请求的建立。
本实施例所述基于业务安全等级的量子密钥分发保护方法，所述步骤S1中，设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化，有利于业务的运行；所述步骤S2中，建立业务请求，并生成业务请求安全等级，有利于实现受损业务的保护与恢复，保证业务请求在传输过程的服务质量；所述步骤S3中，根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配，有利于保证数据的安全传输，提高业务的安全稳定性；所述步骤S4中，设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配，保护技术具有更快的倒换速度，通过为每一个连接的量子密钥请求建立保护路径，有利于减少量子密钥在传输过程中发生故障造成的影响；所述步骤S5中，完成所述工作路径和保护路径相应波长的分配及量子密钥初始化与更新，完成业务请求的建立，由于在保护路径上为每一个连接请求预留量子密钥资源，当网络发生故障时，能够把工作路径上的量子密钥倒换到保护路径上，解决量子密钥的生存性，确保数据的更加安全与传输，提高业务的安全稳定性。
所述步骤S1中，设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化的方法为：在光网络中配置网络拓扑结构，光网络中链路状态、网络光交换节点数、光纤链路数、链路中波长个数、波长中时间隙的个数，有利于保证业务的稳定运行。
具体地，在光网络G k(N,L,Λ,T,S k)中N是节点的集合，L是有向链路的集合，Λ＝{λ 1,λ 2,λ 3,…}是波长的编号集，T＝{t 1,t 2,t 3,…}是波长中时间隙的编号集合，S k＝{s 1,s 2,s 3,…}是光网络中量子密钥共享度的设置集合，所述量子密钥共享度的定义为，每一个时间隙能够被多少个量子密钥共享的数量。设置光网络拓扑结构、链路状态、网络光交换节点数、光纤链路数、链路中波 长个数、以及时间隙个数。
如图2所示，由6个节点和8条链路组成的网络拓扑结构图。每条光纤链路是双向的，每条链路中的波长数为40条，每个波长中有100个时间隙。量子信道、公共交互信道各分配4个波长，业务请求传输的传统信道分配28个波长，在量子信道与公共交互信道之间保留4个波长作为保护带宽。
所述步骤S2中，建立业务请求时，设置每个业务需要分配的传统工作、量子、公共交互信道波长数，每个业务分配量子密钥及量子密钥更新需要的时间隙个数。
另外，根据源节点与目的节点均匀分布产生连接请求，配置连接请求数目、不同连接请求的源节点与目的节点、带宽需求等信息。
其中业务请求用R(s,d,n，t)表示，它表示从源节点s到目的节点d的业务请求，业务请求用以加密的量子密钥个数是n个时间隙，其中，t为量子密钥的更新时间。设置每个业务需要分配的传统工作、量子、公共交互信道波长数，每个业务分配量子密钥及量子密钥更新需要的时间隙个数。
具体地，建立业务请求R 1(1,3,2,20)、R 2(1,3,2,30)，它们都是从源节点1到目的节点3，业务请求加密的量子密钥需求都是2个时间隙，第一个业务请求的量子密钥更新时间为20个时间隙，第二个业务请求的量子密钥更新时间为30个时间隙。
生成业务请求安全等级的方法为：对业务请求进行预先分类，确定量子密钥更新时间，根据加密的量子密钥更新时间来划分优先恢复量子密钥服务顺序，有利于保证使用量子密钥加密数据的生存性服务质量。
本发明根据每一个连接请求的安全服务需求，进行量子密钥优先级划分，匹配相应的量子密钥更新时间，根据不同业务的安全服务需求程度，为每一个连接请求提供量子信号信道保护方法。当多个量子密钥资源同时发生故障时，网络能够快速确定恢复数据的优先级，减少业务请求在传输过程中存在的故障风险，保证业务请求在传输过程的服务质量。
对业务请求进行预先分类的方法为：划分所述业务请求安全等级，根据量子密钥更新时间，对业务请求进行预先分类。
业务请求生成相应的量子密钥更新时长，量子密钥更新时间越短，业务请求安全性需求越高。根据每个业务请求的安全等级，优先恢复等级高的量子密钥。当多个业务请求的量子密钥资源同时发生故障时，同一个保护时间隙资源优先恢复安全性需求高的业务请求，从而有利于实现受损业务的保护与恢复。
具体地，依据业务请求的密钥更新时间进行安全等级的划分与排序，其中两个业务请求R 1(1,3,2,20)、R 2(1,3,2,30)，由于R 1的密钥更新时间更短，业务请求的安全需求更高，当发生故障时，R 1恢复的优先级更高。
所述步骤S3中，计算从源节点到目的节点的多条候选路径时，使用K条最短路径算法建立传统工作、量子信号、公共交互信道路径，若路径建立成功，则执行下一步，否则，认为业务请求发生阻塞。
具体地，对于第一个业务请求R 1(1,3,2,20)，从源节点1到目的节点3用K条最短路径算法计算经典数据工作路径、量子信道、公共交互信道。其中业务请求R 1(1,3,2,20)所选择的工作路径、量子信道、公共交互信道为路径I(1-2-3)。
对所述工作路径进行资源分配的方法为：在所选的工作路径中根据首次命中算法，为工作路径、量子信道、公共交互信道分配波长；根据首次命中算法，在量子信道、公共交互信道的特定波长中分配时间隙，分别用于量子密钥的初始化与时钟同步；在量子信道的特定波长中，根据生成的时间隙需求个数进行量子密钥更新的时间隙分配。
在分配波长和时间隙的过程中，若分配成功，则进入下一步，否则，认为业务请求发生阻塞。
由于数据的加密需要灵活多变，因此不断更改两个用户之间用以加密的量子密钥信息，使得窃听者难以破解。根据业务请求生成的量子密钥更新时间，在量子信道特定中的波长中，分配相应的时间隙用于量子密钥资源的更 新。
具体地，在工作路径I(1-2-3)中，根据业务请求服务的波长需求与量子密钥需求，需要在路径I(1-2-3)找到28个连续的波长用来业务请求经典数据的正常传输，找到4个连续的波长用来建立量子信道，4个连续的波长用来建立公共交互信道用来进行量子密钥的时钟同步；并且在量子信道分配的波长上找到两个连续的时间隙用来量子密钥的初始化。在更新时间20个时间隙之后，在量子信道的特定波长上，寻找两个空闲连续的时间隙用于量子密钥的更新。
所述步骤S4中，建立与量子信道不相交的保护路径时，当光网络中量子密钥共享度的设置为1时，量子信道保护路径为专用保护路径；若光网络中量子密钥共享度的设置大于1时，多个业务请求共享同一保护路径。
按照业务请求的安全需求程度，使用最短路径算法建立与量子工作信道不相交的保护路径。当S k＝1时，此时，量子信道保护路径为专用保护路径，当S k>1时，多个业务请求可以共享同一保护路径。若路径建立成功，则执行下一步，否则业务请求发生阻塞。当量子密钥服务发生故障时，能够根据业务请求的安全需求优先等级和量子密钥共享度，自适应地选择保护路径，以进行受损密钥自动恢复功能，形成快速保护倒换，以恢复受损量子信道。
另外，在量子信道、公共交互信道的特定波长中分配时间隙时，根据不同业务请求的安全需求，进行不同量子密钥共享度的阈值设置。其中所述量子密钥共享度的阈值反映了量子密钥资源的最大共享能力，从而能够根据用户安全服务质量要求，恰当调节量子密钥共享度的阈值，提高量子密钥资源的效率。
本发明针对量子密钥分发技术的网络生存性问题，引入量子密钥共享度的概念，还需要确定每个保护路径的量子密钥共享度阈值，通过设定每一个时间隙所能容纳的量子密钥最大保护阈值，减少因为多个量子密钥分发同时发生故障所引起的恶性竞争，并缓解安全性能提升带来的高阻塞率。
对所述保护路径进行资源分配的方法为：根据首次命中算法，在链路中 满足波长连续性的原则下，为量子密钥保护路径分配波长；根据首次命中算法，依据每个业务请求的量子密钥需求及量子密钥更新时间，分配相应的时间隙进行量子密钥的初始化及更新。
其中在工作路径、量子信道、公共交互信道中，需要查找满足频段的波长资源，减少物理层损伤的影响，保证所分配的波长资源能够满足连续性条件。为了确保业务请求在光通道中的传输质量，需要在量子信道与公共交互信道之间需要分配相应的保护带宽，以确保量子信号传输和安全密钥生成率的最佳状态。
在量子信道、保护信道中，根据量子密钥的更新时间对业务请求的安全程度进行排序。通过首次命中法查找波长中空闲的时间隙资源，进行量子密钥的初始化及更新。
在连接请求数据加密并传输完成后，首先释放量子信道及相应的保护信道中每个时间隙上的量子密钥资源；释放工作路径、量子信道、公共交互信道分配的波长资源；最后，把这个连接请求所建立的工作路径、量子信道、公共交互信道拆除。
具体地，对于第一个业务请求R 1(1,3,2,20)，从源节点1到目的节点3用最短路径算法查找一条与量子信道不相交的保护路径。其中业务请求R 1(1,3,2,20)所选择的保护路径II(1-4-5-3)。
根据业务请求R 1(1,3,2,20)的服务等级，设置量子密钥共享度的阈值大小，这里分两种不同的阈值情况，即S 1＝1、S 2＝2。首先取S 1＝1，此时共享保护转化成专用保护，根据首次命中法和波长连续性查找可用保护波长{λ 1，λ 2，λ 3，λ 4}作为分配量子密钥资源的特定波长。在保护路径II(1-4-5-3)，根据业务需求的量子密钥个数，查找可用保护时间隙资源，即预留时间隙编号为{t 1，t 2}作为业务请求R 1(1,3,2,20)的保护量子密钥初始化及更新资源。
所述步骤S5中，在为连接请求选择工作路径、量子信道、公共交互信道及保护路径，并在量子信道分配量子密钥资源后，更新链路状态，业务请 求建立成功，结束任务。
具体地，建立完成工作路径和保护路径，以及分配好相应的波长及量子密钥资源，业务请求R 1(1,3,2,20)建立成功。
所述步骤S5完成后，针对下一个业务请求可以重复上述步骤S2-S5。具体地，如业务请求R 2(1,3,2,30)可以重复上述步骤S2-S5，在工作路径、量子信道、公共交互信道I(1-2-3)，量子保护信道II(1-4-5-3)上分别预留相应波长和时间隙进行量子密钥的初始化及更新。所选工作路径、量子、公共交互信道波长分配如图3a所示，以及量子密钥的初始化及更新如图3c所示。所选量子保护信道波长及时间隙资源分配如图3b和图3d所示。量子信道与公共交互信道在分配波长时，中间需要分配4个波长作为保护频带，来保证量子密钥的产生速率达到最佳。同样，当量子密钥共享度的阈值设置为S 2＝2，这两个业务请求，R 2(1,3,2,20)、R 2(1,3,2,30)共享相同的时间隙资源，量子密钥分配如图3e所示。
实施例二
如图4所示，基于同一发明构思，本实施例提供了一种基于业务安全等级的量子密钥分发保护系统，其解决问题的原理与所述基于业务安全等级的量子密钥分发保护方法类似，重复之处不再赘述。
本实施例提供一种基于业务安全等级的量子密钥分发保护系统，包括：
网络初始化模块10，用于设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；
业务请求模块20，用于建立业务请求，并生成业务请求安全等级；
工作路径模块30，用于根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；
保护路径模块40，用于设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥共享度，建立与量子信道不相交的保护路径，对所 述保护路径进行资源分配；
资源分配模块50，用于完成所述工作路径和保护路径相应波长的分配及量子密钥初始化及更新，完成业务请求的建立。
另外，本实施例中，还可以包括阈值设置模块，用于针对业务请求的安全需求，设置量子密钥共享度的阈值。根据用户安全要求，恰当调节量子密钥共享度的阈值。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的 步骤。
显然，上述实施例仅仅是为清楚地说明所作的举例，并非对实施方式的限定。对于所属领域的普通技术人员来说，在上述说明的基础上还可以做出其它不同形式变化或变动。这里无需也无法对所有的实施方式予以穷举。而由此所引伸出的显而易见的变化或变动仍处于本发明创造的保护范围之中。

Claims (10)

  1. 一种基于业务安全等级的量子密钥分发保护方法，其特征在于，包括如下步骤：
    步骤S1：设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；
    步骤S2：建立业务请求，并生成业务请求安全等级；
    步骤S3：根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；
    步骤S4：设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；
    步骤S5：完成所述工作路径和保护路径相应波长的分配及量子密钥初始化及更新，完成业务请求的建立。
  2. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化的方法为：在光网络中配置网络拓扑结构，光网络中链路状态、网络光交换节点数、光纤链路数、链路中波长个数、波长中时间隙个数。
  3. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：建立业务请求时，设置每个业务需要分配的传统工作、量子、公共交互信道波长数，每个业务分配量子密钥及量子密钥更新需要的时间隙个数。
  4. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：生成业务请求安全等级的方法为：对业务请求进行预先分类，确 定量子密钥更新时间，根据加密的量子密钥更新时间来划分优先恢复量子密钥服务顺序。
  5. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：选择最优的路径作为工作路径时，使用K条最短路径算法建立传统工作、量子信号、公共交互信道路径，若路径建立成功，则执行下一步，否则，认为业务请求发生阻塞。
  6. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：对所述工作路径进行资源分配的方法为：在所选的工作路径中根据首次命中算法，为工作路径、量子信道、公共交互信道分配波长；根据首次命中算法，在量子信道、公共交互信道的特定波长中分配时间隙，分别用于量子密钥的初始化与时钟同步；在量子信道的特定波长中，根据生成的时间隙需求个数进行量子密钥更新的时间隙分配。
  7. 根据权利要求6所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：选择最优的路径作为保护路径时，确定每个保护路径的量子密钥共享度阈值。按照业务请求的安全需求程度，使用最短路径算法建立与量子工作信道不相交的保护路径。
  8. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：对所述保护路径进行资源分配的方法为：根据首次命中算法，在链路中满足波长连续性的原则下，为量子密钥保护路径分配波长；根据首次命中算法，依据每个业务请求的量子密钥需求及量子密钥更新时间，分配相应的时间隙进行量子密钥的初始化及更新。
  9. 根据权利要求1所述的基于业务安全等级的量子密钥分发保护方法，其特征在于：完成所述工作路径和保护路径相应波长的分配及量子密钥初始化及更新时，在为连接请求选择工作路径、量子信道、公共交互信道及保护路径，并在量子信道分配量子密钥资源后，更新链路状态。
  10. 一种基于业务安全等级的量子密钥分发保护系统，其特征在于，包 括：
    网络初始化模块，用于设置网络拓扑结构，对所述网络拓扑结构中的网络参数进行初始化；
    业务请求模块，用于建立业务请求，并生成业务请求安全等级；
    工作路径模块，用于根据连接请求的源节点和目的节点，计算从源节点到目的节点的多条候选路径，选择最优的路径作为工作路径，对所述工作路径进行资源分配；
    保护路径模块，用于设定量子密钥最大保护阈值，根据业务请求的安全需求程度及量子密钥共享度，建立与量子信道不相交的保护路径，对所述保护路径进行资源分配；
    资源分配模块，完成所述工作路径和保护路径相应波长的分配及量子密钥初始化及更新，更新链路状态，完成业务请求的建立。
PCT/CN2020/105536 2020-07-23 2020-07-29 基于业务安全等级的量子密钥分发保护方法及系统 WO2022016593A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010717513.X 2020-07-23
CN202010717513.XA CN111711517B (zh) 2020-07-23 2020-07-23 基于业务安全等级的量子密钥分发保护方法及系统

Publications (1)

Publication Number Publication Date
WO2022016593A1 true WO2022016593A1 (zh) 2022-01-27

Family

ID=72547429

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/105536 WO2022016593A1 (zh) 2020-07-23 2020-07-29 基于业务安全等级的量子密钥分发保护方法及系统

Country Status (2)

Country Link
CN (1) CN111711517B (zh)
WO (1) WO2022016593A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114499864A (zh) * 2022-04-18 2022-05-13 浙江九州量子信息技术股份有限公司 一种面向云计算平台的量子密钥调度方法
CN116112166A (zh) * 2023-04-13 2023-05-12 广东广宇科技发展有限公司 一种用于复杂网络拓扑结构的自更新量子密钥处理方法
CN116614232A (zh) * 2023-07-20 2023-08-18 广东广宇科技发展有限公司 一种用于分布式通信的非线性密钥更新方法
CN117119449A (zh) * 2023-10-20 2023-11-24 长江量子(武汉)科技有限公司 车云安全通信方法及系统

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112737776B (zh) * 2020-12-29 2022-09-13 中天通信技术有限公司 面向数据中心的负载均衡的量子密钥资源分配方法
CN112769550B (zh) * 2020-12-29 2022-10-21 中天通信技术有限公司 面向数据中心的负载均衡的量子密钥资源分配系统
CN112910642B (zh) * 2021-03-01 2022-05-31 北京邮电大学 基于量子密钥的物联网资源分配方法和系统
CN113179154B (zh) * 2021-03-25 2022-07-01 北京邮电大学 量子密钥分发物联网中资源联合分配方法及相关设备
CN113757909B (zh) * 2021-11-08 2022-02-08 国网浙江省电力有限公司绍兴供电公司 基于量子加密技术的空调集群控制方法
CN114362929A (zh) * 2021-11-23 2022-04-15 北京邮电大学 基于量子密钥分发网络的保护方法、装置和电子设备
CN114302266B (zh) * 2021-12-13 2022-10-18 苏州大学 一种量子密钥分发光网络中资源分配方法及系统
CN114499834B (zh) * 2021-12-20 2024-05-14 北京邮电大学 物联网量子密钥分发方法、系统、电子设备及存储介质
CN115021904A (zh) * 2022-05-23 2022-09-06 苏州大学 基于概率共享风险的量子密钥分发保护方法与系统
CN114928510B (zh) * 2022-06-17 2023-10-31 广东电网有限责任公司 一种电力通信链路建立方法、资源配置方法及系统
CN115567210A (zh) * 2022-09-29 2023-01-03 中电信量子科技有限公司 采用量子密钥分发实现零信任访问的方法及系统
CN117353914A (zh) * 2023-10-25 2024-01-05 苏州大学 动态业务感知的保护方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103647598A (zh) * 2013-11-05 2014-03-19 国家电网公司 一种基于智能光网络的通信多等级保护方法
EP3291480A1 (en) * 2016-09-05 2018-03-07 multitiv GmbH Secure data transmission
CN109005030A (zh) * 2018-07-13 2018-12-14 北京邮电大学 一种量子网络中密钥业务的保护方法及系统
CN109120333A (zh) * 2018-07-13 2019-01-01 北京邮电大学 一种量子密钥分发光网络中的业务保护方法及系统

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070133798A1 (en) * 2005-12-14 2007-06-14 Elliott Brig B Quantum cryptography on a multi-drop optical network
GB201020424D0 (en) * 2010-12-02 2011-01-19 Qinetiq Ltd Quantum key distribution
CN105141354B (zh) * 2015-09-07 2018-08-21 苏州大学 一种基于业务等级划分的频谱共享度保护方法和装置
CN105591939B (zh) * 2016-01-20 2018-11-02 苏州大学 一种基于弹性光网络的保护路径确定方法及装置
CN106878006B (zh) * 2016-12-31 2019-11-05 北京邮电大学 基于光时分复用的量子密钥通道传输方法与系统
CN108809631B (zh) * 2017-04-28 2021-06-22 广东国盾量子科技有限公司 一种量子密钥服务管理系统及方法
CN110149204B (zh) * 2019-05-09 2021-01-05 北京邮电大学 Qkd网络的密钥资源分配方法及系统
CN110212978B (zh) * 2019-06-12 2020-11-06 苏州大学 一种终端延迟选择的量子通信方法及系统
CN110875775B (zh) * 2019-11-22 2020-09-22 苏州大学 Qam相干光通信系统中基于矩的精度增强的osnr监测方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103647598A (zh) * 2013-11-05 2014-03-19 国家电网公司 一种基于智能光网络的通信多等级保护方法
EP3291480A1 (en) * 2016-09-05 2018-03-07 multitiv GmbH Secure data transmission
CN109005030A (zh) * 2018-07-13 2018-12-14 北京邮电大学 一种量子网络中密钥业务的保护方法及系统
CN109120333A (zh) * 2018-07-13 2019-01-01 北京邮电大学 一种量子密钥分发光网络中的业务保护方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
BRITO J. P.; LOPEZ D. R.; AGUADO A.; ABELLAN C.; LOPEZ V.; PASTOR-PERALES A.; LA IGLESIA F. DE; MARTIN V.: "Quantum Services Architecture in Softwarized Infrastructures", 2019 21ST INTERNATIONAL CONFERENCE ON TRANSPARENT OPTICAL NETWORKS (ICTON), 9 July 2019 (2019-07-09), pages 1 - 4, XP033618129, DOI: 10.1109/ICTON.2019.8840400 *

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114499864A (zh) * 2022-04-18 2022-05-13 浙江九州量子信息技术股份有限公司 一种面向云计算平台的量子密钥调度方法
CN114499864B (zh) * 2022-04-18 2022-07-12 浙江九州量子信息技术股份有限公司 一种面向云计算平台的量子密钥调度方法
CN116112166A (zh) * 2023-04-13 2023-05-12 广东广宇科技发展有限公司 一种用于复杂网络拓扑结构的自更新量子密钥处理方法
CN116112166B (zh) * 2023-04-13 2023-08-01 广东广宇科技发展有限公司 一种用于复杂网络拓扑结构的自更新量子密钥处理方法
CN116614232A (zh) * 2023-07-20 2023-08-18 广东广宇科技发展有限公司 一种用于分布式通信的非线性密钥更新方法
CN116614232B (zh) * 2023-07-20 2023-10-27 广东广宇科技发展有限公司 一种用于分布式通信的非线性密钥更新方法
CN117119449A (zh) * 2023-10-20 2023-11-24 长江量子(武汉)科技有限公司 车云安全通信方法及系统
CN117119449B (zh) * 2023-10-20 2024-01-19 长江量子(武汉)科技有限公司 车云安全通信方法及系统

Also Published As

Publication number Publication date
CN111711517A (zh) 2020-09-25
CN111711517B (zh) 2021-08-31

Similar Documents

Publication Publication Date Title
WO2022016593A1 (zh) 基于业务安全等级的量子密钥分发保护方法及系统
Zhao et al. Resource allocation in optical networks secured by quantum key distribution
Cao et al. KaaS: Key as a service over quantum key distribution integrated optical networks
CN112865964B (zh) 一种量子密钥分发方法、设备及存储介质
CN112671809B (zh) 数据传输方法、信源端及接收端
US7181011B2 (en) Key bank systems and methods for QKD
JP5734934B2 (ja) 通信ノード、鍵同期方法、鍵同期システム
Wang et al. Protection schemes for key service in optical networks secured by quantum key distribution (QKD)
CN112769550B (zh) 面向数据中心的负载均衡的量子密钥资源分配系统
Kandi et al. A versatile Key Management protocol for secure Group and Device-to-Device Communication in the Internet of Things
CN112737776B (zh) 面向数据中心的负载均衡的量子密钥资源分配方法
Shirko et al. A novel security survival model for quantum key distribution networks enabled by software-defined networking
CN114302266B (zh) 一种量子密钥分发光网络中资源分配方法及系统
WO2023226130A1 (zh) 基于概率共享风险的量子密钥分发保护方法与系统
Kandi et al. An efficient multi-group key management protocol for heterogeneous IoT devices
US20220294616A1 (en) System and Method for Optimizing the Routing of Quantum Key Distribution (QKD) Key Material in A Network
Chen et al. A quantum key distribution routing scheme for hybrid-trusted QKD network system
KR100509233B1 (ko) 멀티캐스트 그룹 키 관리 방법 및 장치
WO2024092992A1 (zh) Qkd光网络中时隙感知的共享路径保护方法及系统
Zhao et al. Software defined optical networks secured by quantum key distribution (QKD)
Xu et al. Quantum key distribution scheme with key recycling in integrated optical network
KR20080078511A (ko) 무선네트워크에서 키 재구성방법
Lu et al. Dynamic wavelength and key resource adjustment in WDM based QKD optical networks
CN114764601B (zh) 一种梯度数据融合方法、装置及存储介质
Cao et al. Secure virtual optical network embedding over optical networks integrated with quantum key distribution

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20945811

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20945811

Country of ref document: EP

Kind code of ref document: A1