WO2022142463A1 - 一种分布式量子密码网络组密钥分发方法及系统 - Google Patents

一种分布式量子密码网络组密钥分发方法及系统 Download PDF

Info

Publication number
WO2022142463A1
WO2022142463A1 PCT/CN2021/117787 CN2021117787W WO2022142463A1 WO 2022142463 A1 WO2022142463 A1 WO 2022142463A1 CN 2021117787 W CN2021117787 W CN 2021117787W WO 2022142463 A1 WO2022142463 A1 WO 2022142463A1
Authority
WO
WIPO (PCT)
Prior art keywords
group
node
routing
group key
nodes
Prior art date
Application number
PCT/CN2021/117787
Other languages
English (en)
French (fr)
Inventor
原磊
Original Assignee
科大国盾量子技术股份有限公司
山东量子科学技术研究院有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 科大国盾量子技术股份有限公司, 山东量子科学技术研究院有限公司 filed Critical 科大国盾量子技术股份有限公司
Publication of WO2022142463A1 publication Critical patent/WO2022142463A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/12—Shortest path evaluation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/26—Route discovery packet
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/44—Distributed routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/48—Routing tree calculation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present invention requires the priority of the Chinese patent application filed on December 28, 2020 with the application number 202011584314.2 and titled "A method and system for group key distribution in a distributed quantum cryptography network", the entire contents of which are Incorporated herein by reference.
  • the invention belongs to the technical field of encrypted communication of quantum cryptography networks, and in particular relates to a distributed quantum cryptography network group key distribution method and system.
  • the group key service mode has been paid more and more attention by researchers; the group key service mode is used to serve the communication between applications involving multiple parties in the quantum communication networking environment, such as video conferencing, network Games, video on demand, etc.
  • the group key in the current quantum cryptography network is obtained through the key relay between the nodes of the quantum cryptography network.
  • the group key is relayed between quantum cryptographic network nodes.
  • the longer the distance of the relay path the greater the generation cost of the relay key.
  • the current research literature is mostly realized through key agreement optimization. The speed and security of key distribution, but this optimization method does not consider the path cost of group key distribution, and does not use the best path for group key distribution, which increases the path cost of group key distribution, thereby increasing the The cost of group key encrypted communications. How to complete the distribution of all group keys with the shortest or shortest total path is a problem that has not been considered in the current group key application scheme.
  • the present invention proposes a distributed quantum cryptography network group key distribution method and system.
  • the present invention adopts distributed routing calculation, and sequentially determines the optimal key distribution path between each node to construct the shortest or A shorter total path, thus guaranteeing a minimum or less path cost of group key distribution based on the completion of all group key distribution.
  • the present invention adopts the following technical solutions:
  • a distributed quantum cryptography network group key distribution method executed from the quantum cryptography network node where group members participating in group communication are located, hereinafter referred to as the group node side, includes the following steps:
  • a routing spanning tree for group key distribution in the next routing period is formed layer by layer;
  • the routing spanning tree According to its position in the routing spanning tree, it generates a group key or receives the group key distributed by the upper-layer node, saves the group key, and sends the group key to the next-layer node.
  • the group node if there is no information that the group node newly joins or leaves the group communication, it is not necessary to update the routing graph of the quantum cryptographic network, and it is not necessary to recalculate and update the corresponding routing spanning tree.
  • the information on whether there is a group node newly joining or exiting the group communication is obtained, and the information includes the ID of the quantum cryptography network node where the group member who newly joins or exits the group communication is located.
  • the specific process of forming a route spanning tree for group key distribution in the next routing period layer by layer includes: determining each group node to other group nodes The group node whose total path sum is the smallest or less than the set value is determined as the root node, and the group node with the shortest or less than the preset value of the key relay path from each root node is regarded as the lower layer of the corresponding root node. The nodes are repeated continuously to form a routing spanning tree for the next routing period group key distribution layer by layer.
  • the center refers to the physical center point or the location center point located in the routing graph of the quantum cryptography network.
  • the specific process of using the group node with the shortest or less than preset value of the key relay path from each root node as the lower-level node of the corresponding root node includes: setting all group nodes other than the determined root node The nodes are used as the first set, and the nodes of the routing spanning tree are used as the second set;
  • the group node where the root node of the routing spanning tree is located first starts group key distribution, the root node selects a true random number as the group key, saves the group key, and simultaneously relays the group key to the routing A spanning tree corresponds to each lower node of the root node.
  • each node in the routing spanning tree receives the group key distributed by the upper node, saves the group key, and if the node still has a lower node on the routing spanning tree, relays the group key To each lower node of this node of the routing spanning tree.
  • a distributed quantum cryptography network group key distribution system comprising:
  • the group communication authentication server is configured to perform registration, login authentication, and exit management of the group members participating in the group communication, and send the quantum cryptography network node information of the group members newly joining or withdrawing from the group communication to each routing cycle.
  • group node
  • Group nodes participating in group communication, are configured to form a routing spanning tree for group key distribution in the next routing cycle layer by layer according to the updated routing graph, with the purpose of the total path of group key distribution being less than the set threshold; The location of the routing spanning tree, generating the group key or receiving the group key distributed by the upper-layer node, saving the group key, and delivering the group key to the next-layer node.
  • each group node if there is no group node newly joining or withdrawing from the communication, each group node does not need to form a routing spanning tree layer by layer for the next routing period group key distribution according to the updated routing graph.
  • a computer-readable storage medium stores a plurality of instructions, and the instructions are adapted to be loaded by a processor of a terminal device and execute the steps of a distributed quantum cryptography network group key distribution method.
  • a terminal device comprising a processor and a computer-readable storage medium, where the processor is used to implement various instructions; the computer-readable storage medium is used to store a plurality of instructions, the instructions are suitable for being loaded by the processor and executing the described one Steps of a distributed quantum cryptographic network group key distribution method.
  • the invention provides a global optimal path for group key distribution planning by generating a routing spanning tree for each group node through a distributed routing calculation method, which saves the path cost of group key distribution, thereby reducing the group key encryption communication cost.
  • the present invention selects the node at the central position among all group nodes as the root node for group key distribution, and uses the root node as the initial node for group key distribution, which helps to improve the efficiency of group key distribution; Limited, multi-line parallel distribution can be formed according to the situation, which improves the speed of group key distribution.
  • the calculation method of the routing spanning tree of the present invention is distributed, which reduces the dependence on the central node and increases the reliability of the scheme.
  • 1 is a system structure diagram of at least one embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a root node determination process according to at least one embodiment of the present invention.
  • the process of obtaining the group key by the quantum cryptographic network nodes participating in the group communication in the quantum cryptographic network through quantum key relay is called quantum cryptographic network group key distribution.
  • a distributed quantum cryptography network group key distribution method is executed from the quantum cryptography network node where group members participating in group communication are located, hereinafter referred to as the group node side.
  • This embodiment intends to construct the shortest or shorter total path by sequentially determining the best selection path between each node, so as to ensure that the least or less group keys are distributed on the basis of completing the distribution of all group keys. path cost.
  • a routing spanning tree for group key distribution in the next routing period is formed layer by layer;
  • the routing spanning tree According to its position in the routing spanning tree, it generates a group key or receives the group key distributed by the upper-layer node, saves the group key, and sends the group key to the next-layer node.
  • the specific process of forming the routing spanning tree of the next routing period group key distribution layer by layer includes: determining the sum of the total paths from each group node to other group nodes, determining The group node whose total path sum is the smallest or less than the set value is the root node, and the group node with the shortest or less than the preset value of the key relay path from each root node is regarded as the lower node of the corresponding root node, and it is repeated continuously, layer by layer.
  • a routing spanning tree for group key distribution in the next routing period is formed.
  • the specific process of using the group node with the shortest distance from each root node key relay path or less than the preset value as the lower node of the corresponding root node includes: taking all group nodes except the determined root node as the first set, and using The nodes of the routing spanning tree are used as the second set;
  • the group node with the smallest sum of the total paths is determined as the root node, and the group node with the shortest distance from the key relay path of each root node is taken as the representative of the lower-level node of the corresponding root node, and the detailed description includes the following steps:
  • V the set of all group nodes except node S
  • T the set of routing spanning trees
  • step 1 there are multiple groups of nodes A, B, C, D, E, F, and G, and the path lengths of the key relays between each group of nodes and other nodes are respectively :
  • group node A ab+ac+ad+ae+af+ag;
  • group node B ba+bc+bd+be+bf+bg;
  • group node C ca+cb+cd+ce+cf+cg;
  • group node D da+db+dc+de+df+dg;
  • Group node G ga+gb+gc+gd+ge+gf;
  • the group node E has the smallest total path length, and the group node E is determined as the root node.
  • the group node whose total path sum is less than the set value can also be determined as the root node, so that there can be multiple root nodes, forming multi-line parallel distribution, which helps to improve the speed of group key distribution.
  • a plurality of nodes corresponding to smaller path lengths may be selected as the lower node or child node of a certain node.
  • the group key distribution starts first from the group node where the root node of the routing spanning tree is located.
  • the root node selects a true random number as the group key, saves the group key, and at the same time relays the group key to each lower node of the root node corresponding to the routing spanning tree.
  • Each node in the routing spanning tree receives the group key distributed by the upper-level node, and saves the group key. If there is a lower-level node in the routing spanning tree, the group key is relayed to the routing spanning tree. each lower node.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • a system for group key distribution in a distributed quantum cryptography network includes a group communication authentication server and group nodes participating in group communication.
  • the group communication authentication server is responsible for the registration, login authentication, and exit management of the group members participating in the group communication, and sending the quantum cryptography network node ID of the group members who join or leave the group communication to each group node in each routing cycle.
  • the group node calculates the routing spanning tree for group key distribution in the next routing period according to the routing graph of the quantum cryptographic network. If the group nodes participating in group communication in a routing cycle do not change, the group nodes do not need to recalculate the routing spanning tree.
  • the group communication authentication server sends the quantum cryptography network node ID of the group members participating in the group communication to each group node, and each routing cycle, the group communication authentication server will join or quit the group communication group members.
  • the node ID of the quantum cryptography network where it is located is sent to each group node, and each group node calculates the routing spanning tree for group key distribution in the next routing period according to the routing graph of the quantum cryptography network.
  • the group key distribution process for group nodes is as follows:
  • Each group node calculates the routing spanning tree of all group nodes in the group communication according to the routing graph of the quantum cryptography network.
  • the group node where the root node of the routing spanning tree is located first starts the group key distribution, the root node selects a true random number as the group key, saves the group key, and at the same time relays the group key to each of the root nodes of the routing spanning tree.
  • a child node Each node in the routing spanning tree receives the group key distributed by the upper node, and saves the group key. If the node still has child nodes in the routing spanning tree, it relays the group key to the current node of the routing spanning tree. each child node.
  • the method for each group node to determine the routing spanning tree for group key distribution in the next routing period according to the routing graph of the quantum cryptographic network is:
  • V the set of all group nodes except node S
  • T the set of routing spanning trees
  • each group node does not need to recalculate the routing spanning tree for group key distribution.
  • embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种分布式量子密码网络组密钥分发方法及系统，获取当前路由周期的量子密码网络的路由图；获取是否存在组节点新加入或退出组通信的信息，如果存在，按照信息内容更新量子密码网络的路由图；按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；根据自己在路由生成树的位置，生成组密钥或接收上层节点分发的组密钥，保存组密钥，并下发组密钥至下一层节点。本发明各个节点分布式布局，通过构建最短或较短的总路径，从而在完成全部组密钥的分发的基础上，保证最少或较少的组密钥分发的路径成本。

Description

一种分布式量子密码网络组密钥分发方法及系统
本发明要求于2020年12月28日提交中国专利局、申请号为202011584314.2、发明名称为“一种分布式量子密码网络组密钥分发方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本发明中。
技术领域
本发明属于量子密码网络的加密通信技术领域，具体涉及一种分布式量子密码网络组密钥分发方法及系统。
背景技术
本部分的陈述仅仅是提供了与本发明相关的背景技术信息，不必然构成在先技术。
随着量子密码学发展迅速，量子密钥以其独有的安全特性，得到了广泛的重视，正逐步走向商用。组密钥服务模式作为量子通信服务模式之一，越来越受到研究者的重视；组密钥服务模式用于服务量子通信组网环境下多方参与的应用之间的通信，如视频会议、网络游戏、视频点播等。
当前量子密码网络中的组密钥是通过量子密码网络节点之间的密钥中继得到的。组密钥在量子密码网络节点之间中继，中继路径的距离越长，其中继密钥的生成成本越大，据发明人了解，目前的研究 文献，多是通过密钥协商优化来实现密钥分发的快速性和安全性，但这种优化方式没有考虑组密钥分发的路径成本问题，没有采用最佳路径进行组密钥分发，增加了组密钥分发的路径成本，从而增加了组密钥加密通信的成本。如何以最短或较短的总路径完成全部组密钥的分发是当前组密钥应用方案所没有考虑过的问题。
发明内容
本发明为了解决上述问题，提出了一种分布式量子密码网络组密钥分发方法及系统，本发明采用分布式路由计算，通过依次确定各个节点之间的最佳密钥分发路径，构建最短或较短的总路径，从而在完成全部组密钥的分发的基础上，保证最少或较少的组密钥分发的路径成本。
根据一些实施例，本发明采用如下技术方案：
一种分布式量子密码网络组密钥分发方法，从参与组通信的组成员所在的量子密码网络节点，以下简称为组节点侧执行，包括以下步骤：
获取当前路由周期的量子密码网络的路由图；
获取是否存在组节点新加入或退出组通信的信息，如果存在，按照信息内容更新量子密码网络的路由图；
按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；
根据自己在路由生成树的位置，生成组密钥或接收上层节点分发 的组密钥，保存组密钥，并下发组密钥至下一层节点。
作为可选择的实施方式，若不存在组节点新加入或退出组通信的信息，不需要更新量子密码网络的路由图，不需要重新计算和更新相应的路由生成树。
作为可选择的实施方式，获取是否存在组节点新加入或退出组通信的信息中，该信息包括新加入或退出组通信的组成员所在的量子密码网络节点ID。
作为可选择的实施方式，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树的具体过程包括：确定每一个组节点到其他组节点的总路径之和，确定总路径之和最小或小于设定值的组节点为根节点，将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点，不断重复，逐层形成下个路由周期组密钥分发的路由生成树。
作为可选择的实施方式，选择处于量子密码网络的路由图中位于中心位置处的若干组节点为根节点。
所述中心是指位于量子密码网络的路由图中物理中心点或位置中心点。
作为可选择的实施方式，将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点的具体过程包括：将所有除已确定的根节点以外的组节点作为第一集合，将路由生成树的节点作为第二集合；
查找第一集合中距离第二集合中各个组节点最小或小于预设值的若干节点，作为对应组节点的下层节点或子节点，将这些下层节点与其对应的上层节点的连接边加入第三集合，将下层节点加入第二集合，同时从第一集合中删除上述下层节点；
不断重复，直到第一集合为空为止。
作为可选择的实施方式，路由生成树的根节点所在的组节点首先开始组密钥分发，根节点选择真随机数作为组密钥，保存组密钥，同时将组密钥分别中继到路由生成树对应根节点的每一个下层节点。
作为可选择的实施方式，每一个路由生成树中的节点收到上层节点分发的组密钥，保存组密钥，如果本节点在路由生成树上还存在下层节点，则将组密钥中继到路由生成树本节点的每一个下层节点。
一种分布式量子密码网络组密钥分发系统，包括：
组通信认证服务器，被配置为进行参与组通信的组成员的注册、登陆认证、退出管理以及在每个路由周期将新加入或退出组通信的组成员所在的量子密码网络节点信息发送给每个组节点；
组节点，参与组通信，被配置为按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；根据自己在路由生成树的位置，生成组密钥或接收上层节点分发的组密钥，保存组密钥，并下发组密钥至下一层节点。
作为可选择的实施方式，若不存在组节点新加入或退出通信，各个组节点不用按照更新后的路由图，逐层形成下个路由周期组密钥分 发的路由生成树。
一种计算机可读存储介质，其中存储有多条指令，所述指令适于由终端设备的处理器加载并执行所述的一种分布式量子密码网络组密钥分发方法的步骤。
一种终端设备，包括处理器和计算机可读存储介质，处理器用于实现各指令；计算机可读存储介质用于存储多条指令，所述指令适于由处理器加载并执行所述的一种分布式量子密码网络组密钥分发方法的步骤。
与现有技术相比，本发明的有益效果为：
本发明通过分布式路由计算方式，通过每个组节点生成路由生成树为组密钥分发规划提供全局最优路径，节约了组密钥分发的路径成本，从而降低了组密钥加密通信成本。
本发明选择所有组节点中位于中心位置的节点作为组密钥分发的根节点，以根节点作为组密钥分发的初始节点，这有助于提高组密钥分发效率；且以最小或一定阈值限定，可以根据情况形成多线路并行分发，提高了组密钥分发的速度。
本发明的路由生成树的计算方式为分布式，降低了对中心节点的依赖性，增加了方案的可靠性。
为使本发明的上述目的、特征和优点能更明显易懂，下文特举较佳实施例，并配合所附附图，作详细说明如下。
附图说明
构成本发明的一部分的说明书附图用来提供对本发明的进一步理解，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。
图1为本发明中至少一个实施例的系统结构图；
图2为本发明中至少一个实施例的根节点确定过程示意图。
具体实施方式：
下面结合附图与实施例对本发明作进一步说明。
应该指出，以下详细说明都是例示性的，旨在对本发明提供进一步的说明。除非另有指明，本文使用的所有技术和科学术语具有与本发明所属技术领域的普通技术人员通常理解的相同含义。
需要注意的是，这里所使用的术语仅是为了描述具体实施方式，而非意图限制根据本发明的示例性实施方式。如在这里所使用的，除非上下文另外明确指出，否则单数形式也意图包括复数形式，此外，还应当理解的是，当在本说明书中使用术语“包含”和/或“包括”时，其指明存在特征、步骤、操作、器件、组件和/或它们的组合。
在实施例部分，将量子密码网络中参与组通信的量子密码网络节点通过量子密钥中继获得组密钥的过程，称之为量子密码网络组密钥分发。
实施例一：
一种分布式量子密码网络组密钥分发方法，从参与组通信的组成员所在的量子密码网络节点，以下简称为组节点侧执行。
本实施例拟通过依次确定各个节点之间的最佳选择路径，构建最短或较短的总路径，从而在完成全部组密钥的分发的基础上，保证最少或较少的组密钥分发的路径成本。
包括以下步骤：
获取当前路由周期的量子密码网络的路由图；
获取是否存在组节点新加入或退出组通信的信息，如果存在，按照信息内容更新量子密码网络的路由图；
按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；
根据自己在路由生成树的位置，生成组密钥或接收上层节点分发的组密钥，保存组密钥，并下发组密钥至下一层节点。
若不存在组节点新加入或退出通信的信息，不用按照更新后的路由图，逐层形成下个路由周期组密钥分发的路由生成树。
获取是否存在组节点新加入或退出组通信的信息中，该信息为新加入或退出组通信的组成员所在的量子密码网络节点ID。
以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树的具体过程包括：确定每一个组节点到其他组节点的总路径之和，确定总路径之和最小或小于设定值的组节点为根节点，将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点，不断重复，逐层形成下个路由周期组密钥分发的路由生成树。
作为优选的方式，可以选择处于量子密码网络的路由图中中心位置处的若干组节点为根节点，有助于提高组密钥分发的速度。
将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点的具体过程包括：将所有除已确定的根节点以外的组节点作为第一集合，将路由生成树的节点作为第二集合；
查找第一集合中距离第二集合中各个组节点最小或小于预设值的若干节点，作为对应组节点的下层节点或子节点，将这些下层节点与其对应的上层节点的连接边加入第三集合，将下层节点加入第二集合，同时从第一集合中删除上述下层节点；
不断重复，直到第一集合为空为止。
以确定总路径之和最小的组节点为根节点，距离各根节点密钥中继路径的最短的组节点作为相应根节点的下层节点为代表，进行详细说明，包括以下步骤：
1、确定组节点路由生成树的根节点，计算每一个组节点到其它节点的路径和，将和最小的组节点S作为路由生成树的根节点；
2、将所有除节点S以外的组节点的集合记为V，将路由生成树的集合记为(U，T)，U为生成树的节点集合，T为生成树中的连接节点的边集合，初始时，U只包含一个根节点S，T为空；
3、查找U和V中距离最近的两个节点(此处的距离是指节点间密钥中继的最短路径长度)，设为u和v，其中u∈U，v∈V，将边(u,v)加入集合T，将v加入集合U，同时从集合V中删除节点v；
4、重复步骤3，直到集合V为空为止。
作为示例的，步骤1中，如图2所示，设有A、B、C、D、E、F、G多个组节点，各组节点和其他节点的密钥中继的路径长度分别为：
组节点A:ab+ac+ad+ae+af+ag；
组节点B:ba+bc+bd+be+bf+bg；
组节点C:ca+cb+cd+ce+cf+cg；
组节点D:da+db+dc+de+df+dg；
组节点E:ea+eb+ec+ed+ef+eg；
组节点F:fa+fb+fc+fd+fe+fg；
组节点G:ga+gb+gc+gd+ge+gf；
其中，ij分别从组节点I到组节点J的密钥中继的路径长度，且ij＝ji。总路径长度最小的为组节点E，确定组节点E为根节点。
当然，在其他实施例中，可以使用其他方式计算密钥中继的总路径长度。
也可以根据应用情况和要求，确定总路径之和小于设定值的组节点为根节点，这样可以存在多个根节点，构成多线路并行分发，有助于提高组密钥分发的速度。
在不同的实施例中，也可以在确定下层节点或子节点的过程中，选择多条路径长度较小对应的节点为某节点的下层节点或子节点。
但是，无论是单线路分发还是多线路并行分发，都从路由生成树的根节点所在的组节点首先开始组密钥分发。根节点选择真随机数作 为组密钥，保存组密钥，同时将组密钥分别中继到路由生成树对应根节点的每一个下层节点。
每一个路由生成树中的节点收到上层节点分发的组密钥，保存组密钥，如果本节点在路由生成树上还存在下层节点，则将组密钥中继到路由生成树本节点的每一个下层节点。
实施例二：
一种分布式量子密码网络组密钥分发的系统，如图1所示，整个系统包括组通信认证服务器和参与组通信的组节点。组通信认证服务器负责参与组通信的组成员的注册、登陆认证、退出管理以及在每个路由周期将新加入或退出组通信的组成员所在的量子密码网络节点ID发送给每个组节点。每个路由周期，组节点根据量子密码网络的路由图计算下个路由周期组密钥分发的路由生成树。如果一个路由周期参与组通信的组节点没有变动，则组节点不需要重新计算路由生成树。
组通信开始时，组通信认证服务器将参与组通信的组成员所在的量子密码网络节点ID分别发送给每个组节点，每个路由周期，组通信认证服务器将新加入或退出组通信的组成员所在的量子密码网络节点ID发送给每个组节点，每个组节点根据量子密码网络的路由图计算下个路由周期组密钥分发的路由生成树。
组节点的组密钥分发过程如下所述：
每一个组节点根据量子密码网络的路由图计算本组通信所有组节点的路由生成树。路由生成树的根节点所在的组节点首先开始组密钥分发，根节点选择真随机数作为组密钥，保存组密钥，同时将组密钥分别中继到路由生成树本根节点的每一个子节点。每一个路由生成树中的节点收到上层节点分发的组密钥，保存组密钥，如果本节点在路由生成树上还存在子节点，则将组密钥中继到路由生成树本节点的每一个子节点。
在本实施例中，每个组节点根据量子密码网络的路由图确定下个路由周期组密钥分发的路由生成树的方法为：
1、首先确定组节点路由生成树的根节点，计算每一个组节点到其它节点的路径和，将和最小的组节点S作为路由生成树的根节点；
2、将所有除节点S以外的组节点的集合记为V，将路由生成树的集合记为(U，T)，U为生成树的节点集合，T为生成树中的连接节点的边集合，初始时，U只包含一个根节点S，T为空；
3、查找U和V中距离最近的两个节点(此处的距离是指节点间密钥中继的最短路径长度)，设为u和v，其中u∈U，v∈V，将边(u,v)加入集合T，将v加入集合U，同时从集合V中删除节点v；
3、重复步骤3，直到集合V为空为止。
如果在路由周期内参与组通信的组成员没有发生变动，则每个组节点不需要重新计算组密钥分发的路由生成树。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产 生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
上述虽然结合附图对本发明的具体实施方式进行了描述，但并非对本发明保护范围的限制，所属领域技术人员应该明白，在本发明的技术方案的基础上，本领域技术人员不需要付出创造性劳动即可做出的各种修改或变形仍在本发明的保护范围以内。

Claims (10)

  1. 一种分布式量子密码网络组密钥分发方法，其特征是：从参与组通信的组成员所在的量子密码网络节点，以下简称为组节点侧执行，包括以下步骤：
    获取当前路由周期的量子密码网络的路由图；
    获取是否存在组节点新加入或退出组通信的信息，如果存在，按照信息内容更新量子密码网络的路由图；
    按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；
    根据自己在路由生成树的位置，生成组密钥或接收上层节点分发的组密钥，保存组密钥，并下发组密钥至下一层节点。
  2. 如权利要求1所述的一种分布式量子密码网络组密钥分发方法，其特征是：若不存在组节点新加入或退出组通信的信息，不需要更新量子密码网络的路由图，不需要重新计算和更新相应的路由生成树。
  3. 如权利要求1所述的一种分布式量子密码网络组密钥分发方法，其特征是：获取是否存在组节点新加入或退出组通信的信息中，该信息包括新加入或退出组通信的组成员所在的量子密码网络节点ID。
  4. 如权利要求1所述的一种分布式量子密码网络组密钥分发方法，其特征是：以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树的具体过程包括：确定每一个 组节点到其他组节点的总路径之和，确定总路径之和最小或小于设定值的组节点为根节点，将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点，不断重复，逐层形成下个路由周期组密钥分发的路由生成树。
  5. 如权利要求1或4所述的一种分布式量子密码网络组密钥分发方法，其特征是：选择处于量子密码网络的路由图中位于中心位置处的若干组节点为根节点。
  6. 如权利要求4所述的一种分布式量子密码网络组密钥分发方法，其特征是：将距离各根节点密钥中继路径的最短或小于预设值的组节点作为相应根节点的下层节点的具体过程包括：将所有除已确定的根节点以外的组节点作为第一集合，将路由生成树的节点作为第二集合；
    查找第一集合中距离第二集合中各个组节点最小或小于预设值的若干节点，作为对应组节点的下层节点或子节点，将这些下层节点与其对应的上层节点的连接边加入第三集合，将下层节点加入第二集合，同时从第一集合中删除上述下层节点；
    不断重复，直到第一集合为空为止。
  7. 如权利要求1所述的一种分布式量子密码网络组密钥分发方法，其特征是：下发组密钥至下一层节点的具体过程中，路由生成树的根节点所在的组节点首先开始组密钥分发，根节点选择真随机数作为组密钥，保存组密钥，同时将组密钥分别中继到路由生成树对应根 节点的每一个下层节点。
  8. 如权利要求1所述的一种分布式量子密码网络组密钥分发方法，其特征是：下发组密钥至下一层节点的具体过程中，每一个路由生成树中的节点收到上层节点分发的组密钥，保存组密钥，如果本节点在路由生成树上还存在下层节点，则将组密钥中继到路由生成树本节点的每一个下层节点。
  9. 一种分布式量子密码网络组密钥分发系统，其特征是：包括：
    组通信认证服务器，被配置为进行参与组通信的组成员的注册、登陆认证、退出管理以及在每个路由周期将新加入或退出组通信的组成员所在的量子密码网络节点信息发送给每个组节点；
    组节点，参与组通信，被配置为按照更新后的路由图，以组密钥分发总路径小于设定阈值为目的，逐层形成下个路由周期组密钥分发的路由生成树；根据自己在路由生成树的位置，生成组密钥或接收上层节点分发的组密钥，保存组密钥，并下发组密钥至下一层节点。
  10. 一种终端设备，其特征是：包括处理器和计算机可读存储介质，处理器用于实现各指令；计算机可读存储介质用于存储多条指令，所述指令适于由处理器加载并执行权利要求1-8中任一项所述的一种分布式量子密码网络组密钥分发方法的步骤。
PCT/CN2021/117787 2020-12-28 2021-09-10 一种分布式量子密码网络组密钥分发方法及系统 WO2022142463A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011584314.2A CN114697002B (zh) 2020-12-28 2020-12-28 一种分布式量子密码网络组密钥分发方法及系统
CN202011584314.2 2020-12-28

Publications (1)

Publication Number Publication Date
WO2022142463A1 true WO2022142463A1 (zh) 2022-07-07

Family

ID=82130071

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/117787 WO2022142463A1 (zh) 2020-12-28 2021-09-10 一种分布式量子密码网络组密钥分发方法及系统

Country Status (2)

Country Link
CN (1) CN114697002B (zh)
WO (1) WO2022142463A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116669019A (zh) * 2023-07-28 2023-08-29 江苏飞梭智行设备有限公司 一种无人驾驶车辆轨道通信加密方法
RU2820558C1 (ru) * 2023-07-05 2024-06-05 ООО "СМАРТС-Кванттелеком" Способ управления критерием стойкости квантового распределения ключей, описываемых связными графами произвольных конфигураций

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103997463A (zh) * 2014-05-23 2014-08-20 中国人民解放军理工大学 一种低开销的覆盖网安全组播方法
CN103001875B (zh) * 2013-01-07 2015-03-11 山东量子科学技术研究院有限公司 一种量子密码网络动态路由方法
US20150334631A1 (en) * 2014-05-16 2015-11-19 Qualcomm Incorporated Establishing reliable routes without expensive mesh peering
CN105827397A (zh) * 2015-01-08 2016-08-03 阿里巴巴集团控股有限公司 基于可信中继的量子密钥分发系统、方法及装置
CN109962773A (zh) * 2017-12-22 2019-07-02 山东量子科学技术研究院有限公司 广域量子密码网络数据加密路由方法
CN111355655A (zh) * 2018-12-21 2020-06-30 山东量子科学技术研究院有限公司 一种量子密码网络量子路由检测方法和服务器

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8203970B2 (en) * 2006-10-16 2012-06-19 Hewlett-Packard Development Company, L.P. Method and apparatus for selecting spanning tree root
US7684352B2 (en) * 2006-11-02 2010-03-23 Nortel Networks Ltd Distributed storage of routing information in a link state protocol controlled network
CN100596063C (zh) * 2007-02-01 2010-03-24 华为技术有限公司 组密钥控制报文的分发系统、方法和装置
CN104579964B (zh) * 2013-01-07 2017-10-13 山东量子科学技术研究院有限公司 一种量子密码网络动态路由架构系统
CN103346969A (zh) * 2013-07-05 2013-10-09 中国科学院计算机网络信息中心 基于OpenFlow实现动态组播生成树路径调整的方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103001875B (zh) * 2013-01-07 2015-03-11 山东量子科学技术研究院有限公司 一种量子密码网络动态路由方法
US20150334631A1 (en) * 2014-05-16 2015-11-19 Qualcomm Incorporated Establishing reliable routes without expensive mesh peering
CN103997463A (zh) * 2014-05-23 2014-08-20 中国人民解放军理工大学 一种低开销的覆盖网安全组播方法
CN105827397A (zh) * 2015-01-08 2016-08-03 阿里巴巴集团控股有限公司 基于可信中继的量子密钥分发系统、方法及装置
CN109962773A (zh) * 2017-12-22 2019-07-02 山东量子科学技术研究院有限公司 广域量子密码网络数据加密路由方法
CN111355655A (zh) * 2018-12-21 2020-06-30 山东量子科学技术研究院有限公司 一种量子密码网络量子路由检测方法和服务器

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
RU2820558C1 (ru) * 2023-07-05 2024-06-05 ООО "СМАРТС-Кванттелеком" Способ управления критерием стойкости квантового распределения ключей, описываемых связными графами произвольных конфигураций
CN116669019A (zh) * 2023-07-28 2023-08-29 江苏飞梭智行设备有限公司 一种无人驾驶车辆轨道通信加密方法
CN116669019B (zh) * 2023-07-28 2023-10-27 江苏飞梭智行设备有限公司 一种无人驾驶车辆轨道通信加密方法

Also Published As

Publication number Publication date
CN114697002A (zh) 2022-07-01
CN114697002B (zh) 2024-07-19

Similar Documents

Publication Publication Date Title
TWI242337B (en) Network system, spanning tree configuration method, spanning tree configuration node, and spanning tree configuration program
TWI493926B (zh) 複雜型樹狀網路之自動化訊務工程
KR101809779B1 (ko) 타이-브레이킹 메커니즘에의 피드백으로서의 링크 사용률의 이용에 기초한 ８０２．１ａｑ에 대한 자동화된 트래픽 엔지니어링
Johari et al. A contract-based model for directed network formation
Xiao et al. Home-based zero-knowledge multi-copy routing in mobile social networks
US10404576B2 (en) Constrained shortest path determination in a network
CN103001892B (zh) 基于云计算的网络资源分配方法及系统
CN103650433A (zh) 路由发布方法、系统及控制器
WO2023245740A1 (zh) 一种基于蚁群算法的第四方物流运输路径规划方法
Michael et al. Optimal link-state hop-by-hop routing
WO2022142463A1 (zh) 一种分布式量子密码网络组密钥分发方法及系统
CN109995580A (zh) 5g网络切片中基于ga_pso混合算法的vn映射方法
Zhang et al. Concurrent multipath routing optimization in named data networks
CN100558071C (zh) 一种链路资源管理方法及传送网络和网络设备
CN105453494B (zh) 虚拟最短路径树建立及处理的方法及路径计算单元
Lui Constructing communication subgraphs and deriving an optimal synchronization interval for distributed virtual environment systems
Shi et al. Concurrent Entanglement Routing for Quantum Networks: Model and Designs
WO2022142460A1 (zh) 一种集中式量子密码网络组密钥分发方法及系统
CN106982162A (zh) 用于转发业务流的方法、装置和系统
Pandurangan et al. Theory of communication networks
WO2022142461A1 (zh) 一种分布式广域量子密码网络组密钥分发方法及系统
WO2022142462A1 (zh) 集中式广域量子密码网络组密钥分发方法及系统
Petrov et al. Minimization of multicast traffic and ensuring its fault tolerance in software-defined networks
Chakraborty et al. Optimal routing for dynamic multipoint connection
Kheong et al. Efficient setup for multicast connections using tree-caching

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913210

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21913210

Country of ref document: EP

Kind code of ref document: A1