WO2022213564A1 - 一种物联网无线终端量子密钥分发与协商方法 - Google Patents

一种物联网无线终端量子密钥分发与协商方法 Download PDF

Info

Publication number
WO2022213564A1
WO2022213564A1 PCT/CN2021/123062 CN2021123062W WO2022213564A1 WO 2022213564 A1 WO2022213564 A1 WO 2022213564A1 CN 2021123062 W CN2021123062 W CN 2021123062W WO 2022213564 A1 WO2022213564 A1 WO 2022213564A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
session
terminal
information
verification
Prior art date
Application number
PCT/CN2021/123062
Other languages
English (en)
French (fr)
Inventor
陈立全
赵梦楠
屠天扬
Original Assignee
东南大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 东南大学 filed Critical 东南大学
Publication of WO2022213564A1 publication Critical patent/WO2022213564A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Definitions

  • the invention belongs to the technical field of information security, discloses the application of quantum key distribution in a new field, and in particular relates to a quantum key distribution and negotiation method for Internet of Things wireless terminals.
  • Quantum key distribution uses quantum states to encode and transmit information quantumly, thereby providing a theoretically unconditionally secure shared key for both parties. It is known as one of the most disruptive cutting-edge technologies in the field of information security. Its security relies on the basic principles of quantum mechanics: single photons are not separable, Heisenberg's uncertainty principle, measurement collapse principle, quantum non-cloning theorem, etc. Once someone steals the key, it will inevitably be discovered. Quantum key distribution technology can establish information-theoretic-secure confidential communication for both parties, making the intensity of confidential communication jump from computing-based security to quantum-physical feature-based security.
  • IoT terminals still use plaintext protocols to directly expose the transmission content, so eavesdroppers can easily obtain the entire content of the communication without any security guarantee.
  • the IoT terminals that adopt encrypted transmission can be divided into three categories according to the different encryption strengths: one-type one-key, one-machine-one-key, and one-time-one key.
  • One-time pad can use asymmetric encryption to negotiate session keys, which requires a reliable third-party public key authentication center.
  • IoT terminals are mobile wireless terminals, so the distribution of quantum keys must be carried through wireless channels.
  • the wireless channel key generation technology is becoming more and more mature, which can ensure the safe distribution of quantum keys to the wireless terminals of the Internet of Things.
  • the two parties of the session communication cannot guarantee that the keys are consistent after receiving the quantum keys, which is an urgent problem to be solved.
  • the present invention is aimed at the problems in the prior art.
  • a quantum key distribution method of the wireless terminals of the Internet of Things is proposed.
  • the negotiation method uses the wireless channel key generation technology to generate a channel key between the edge gateway and the terminal device, and uses this key to encrypt the quantum key at the edge gateway.
  • the identity and other information are taken for key consistency check, so as to ensure the smooth progress of subsequent confidential sessions.
  • the technical solution adopted in the present invention is: a quantum key distribution and negotiation method for a wireless terminal of the Internet of Things, comprising the following steps:
  • channel key generation based on the wireless channel feature technology, the wireless channel key is generated between the edge gateway and the IoT wireless terminal;
  • the edge gateway encrypts the session information by using the generated channel key, and sends the session information to the wireless terminal to realize communication between the two parties;
  • the session information at least includes a quantum key, a session identifier and a key reading identifier;
  • the quantum key The key should be the encryption key required for quantum secure communication between the two communication parties of the IoT session terminal;
  • the session identifier is used to identify the specific session established by the two communication parties of the wireless terminal, that is, the session in which the quantum key is used for secure communication in the future; key reading The identifier is the unique identifier of the quantum key used in a single confidential communication, which is used for the key consistency comparison between the two parties in subsequent communications;
  • the IoT wireless terminal decrypts the received session information by using the channel key generated in step S1, and obtains a symmetric quantum key, a session ID and a key reading ID;
  • step S5 feedback processing: the target terminal of the IoT session terminal uses the verification result obtained in step S4 as feedback information, generates a key verification response and sends it to the session application terminal, and the session application terminal performs corresponding processing according to the received feedback result.
  • step S1 further includes:
  • the edge gateway G and the wireless terminal T respectively transmit pilot sequences to each other;
  • the edge gateway G and the wireless terminal T respectively measure the channel characteristics from each to the other;
  • the edge gateway G and the wireless terminal T quantify the wireless channel characteristics measured in step S12, and generate a channel key at least including identification information for encrypting the quantum key.
  • the key read identifier in the step S2 is the unique identifier of the quantum key in a single communication; the quantum key, the session identifier and the key read identifier to be transmitted by the edge gateway G are pre- After processing, channel error correction coding is performed to generate a bit sequence after channel error correction coding, and then the bit sequence is encrypted by using the channel key generated in step S1, and the encrypted data stream is sent to the wireless terminal T through an open channel.
  • step S3 further includes:
  • the wireless terminal T decrypts the data stream received from the edge gateway G by using the channel key generated in step S1, and recovers the quantum key, the session identifier and the key reading identifier sent by the edge gateway G therefrom;
  • the wireless terminal T uses a channel coding and decoding algorithm to perform channel error correction coding and decoding on the data stream decrypted in step S31 to generate a bit sequence after channel decoding;
  • step S33 After the wireless terminal T processes the bit sequence obtained in step S32, the session information transmitted by the edge gateway G to the wireless terminal T is obtained.
  • the processing process is inverse to the preprocessing process in step S2.
  • step S4 further comprises:
  • the application terminal T1 of the Internet of Things session terminal sends a key verification request to the session target terminal T2, where the identity verification information of the key verification request includes the identity of the sender (the session application terminal T1 ) , the identity of the receiver Terminal (session target terminal T 2 ) identity, session identity, key reading identity and quantum key hash value; the sender identity is used to indicate the source of the message, and the receiver judges the validity of the message sender according to this identity;
  • the session target terminal identity information is used to indicate the target device for message interaction with the device;
  • the session ID is used to indicate the specific session to which the current quantum key is applied, and is generated when the session application terminal applies for a session;
  • the key read ID is the quantum key
  • the label information in this session is unique within a single session; in addition to the above information, the verification request also includes an information digest encrypted with the sender's private key, and the receiver uses this information digest to identify the sender. Authentication, and can determine whether the message has been tampered with during transmission;
  • the session target terminal T2 after receiving the verification request sent by the session application terminal T1, the session target terminal T2 performs consistency comparison between the identity verification information in the verification request and the corresponding information of the local terminal. If the identity verification information is completely consistent , it means that the quantum key received by both parties belongs to this session and is consistent; if any one of the identity verification information fails to compare, it means that the quantum key received by both parties is invalid in this communication.
  • the key consistency comparison includes the processing of several information in the verification request: the consistency comparison between the sender's identity ID and the session ID, to determine whether the sender of the request has established a legitimate session with itself
  • the wireless terminal is the wireless terminal, and it is consistent with the session ID in the request;
  • the receiver ID in the request is compared with the receiver terminal's own ID for consistency, and it is determined that the target communication terminal of the sender is itself;
  • the session ID and the key read ID According to the session ID, the key reading ID in the request is compared with the key reading ID relayed by the receiving end from the edge gateway, and the key reading ID received by both parties in the communication is determined. It is consistent within this session;
  • the quantum key hash value sent by the sender is compared with the quantum key hash value of the receiver to further ensure the consistency of the quantum key.
  • step S5 further comprises:
  • the session target terminal T2 After the session target terminal T2 completes the key consistency comparison, it sends a key verification response to the session application terminal T1 according to the verification result ;
  • the verification corresponding request includes the identity of the session target terminal T2 , the session application
  • the terminal T1 identity identification, session identification, key reading identification and key verification result at the same time, perform identity authentication and anti-tampering operations on the information carried in the key verification response, and encrypt using the private key of the session target terminal T2
  • the hash value of the above-mentioned request information and sent to the session application terminal T 1 together with the above-mentioned request information;
  • the session application terminal T1 processes the received key verification response, and processes the three pieces of information : the sender ID, the receiver ID, and the session ID, in order to verify the legitimacy of the message and the message sender , and indicate the specific session corresponding to this key verification response, and the key reading identification information is used as the unique identification of the quantum key corresponding to this key verification in this session. According to this information, the session application terminal T 1 can exactly locate the specific key corresponding to the verification result;
  • the session application terminal T 1 processes according to the different situations of the verification results: when the verification is successful, that is, the session target terminal T 2 determines the quantum key that it has received. Consistent with the session application terminal T1, the two communicating parties will store the quantum key negotiated this time, and use this quantum key to conduct confidential communication in the future ; if the verification fails, the quantum key negotiated this time will be invalid and the session target will be invalid. The terminal T2 ignores the current key and does not store and record it. At the same time, the session application terminal T1 needs to initiate a key application again, and the upper quantum key management center is responsible for redistributing the quantum key.
  • the present invention proposes a quantum key distribution and negotiation method for the wireless terminal of the Internet of Things.
  • the negotiation process of the quantum key is more secure. There is eavesdropping, and both parties in the communication can immediately find out. Therefore, based on the security advantages of quantum keys, combining it with the Internet of Things and applying it to the communication of the Internet of Things terminals can ensure the absolute security of the data transmitted by the wireless terminals of the Internet of Things. Improve the overall security of the Internet of Things; in addition, after using the wireless channel key generation technology to complete the quantum key transfer from the edge gateway to the Internet of Things terminal, before the two communicating parties receive the quantum key and start to transmit data, the communication between the two parties is increased. The key consistency check between the two parties can ensure that the quantum keys of a certain session are consistent. This operation is the key to the smooth progress of the confidential session between the two parties.
  • Fig. 1 is the method step flow chart of the present invention
  • Fig. 2 is the working frame diagram of the present invention
  • FIG. 3 is a flow chart of the protocol of the present invention.
  • T1 session request terminal T 2 session target terminal G 1 Edge gateway corresponding to T1 G 2 Edge gateway corresponding to T2 K t1 The channel key generated by the T1 side K g1
  • a quantum key distribution and negotiation method for IoT wireless terminals includes the following steps:
  • a channel key is generated between the edge gateway and the IoT wireless terminal based on the feature quantization of the wireless channel.
  • the edge gateway uses this channel key to encrypt information such as quantum keys, and the IoT wireless terminal uses this channel key to encrypt the information sent by the edge gateway decrypt the information;
  • the two communicating parties in the solution are the session application terminal T 1 and the session target terminal T 2 respectively, and their respective corresponding edge gateways are respectively edge gateways G 1 and G 2 .
  • the session application terminal T 1 and the edge gateway G 1 respectively send the channel sounding pilot signal P; then, according to the channel sounding pilot signal P, the session application terminal T 1 and the edge gateway G 1 obtain the channel characteristics of the channel between them ; Finally, the session application terminal T 1 quantizes the acquired channel feature into a channel key K t1 , and the edge gateway G 1 quantizes the acquired channel feature into a channel key K g1 .
  • the channel key generation process between the session target terminal T 2 and the edge gateway G 2 is consistent with the above description, the channel key generated by the session target terminal T 2 is K t2 , and the channel key generated by the edge gateway G 2 is K g2 .
  • K t1 and K g1 are consistent, and similarly, K t2 and K g2 are consistent, and can be used as a symmetric key for encrypted transmission between the wireless terminal and the edge gateway.
  • the edge gateway uses the generated channel key to encrypt the quantum key, session ID and key read ID in the edge gateway key pool;
  • a consistent pair of quantum keys K q1 and K q2 already exists at the edge gateways G 1 and G 2 , and the pair of quantum keys is distributed by the upper-layer nodes through the quantum key network.
  • the edge gateways G 1 and G 2 not only need to transmit the quantum key to the wireless terminals T 1 and T 2 , but also need to transmit the session identifier Ctag established by the two terminals and the key reading identifier of the quantum key in this session. Ktag.
  • the session identifier Ctag is generated by the session application terminal T1 when applying for a confidential session with the session target terminal T2, and T1 and T2 record and store the session identifier Ctag when the session is successfully established, which is valid only before the session ends and It is unique, and both communicating parties can use this identification to determine which specific session the received message belongs to and the sender of the message.
  • the key reading identification Ktag is the identification information of the quantum key in this session, which is unique within a single session. In the subsequent key comparison, this information will be checked for consistency.
  • Step (2) includes the following substeps:
  • the symbolic representations of the session identifier and the key reading identifier in steps (2.1) and (2.2) are not consistent, and the purpose is to distinguish the information transmitted by both ends.
  • the session ID and the key read ID sent by the edge gateways G 1 and G 2 to the wireless terminals T 1 and T 2 respectively should be consistent.
  • the IoT wireless terminal uses the generated channel key to decrypt the encrypted information sent by the edge gateway to obtain the corresponding quantum key, session ID and key reading ID.
  • Step (3) is to decrypt the information encrypted by the edge gateway in step (2), including the following sub-steps:
  • the session application terminal T1 receives the secret information E i1 sent by the edge gateway G 1 , uses the channel key K t1 generated in step ( 1 ) to decrypt the E i1 , and recovers the information I carried by the edge gateway.
  • the session target terminal T 2 receives the secret information E i2 sent by the edge gateway G 2 , uses the channel key K t2 generated in step (1) to decrypt the E i2 , and restores the information carried by the edge gateway.
  • the communication parties of the session wireless terminal perform the key consistency check on the received quantum key.
  • the key hash value and the information digest generated by encrypting the above information with the private key of the session application terminal are sent to the session target terminal; then the session target terminal performs key consistency comparison and verification according to the received key verification request, Finally, the key verification result is obtained.
  • the session application terminal identity ID 1 is used to indicate the specific identity information of the message sender to the session target terminal T 2 to prove the legitimacy of the message source; the session target terminal identity ID 2 is the recipient of the key verification request. In this specific embodiment, it is the identity information of the session target terminal T 2 ; the session identifier Ctag 1 and the key reading identifier Ktag 1 have the same meaning as described in step (2), and are used here to indicate that T 1 wants to communicate with T 2
  • the specific session to which the quantum key for key consistency check belongs and the unique identification information of this quantum key in this session; the quantum key hash value H(K q1 ) is the quantum key obtained by T 1 for itself The result of the hash operation on the key K q1 , if the quantum keys received by T 1 and T 2 are the same, the hash results of the two are also the same, and the hash value will not leak any keys.
  • step ( 4 ) the session application terminal T1 generates and sends the key verification request to the session target terminal T2, including the following substeps:
  • the session application terminal T 1 performs a hash operation on the received quantum key K q1 to generate a quantum key hash value H(K q1 );
  • the encryption algorithm adopts Elliptic Curve Digital Signature Algorithm (ECDSA), which is more in line with the lightweight feature requirements of the Internet of Things wireless terminal.
  • EDSA Elliptic Curve Digital Signature Algorithm
  • step ( 4 ) the session target terminal T2 receives and processes the key verification request sent by the session application terminal T1 and includes the following substeps :
  • H'(M 1 ) and H(M 1 ) are equal, it can be verified whether the message has been tampered with, and whether the sender of the message is from the session application terminal T 1 can be determined. If the two are equal, the subsequent information comparison can be continued; if the two are not equal, the information transmitted by the key verification request is invalid, and the session target terminal T 2 will notify the session application terminal T 1 to re-initiate the encryption. key verification request.
  • the session target terminal T2 compares the identification ID 2 in the information body M1 with its own identification.
  • the session target terminal T 2 obtains the session identifier Ctag 2 of its own storage backup according to the session application terminal identity identifier ID 1 , and compares it with the session identifier Ctag 1 in the information body M 1 ;
  • the session target terminal T 2 compares the key reading identification Ktag 1 in the information body M 1 with its own key reading identification Ktag 2 ;
  • the session target terminal T 2 performs a hash operation on the quantum key K q2 received by itself to obtain the quantum key hash value H(K q2 ), and calculates the quantum key hash value H in the message body M 1 (K q1 ) is aligned with H(K q2 );
  • the session target terminal T2 makes a key verification response to the session application terminal T1 according to the key verification result obtained in step (4.6). Similar to the key verification request, the key verification response includes the identity of the session target terminal T2 , the identity of the session application terminal T1, the session identification, the key read identification, and the use of the private key of the session application terminal to encrypt the above. A summary of the information generated by the information.
  • the session target terminal uses the comparison and verification result as feedback information, generates a key verification response and sends it to the session application terminal. Finally, the session application terminal performs corresponding processing according to the received feedback result.
  • the key verification response sent by the session target terminal T2 includes the session target terminal T2 identity identifier, the session application terminal T1 identity identifier, the session identifier, the key read identifier, the key verification result flag and the The private key of the session target terminal T2 encrypts the message digest generated from the above-mentioned information.
  • the key verification result flag bit is the key verification result generated by the session target terminal T 2 after information comparison and verification in step (4.6), and the specific meanings and functions of other identification information are consistent with the description in step (4). .
  • step ( 5 ) the session target terminal T2 generates and sends the key verification response to the session application terminal T1, including the following sub - steps:
  • the session target terminal T 2 packs its own identification ID 2 , the identification ID 1 of the session application terminal T 1 , the session identification Ctag 2 , the key reading identification Ktag 1 and the key verification result flag KC result );
  • step (5) the session application terminal T 1 makes corresponding processing according to the received key verification response, including the following sub-steps:
  • the session application terminal T 1 obtains the message body M 2 and the message digest ciphertext e 2 from the received key verification response KC Response .
  • First, perform a hash operation on the message body M 2 to obtain H'(M 2 ), and then use the public key PU 2 of the session target terminal T 2 to decrypt the message digest ciphertext e 2 to obtain the message digest H(M 2 ) D_ECDSA(PU 2 , e 2 ).
  • the alignment work of H(M 2 ) and H'(M 2 ) and the result processing are the same as in step (4.5).
  • step (5.5) The processing of each identification information in the information body M2 by the session application terminal T1 is consistent with that in step (4.6). If the identification information comparison fails, the session application terminal T1 will resend the key verification request ; if the identification information comparison is successful, the corresponding processing is made according to the KC result in the information body M2 according to the situation:
  • KC result True
  • the key consistency check is successful, that is, the session target terminal T 2 determines that the received quantum key is consistent with the session application terminal T 1 , then the two communicating parties will store the quantum key negotiated this time. Subsequent use of this quantum key for secure communication;
  • T 1 and T 2 invalidate the received quantum keys K q1 and K q2 , and do not store and record them, and the session application terminal T 1 needs to re-run A key application is initiated, and the upper-level quantum key management center is responsible for redistribution of quantum keys.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种物联网无线终端量子密钥分发与协商方法，首先生成边缘网关至物联网无线终端之间的无线信道密钥；边缘网关利用信道密钥加密量子密钥等会话信息后，发送给无线终端通信双方；物联网无线终端利用信道密钥进行解密，得到用于保密通信的量子密钥；物联网会话申请终端和会话目标终端双方接收到量子密钥后，通过协议交互密钥信息并比对校验来保证两端量子密钥的一致性，以此确保后续保密会话顺利进行，有力提升物联网整体安全性。

Description

一种物联网无线终端量子密钥分发与协商方法 技术领域
本发明属于信息安全技术领域，公开了量子密钥分发在新领域的应用，具体涉及一种物联网无线终端量子密钥分发与协商方法。
背景技术
量子密钥分发利用量子态对信息进行量子编码并传递，从而为通信双方提供理论上无条件安全的共享密钥，被称为信息安全领域最具颠覆性的前沿技术之一。它的安全性依赖于量子力学基本原理：单光子不可再分、海森堡不确定性原理、测量塌缩原理、量子不可克隆定理等，一旦有人窃取密钥，必然会被发现。量子密钥分发技术可以为通信双方建立信息论安全的保密通信，使保密通信强度从基于计算安全跃升为基于量子物理特征安全。
目前，部分物联网终端仍然采用明文协议，直接暴露传输内容，因此窃听者可以很容易获取通信的全部内容，没有任何安全保障。此外，采取加密传输的物联网终端终端根据加密强度的不同可以分为三类：一型一密、一机一密以及一次一密。然而，不论是一型一密还是一机一密，由于密钥固定，被窃听者攻破的可能性仍然较高，难以保障信息传输的安全性。一次一密可以采用非对称加密的方式进行会话密钥的协商，需要可靠的第三方公钥认证中心，否则一旦认证中心被攻破，传输的密文也会被完全破解；也可以采用对称加密的方式，但是对称密钥的协商过程容易遭受中间人攻击。由此可见，传统的密钥 方案存在的安全隐患日益凸显，将量子密钥应用于物联网终端是必然趋势。
物联网终端大部分是移动的无线终端，因此量子密钥的分发必须通过无线信道作为承载。目前，无线信道密钥生成技术日益成熟，能够保证量子密钥安全分发至物联网无线终端，然而，会话通信双方接收到量子密钥后不能保证密钥是一致的，这是急需解决的问题。
发明内容
本发明正是针对现有技术中的问题，为实现量子密钥安全分发至物联网无线终端以及会话终端设备之间的密钥一致性协商，提出了一种物联网无线终端量子密钥分发与协商方法，利用无线信道密钥生成技术在边缘网关与终端设备之间生成信道密钥，并利用此密钥加密边缘网关处的量子密钥，同时会话通信双方终端设备根据接收到的密钥读取标识等信息进行密钥一致性检验，以此确保后续保密会话顺利进行。
为了实现上述目的，本发明采用的技术方案是：一种物联网无线终端的量子密钥分发与协商方法，包括如下步骤：
S1,信道密钥的生成：基于无线信道特征技术，在边缘网关和物联网无线终端之间生成无线信道密钥；
S2,信息传输：边缘网关利用生成的信道密钥加密会话信息，并将会话信息发送给无线终端，实现双方通信；所述会话信息至少包括量子密钥、会话标识和密钥读取标识；量子密钥应是物联网会话终端 通信双方进行量子保密通信需要的加密密钥；会话标识用于标识无线终端通信双方建立的特定会话，即后续应用量子密钥进行保密通信的会话；密钥读取标识是单次保密通信中用到的量子密钥的唯一标识，用于后续通信双方的密钥一致性比对；
S3,解密：物联网无线终端利用步骤S1生成的信道密钥，对接收到的会话信息进行解密，得到对称的量子密钥、会话标识和密钥读取标识；
S4，校验：物联网会话终端的通信双方对接收到的量子密钥进行密钥的一致性校验，若结果一致，本次密钥用于后续步骤步骤；只要有一项校验不一致，量子密钥在本次通信中无效；
S5，反馈处理：物联网会话终端的目标终端将步骤S4获得的校验结果作为反馈信息，生成密钥校验响应发送至会话申请终端，会话申请终端根据接收到的反馈结果作出相应的处理。
作为本发明的一种改进，所述步骤S1进一步包括：
S11，边缘网关G和无线终端T分别向对方发射导频序列；
S12，边缘网关G和无线终端T分别测量各自到对方的信道特征；
S13，边缘网关G和无线终端T对经步骤S12测量得到的无线信道特征进行量化，生成至少包括用于加密量子密钥的标识信息的信道密钥。
作为本发明的一种改进，所述步骤S2中密钥读取标识为单次通信中量子密钥的唯一标识；边缘网关G将要传输的量子密钥、会话标识以及密钥读取标识通过预处理后进行信道纠错编码，生成信道纠错 编码后的比特序列，然后利用步骤S1生成的信道密钥对比特序列加密，再将加密后的数据流通过公开信道发送给无线终端T。
作为本发明的另一种改进，所述步骤S3进一步包括：
S31，无线终端T通过在步骤S1生成的信道密钥，对从边缘网关G接收到的数据流进行解密，从中恢复出边缘网关G发送的量子密钥、会话标识以及密钥读取标识；
S32，无线终端T使用信道编码解码算法对步骤S31解密后的数据流进行信道纠错编码解码，生成信道解码后的比特序列；
S33，无线终端T将步骤S32得到的比特序列进行处理后，得到边缘网关G传输给无线终端T的会话信息，所述处理过程和步骤S2中的预处理过程呈相逆处理。
作为本发明的又一种改进，所述步骤S4进一步包括：
S41，物联网会话终端的申请终端T 1向会话目标终端T 2发送密钥校验请求，所述密钥校验请求的身份校验信息包括发送端(会话申请终端T 1)身份标识、接收端(会话目标终端T 2)身份标识、会话标识、密钥读取标识以及量子密钥哈希值；发送端身份标识用于指明消息的来源，接收端根据此标识判断消息发送端的合法性；会话目标终端身份信息用于指明与本设备进行消息交互的目标设备；会话标识用于指明应用当前量子密钥的特定会话，于会话申请终端申请会话时产生；密钥读取标识是量子密钥在本次会话中的标号信息，在单次会话内具有唯一性；除了上述信息，校验请求中还包含利用发送端私钥加 密的信息摘要，接收端利用这一信息摘要对发送端进行身份认证，并且可以确定消息在传输过程中是否受到篡改；
S42，会话目标终端T 2接收到会话申请终端T 1发送的校验请求后，将校验请求中的身份校验信息与本端的对应信息进行一致性比对，若各身份校验信息完全一致，则表明通信双方接收到的量子密钥属于本次会话并且是一致的；若有任意一个身份校验信息比对失败，则表明双方接收到的量子密钥在本次通信内是无效的，不能应用于后续保密会话；密钥一致性比对包括对校验请求中若干信息的处理：发送端身份标识与会话标识的一致性比对，确定此请求的发送方是已与自身建立合法会话的无线终端，并且与请求中的会话标识相符合；请求中的接收端身份标识与接收终端自身身份标识进行一致性比对，确定发送端的目标通信终端是自身；会话标识与密钥读取标识的一致性比对，根据会话标识，将请求中的密钥读取标识与接收端从边缘网关处中继得到的密钥读取标识进行比对，确定通信双方收到的密钥读取标识在本次会话内是一致的；发送端传送的量子密钥哈希值与接收端的量子密钥哈希值进行比对，进一步保证量子密钥的一致性。
作为本发明的更进一步改进，所述步骤S5进一步包括：
S51，会话目标终端T 2完成密钥一致性比对后，根据校验结果向会话申请终端T 1发送密钥校验响应；所述校验相应请求包含会话目标终端T 2身份标识、会话申请终端T 1身份标识、会话标识、密钥读取标识和密钥校验结果，同时对密钥校验响应承载的信息进行身份认证以及防篡改的操作，利用会话目标终端T 2的私钥加密上述请求信息的哈 希值，并与上述请求信息一起发送至会话申请终端T 1；
S52，会话申请终端T 1对接收到的密钥校验响应进行处理，对发送端身份标识、接收端身份标识以及会话标识这三个信息的处理，目的是验证消息以及消息发送方的合法性，并且指出此密钥校验响应所对应的特定会话，密钥读取标识信息作为本次密钥校验所对应的量子密钥在此次会话中的唯一标识，根据这些信息，会话申请终端T 1能够确切定位到校验结果所对应的具体密钥；
S53，完成对请求信息中每一个标识信息的处理后，会话申请终端T 1根据校验结果的不同分情况处理：当校验成功时，即会话目标终端T 2确定自身接收到的量子密钥与会话申请终端T 1一致，通信双方将对本次协商的量子密钥进行存储，后续利用这一量子密钥进行保密通信；若校验失败，则本次协商的量子密钥失效，会话目标终端T 2忽视本次密钥，不对其进行存储记录，同时会话申请终端T 1需要再次发起密钥申请，并由上层量子密钥管理中心负责进行量子密钥的重新分发。
与现有技术相比，本发明提出了一种物联网无线终端量子密钥分发与协商方法，基于量子态测不准原理以及量子不可克隆原理，量子密钥的协商过程安全性较高，若存在窃听行为，通信双方能够即刻发现，因此基于量子密钥的安全性优势，将其与物联网结合起来，应用至物联网终端的通信中，能够保证物联网无线终端传输数据的绝对安全，有力提升物联网整体安全性；此外，利用无线信道密钥生成技术完成从边缘网关到物联网终端的量子密钥传递后，在通信双 方接收到量子密钥并开始传输数据前，增加了通信双方之间的密钥一致性检验，能够保证某一次会话的量子密钥是一致的，这一操作是通信双方保密会话顺利进行的关键。
附图说明
图1为本发明的方法步骤流程图；
图2为本发明的工作框架图；
图3为本发明的协议流程图。
具体实施方式
以下将结合附图和实施例，对本发明进行较为详细的说明。
实施例1
本方案中的符号及其定义如表1所示：
表1
符号 定义
T 1 会话申请终端
T 2 会话目标终端
G 1 T 1对应的边缘网关
G 2 T 2对应的边缘网关
K t1 T 1端生成的信道密钥
K g1 G 1端生成的信道密钥
K t2 T 2端生成的信道密钥
K g2 G 2端生成的信道密钥
Ctag 保密会话标识
Ktag 密钥读取标识
K q1 T 1端量子密钥
K q2 T 2端量子密钥
ID 1 T 1身份标识
ID 2 T 2身份标识
KC Request 密钥校验请求
KC Response 密钥校验响应
KC Result 密钥校验结果
ECDSA(PR,*) 椭圆曲线私钥签名算法
D_ECDSA(PU,*) 椭圆曲线公钥认证算法
AES(K,*) AES加密算法
D_AES(K,*) AES解密算法
H(*) 哈希运算
如图1所示，一种物联网无线终端的量子密钥分发与协商方法，包括如下的步骤：
(1)边缘网关与物联网无线终端之间基于无线信道特征量化生成信道密钥，边缘网关利用此信道密钥加密量子密钥等信息，物联网无线终端利用此信道密钥对边缘网关发送的信息进行解密；
假设方案中通信双方分别为会话申请终端T 1和会话目标终端T 2，他们各自对应的边缘网关分别为边缘网关G 1和G 2。
首先，会话申请终端T 1与边缘网关G 1分别发送信道探测导频信号P；随后，根据信道探测导频信号P,会话申请终端T 1与边缘网关G 1 获得两者之间信道的信道特征；最后，会话申请终端T 1将获取的信道特征量化为信道密钥K t1，边缘网关G 1将获取的信道特征量化为信道密钥K g1。会话目标终端T 2与边缘网关G 2之间的信道密钥生成过程与上述描述一致，会话目标终端T 2生成的信道密钥为K t2，边缘网关G 2生成的信道密钥为K g2。其中K t1与K g1具有一致性，同理，K t2与K g2具有一致性，可以作为无线终端与边缘网关之间进行加密传输的对称密钥。
(2)边缘网关利用生成的信道密钥加密边缘网关密钥池中的量子密钥、会话标识以及密钥读取标识；
边缘网关G 1和G 2处已存有一致的量子密钥对K q1和K q2，这对量子密钥由上层节点经量子密钥网络分发得到。边缘网关G 1和G 2不仅需要向无线终端T 1和T 2传输量子密钥，还需要传输两个终端已经建立的会话标识Ctag以及此量子密钥在本次会话中的密钥读取标识Ktag。
其中会话标识Ctag由会话申请终端T 1在申请与会话目标终端T 2的保密会话时产生，并且T 1与T 2在会话成功建立时对会话标识Ctag进行记录存储，仅在会话结束前有效且是唯一的，通信双方可以通过这一标识确定接收到的消息属于哪一个特定会话以及消息的发送方。密钥读取标识Ktag是此次量子密钥在本次会话中的标识信息，在单次会话内具有唯一性，在后续的密钥比对中，会对这一信息进行一致性校验。
步骤(2)包括如下的子步骤：
(2.1)边缘网关G 1向会话申请终端T 1传输的信息为I 1＝(K q1,Ctag 1,Ktag 1)，包括量子密钥K q1、会话标识Ctag 1以及密钥读取标识Ktag 1。边缘网关G 1利用步骤(1)中生成的信道密钥K g1对I 1进行加密处理，此处采用AES对称加密算法，生成密文E i1＝ AES(K g1,I 1)，并将E i1发送至会话申请终端T 1。
(2.2)类似的，边缘网关G 2向会话目标终端T 2传输的信息为I 2＝(K q2,Ctag 2,Ktag 2)，包括量子密钥K q2、会话标识Ctag 2以及密钥读取标识Ktag 2。边缘网关G 2利用步骤(1)中生成的信道密钥K g2对I 2进行加密处理，生成密文E i2＝AES(K g2,I 2)，并将E i2发送至会话申请终端T 2。
需要注意的是，步骤(2.1)以及步骤(2.2)中的会话标识以及密钥读取标识的符号表示并不一致，目的是对两端传送的信息加以区分。在会话正常进行时，边缘网关G 1和G 2分别向无线终端T 1和T 2发送的会话标识以及密钥读取标识应该是一致的。
(3)物联网无线终端利用生成的信道密钥对边缘网关发送的加密信息进行解密操作，得到对应的量子密钥、会话标识以及密钥读取标识。
步骤(3)即是对步骤(2)中边缘网关加密的信息进行解密操作，包括如下的子步骤：
(3.1)会话申请终端T 1收到边缘网关G 1发送的秘密信息E i1，利用步骤(1)中生成的信道密钥K t1对E i1进行解密处理，恢复出通过边缘网关承载的信息I′ 1＝D_AES(K t1,E i1)＝(K q1,Ctag 1,Ktag 1)，同样包括量子密钥K q1、会话标识Ctag 1以及密钥读取标识Ktag 1。
(3.2)类似的，会话目标终端T 2收到边缘网关G 2发送的秘密信息E i2，利用步骤(1)中生成的信道密钥K t2对E i2进行解密处理，恢复出通过边缘网关承载的信息I′ 2＝D_AES(K t2,E i2)＝(K q2,Ctag 2,Ktag 2)，同样包括量子密钥K q2、会话标识Ctag 2以及密钥读取标识Ktag 2。
(4)会话无线终端通信双方对接收到的量子密钥进行密钥的一 致性校验，首先由会话申请终端将自身身份标识、会话目标终端身份标识、会话标识、密钥读取标识、量子密钥哈希值以及利用会话申请终端的私钥加密上述信息生成的信息摘要发送至会话目标终端；接着由会话目标终端根据接收到的密钥校验请求进行密钥一致性比对校验，最终得出密钥校验结果。
其中，由会话申请终端T 1向会话目标终端T 2发送的密钥校验请求中携带的各信息具体意义如下：
会话申请终端身份标识ID 1用于向会话目标终端T 2表明消息发送方的具体身份信息，证明消息来源的合法性；会话目标终端身份标识ID 2即为密钥校验请求的接收方，在本具体实施方案中为会话目标终端T 2的身份标识信息；会话标识Ctag 1与密钥读取标识Ktag 1与步骤(2)中描述的含义一致，在此用于表明T 1想要与T 2进行密钥一致性校验的量子密钥所属的具体会话以及此量子密钥在本次会话中的唯一标识信息；量子密钥哈希值H(K q1)为T 1对自身获取的量子密钥K q1进行哈希运算产生的结果，若T 1与T 2接收到的量子密钥是一致的，则两者哈希的结果也是一致的，同时哈希值不会泄漏任何密钥的有效信息，因此能够保证密钥检验过程中的安全性；利用T 1的私钥PR 1加密上述信息M 1＝(ID 1,ID 2,Ctag 1,Ktag 1,H(K q1))，并生成信息摘要H(M 1)，此信息摘要用于T 2对T 1进行身份认证以及检验消息是否受到篡改。
步骤(4)中会话申请终端T 1生成并向会话目标终端T 2发送密钥校验请求包括如下的子步骤：
(4.1)会话申请终端T 1对接收到的量子密钥K q1进行哈希运算生成量子密钥哈希值H(K q1)；
(4.2)会话申请终端T 1将自身的身份标识ID 1、会话目标终端T 2 的身份标识ID 2、会话标识Ctag 1、密钥读取标识Ktag 1以及量子密钥哈希值H(K q1)打包成密钥校验请求中的信息主体M 1＝(ID 1,ID 2,Ctag 1,Ktag 1,H(K q1))；
(4.3)会话申请终端T 1对M 1进行哈希运算生成消息摘要H(M 1)，并用会话申请终端T 1的私钥PR 1对消息摘要H(M 1)进行加密处理，生成密文e 1＝ECDSA(PR 1,H(M 1))；
此步骤中，加密算法采用椭圆曲线数字签名算法(ECDSA)，比较符合物联网无线终端的轻量级特征要求。
(4.4)会话申请终端T 1将步骤(4.2)中生成的信息主体M 1与步骤(4.3)中生成的信息摘要密文e 1结合生成最终的密钥校验请求KC Request＝M 1+e 1，最后，将这一请求信息发送至会话目标终端T 2。
步骤(4)中会话目标终端T 2接收并处理会话申请终端T 1发送的密钥校验请求包括如下的子步骤：
(4.5)会话目标终端T 2从接收到的密钥校验请求KC Request中得到信息主体M 1与信息摘要密文e 1。首先，对信息主体M 1进行哈希运算得到H′(M 1)，然后利用会话申请终端T 1的公钥PU 1对信息摘要密文e 1进行解密操作，得到信息摘要H(M 1)＝D_ECDSA(PU 1,e 1)。
通过比较H′(M 1)与H(M 1)是否相等，可以验证消息是否受到篡改，并且能够确定消息的发送方是否来自会话申请终端T 1。如果两者相等，则可以继续进行后续信息的比对工作；如果两者不相等，则该密钥校验请求传输的信息无效，会话目标终端T 2将会通知会话申请终端T 1重新发起密钥校验请求。
(4.6)完成发送方身份认证以及信息篡改检验后,会话目标终 端T 2获得密钥校验请求中的信息主体M 1＝(ID 1,ID 2,Ctag 1,Ktag 1,H(K q1))，初始化校验结果标志位KC result＝True，信息比对的具体流程如下：
a)会话目标终端T 2将信息主体M 1中的身份标识ID 2与自身的身份标识进行比对。
b)会话目标终端T 2根据会话申请终端身份标识ID 1得到自身存储备份的会话标识Ctag 2，将其与信息主体M 1中的会话标识Ctag 1进行比对；
c)会话目标终端T 2将信息主体M 1中的密钥读取标识Ktag 1与自身的密钥读取标识Ktag 2进行比对；
d)会话目标终端T 2对自身接收到的量子密钥K q2进行哈希运算，得到量子密钥哈希值H(K q2)，并将信息主体M 1中的量子密钥哈希值H(K q1)与H(K q2)进行比对；
其中，a)到d)四个步骤中，若有任意一个步骤出现比对不一致的情况，则意味着密钥一致性校验失败，会话目标终端T 2将改变校验结果标志位KC result＝False，并提前结束校验处理，跳转至步骤(4.7)。若四个步骤的比对结果均一致，则意味着
会话申请终端T 1与会话目标终端T 2接收到的量子密钥是一致的，保持校验结果标识位KC result＝True。
(4.7)会话目标终端T 2根据步骤(4.6)中得到的密钥校验结果对会话申请终端T 1做出密钥校验响应。与密钥校验请求相类似，密钥校验响应中包括会话目标终端T 2身份标识、会话申请终端T 1身份标 识、会话标识、密钥读取标识以及利用会话申请终端的私钥加密上述信息生成的信息摘要。
(5)会话目标终端将比对校验的结果作为反馈信息，生成密钥校验响应发送至会话申请终端，最后，会话申请终端根据接收到的反馈结果作出相应的处理。
其中，会话目标终端T 2发送的密钥校验响应中包括会话目标终端T 2身份标识、会话申请终端T 1身份标识、会话标识、密钥读取标识、密钥校验结果标志位以及利用会话目标终端T 2的私钥加密上述信息生成的信息摘要。密钥检验结果标志位是步骤(4.6)中由会话目标终端T 2经信息比对校验后生成的密钥校验结果，其他标识信息的具体含义以及作用与步骤(4)中的描述一致。
步骤(5)中会话目标终端T 2生成并向会话申请终端T 1发送密钥校验响应包括如下的子步骤：
(5.1)会话目标终端T 2将自身的身份标识ID 2、会话申请终端T 1的身份标识ID 1、会话标识Ctag 2、密钥读取标识Ktag 1以及密钥校验结果标志位KC result打包成密钥校验响应中的信息主体M 2＝(ID 2,ID 1,Ctag 2,Ktag 2,KC result)；
(5.2)会话目标终端T 2对M 2进行哈希运算生成消息摘要H(M 2)，并用会话目标终端T 2的私钥PR 2对消息摘要H(M 2)进行加密处理，生成密文e 2＝ECDSA(PR 2,H(M 2))；
(5.3)会话目标终端T 2将步骤(5.1)中生成的信息主体M 2与步骤(5.2)中生成的信息摘要密文e 2结合生成最终的密钥校验响应 KC Response＝M 2+e 2，最后，将这一响应信息发送至会话申请终端T 1。
步骤(5)中会话申请终端T 1根据接收到的密钥校验响应做出相应的处理包括如下的子步骤：
(5.4)会话申请终端T 1从接收到的密钥校验响应KC Response中得到信息主体M 2与信息摘要密文e 2。首先，对信息主体M 2进行哈希运算得到H′(M 2)，然后利用会话目标终端T 2的公钥PU 2对信息摘要密文e 2进行解密操作，得到信息摘要H(M 2)＝D_ECDSA(PU 2,e 2)。对H(M 2)以及H′(M 2)的比对工作以及结果处理与步骤(4.5)中一致。
(5.5)会话申请终端T 1对信息主体M 2中各个标识信息的处理与步骤(4.6)中一致。若标识信息比对失败，则会话申请终端T 1将重新发送密钥校验请求；若标识信息比对成功，则根据信息主体M 2中的KC result分情况做出相应处理：
若KC result＝True，密钥一致性校验成功，即会话目标终端T 2确定接收到的量子密钥与会话申请终端T 1一致，那么通信双方将对本次协商的量子密钥进行存储，后续利用这一量子密钥进行保密通信；
若KC result＝False，密钥一致性校验失败，则T 1与T 2对接收到的量子密钥K q1与K q2做无效处理，不对其进行存储记录，同时会话申请终端T 1需要再次发起密钥申请，并由上层量子密钥管理中心负责进行量子密钥的重新分发。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。 因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (6)

  1. 一种物联网无线终端的量子密钥分发与协商方法，其特征在于，包括如下步骤：
    S1,信道密钥的生成：基于无线信道特征技术，在边缘网关和物联网无线终端之间生成无线信道密钥；
    S2,信息传输：边缘网关利用生成的信道密钥加密会话信息，并将会话信息发送给无线终端，实现双方通信；所述会话信息至少包括量子密钥、会话标识和密钥读取标识；
    S3,解密：物联网无线终端利用步骤S1生成的信道密钥，对接收到的会话信息进行解密，得到对称的量子密钥、会话标识和密钥读取标识；
    S4，校验：物联网会话终端的通信双方对接收到的量子密钥进行密钥的一致性校验，若结果一致，本次密钥用于后续步骤；只要有一项校验不一致，量子密钥在本次通信中无效；
    S5，反馈处理：物联网会话终端的目标终端将步骤S4获得的校验结果作为反馈信息，生成密钥校验响应发送至会话申请终端，会话申请终端根据接收到的反馈结果作出相应的处理。
  2. 如权利要求1所述的一种物联网无线终端的量子密钥分发与协商方法，其特征在于所属步骤S1进一步包括：
    S11，边缘网关G和无线终端T分别向对方发射导频序列；
    S12，边缘网关G和无线终端T分别测量各自到对方的信道特征；
    S13，边缘网关G和无线终端T对经步骤S12测量得到的无线信道特征进行量化，生成至少包括用于加密量子密钥的标识信息的信道 密钥。
  3. 如权利要求2所述的一种物联网无线终端的量子密钥分发与协商方法，其特征在于步骤S2中密钥读取标识为单次通信中量子密钥的唯一标识；边缘网关G将要传输的量子密钥、会话标识以及密钥读取标识通过预处理后进行信道纠错编码，生成信道纠错编码后的比特序列，然后利用步骤S1生成的信道密钥对比特序列加密，再将加密后的数据流通过公开信道发送给无线终端T。
  4. 如权利要求3所述的一种物联网无线终端的量子密钥分发与协商方法，其特征在于所述步骤S3进一步包括：
    S31，无线终端T通过在步骤S1生成的信道密钥，对从边缘网关G接收到的数据流进行解密，从中恢复出边缘网关G发送的量子密钥、会话标识以及密钥读取标识；
    S32，无线终端T使用信道编码解码算法对步骤S31解密后的数据流进行信道纠错编码解码，生成信道解码后的比特序列；
    S33，无线终端T将步骤S32得到的比特序列进行处理后，得到边缘网关G传输给无线终端T的会话信息，所述处理过程和步骤S2中的预处理过程呈相逆处理。
  5. 如权利要求3或4所述一种的物联网无线终端的量子密钥分发与协商方法，其特征在于所述步骤S4进一步包括：
    S41，物联网会话终端的申请终端T 1向会话目标终端T 2发送密钥校验请求，所述密钥校验请求的身份校验信息包括会话申请终端T 1 身份标识、会话目标终端T 2身份标识、会话标识、密钥读取标识、量子密钥哈希值和包含利用会话申请终端T 1私钥加密的信息摘要；
    S42，会话目标终端T 2接收到会话申请终端T 1发送的校验请求后，将校验请求中的身份校验信息与本端的对应信息进行一致性比对，若各身份校验信息完全一致，则表明通信双方接收到的量子密钥属于本次会话并且是一致的；若有任意一个身份校验信息比对失败，则表明双方接收到的量子密钥在本次通信内是无效的，不能应用于后续保密会话。
  6. 如权利要求5所述的一种物联网无线终端的量子密钥分发与协商方法，其特征在于所述步骤S5进一步包括：
    S51，会话目标终端T 2完成密钥一致性比对后，根据校验结果向会话申请终端T 1发送密钥校验响应；所述校验相应请求包含会话目标终端T 2身份标识、会话申请终端T 1身份标识、会话标识、密钥读取标识和密钥校验结果，同时对密钥校验响应承载的信息进行身份认证以及防篡改的操作，利用会话目标终端T 2的私钥加密上述请求信息的哈希值，并与上述请求信息一起发送至会话申请终端T 1；
    S52，会话申请终端T 1对接收到的密钥校验响应进行处理，确切定位到校验结果所对应的具体密钥；
    S53，完成对请求信息中每一个标识信息的处理后，会话申请终端T 1根据校验结果的不同分情况处理：当校验成功时，即会话目标终端T 2确定自身接收到的量子密钥与会话申请终端T 1一致，通信双方将对本次协商的量子密钥进行存储，后续利用这一量子密钥进行保密 通信；若校验失败，则本次协商的量子密钥失效，会话目标终端T 2忽视本次密钥，不对其进行存储记录，同时会话申请终端T 1需要再次发起密钥申请，并由上层量子密钥管理中心负责进行量子密钥的重新分发。
PCT/CN2021/123062 2021-04-07 2021-10-11 一种物联网无线终端量子密钥分发与协商方法 WO2022213564A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110373128.2A CN113038468B (zh) 2021-04-07 2021-04-07 一种物联网无线终端量子密钥分发与协商方法
CN202110373128.2 2021-04-07

Publications (1)

Publication Number Publication Date
WO2022213564A1 true WO2022213564A1 (zh) 2022-10-13

Family

ID=76454430

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/123062 WO2022213564A1 (zh) 2021-04-07 2021-10-11 一种物联网无线终端量子密钥分发与协商方法

Country Status (2)

Country Link
CN (1) CN113038468B (zh)
WO (1) WO2022213564A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115694816A (zh) * 2023-01-04 2023-02-03 南京中科齐信科技有限公司 一种基于uds协议的量子密钥对充注方法
CN116170232A (zh) * 2023-04-21 2023-05-26 安徽中科锟铻量子工业互联网有限公司 量子网关数据显示管理系统
CN116366206A (zh) * 2023-06-01 2023-06-30 三未信安科技股份有限公司 一种增强密码卡可靠性的方法及系统
CN116471587A (zh) * 2023-04-19 2023-07-21 合肥工业大学 一种v2v通信下的车组内通信密钥生成及更新方法
CN116743380A (zh) * 2023-08-14 2023-09-12 中电信量子科技有限公司 基于量子密钥分发的otn加密通信方法及系统
CN117241267A (zh) * 2023-11-15 2023-12-15 合肥工业大学 一种基于区块链适用于v2i场景下量子组密钥分发方法

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113038468B (zh) * 2021-04-07 2022-09-09 东南大学 一种物联网无线终端量子密钥分发与协商方法
CN113630407B (zh) * 2021-08-02 2022-12-27 中电信量子科技有限公司 使用对称密码技术增强mqtt协议传输安全的方法和系统
CN113708929B (zh) * 2021-08-26 2022-07-01 东南大学 一种物联网边缘网关定时推送量子密钥的方法
CN117527228A (zh) * 2023-12-06 2024-02-06 安徽省气象信息中心 一种基于量子安全隧道的地面气象观测数据传输密钥协商方法及系统
CN117579276B (zh) * 2024-01-16 2024-03-29 浙江国盾量子电力科技有限公司 用于馈线终端的量子加密方法及量子板卡模组

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104660602A (zh) * 2015-02-14 2015-05-27 山东量子科学技术研究院有限公司 一种量子密钥传输控制方法及系统
CN107896148A (zh) * 2017-12-25 2018-04-10 北京天融信网络安全技术有限公司 一种加解密数据的方法及系统
CN111049645A (zh) * 2019-11-20 2020-04-21 北京邮电大学 物联网系统及其量子密钥分配方法和装置
CN111970696A (zh) * 2020-08-27 2020-11-20 东南大学 一种基于功率分配和波束调度的多用户高效密钥生成方法
CN113038468A (zh) * 2021-04-07 2021-06-25 东南大学 一种物联网无线终端量子密钥分发与协商方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105991285B (zh) * 2015-02-16 2019-06-11 阿里巴巴集团控股有限公司 用于量子密钥分发过程的身份认证方法、装置及系统
CN109347628B (zh) * 2018-09-29 2019-07-26 中国人民解放军国防科技大学 一种基于物理层信道特征的轻量级动态安全加密方法
CN111132153B (zh) * 2019-12-19 2021-07-09 中山大学 一种基于无线信道特征的内生安全通信方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104660602A (zh) * 2015-02-14 2015-05-27 山东量子科学技术研究院有限公司 一种量子密钥传输控制方法及系统
CN107896148A (zh) * 2017-12-25 2018-04-10 北京天融信网络安全技术有限公司 一种加解密数据的方法及系统
CN111049645A (zh) * 2019-11-20 2020-04-21 北京邮电大学 物联网系统及其量子密钥分配方法和装置
CN111970696A (zh) * 2020-08-27 2020-11-20 东南大学 一种基于功率分配和波束调度的多用户高效密钥生成方法
CN113038468A (zh) * 2021-04-07 2021-06-25 东南大学 一种物联网无线终端量子密钥分发与协商方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ARUL RAJAKUMAR; RAJA GUNASEKARAN; ALMAGRABI ALAA OMRAN; ALKATHEIRI MOHAMMED SAEED; CHAUHDARY SAJJAD HUSSAIN; BASHIR ALI KASHIF: "A Quantum-Safe Key Hierarchy and Dynamic Security Association for LTE/SAE in 5G Scenario", IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, IEEE SERVICE CENTER, NEW YORK, NY., US, vol. 16, no. 1, 24 October 2019 (2019-10-24), US , pages 681 - 690, XP011766606, ISSN: 1551-3203, DOI: 10.1109/TII.2019.2949354 *

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115694816A (zh) * 2023-01-04 2023-02-03 南京中科齐信科技有限公司 一种基于uds协议的量子密钥对充注方法
CN116471587A (zh) * 2023-04-19 2023-07-21 合肥工业大学 一种v2v通信下的车组内通信密钥生成及更新方法
CN116471587B (zh) * 2023-04-19 2023-10-20 合肥工业大学 一种v2v通信下的车组内通信密钥生成及更新方法
CN116170232A (zh) * 2023-04-21 2023-05-26 安徽中科锟铻量子工业互联网有限公司 量子网关数据显示管理系统
CN116170232B (zh) * 2023-04-21 2023-06-23 安徽中科锟铻量子工业互联网有限公司 量子网关数据显示管理系统
CN116366206A (zh) * 2023-06-01 2023-06-30 三未信安科技股份有限公司 一种增强密码卡可靠性的方法及系统
CN116366206B (zh) * 2023-06-01 2023-08-25 三未信安科技股份有限公司 一种增强密码卡可靠性的方法及系统
CN116743380A (zh) * 2023-08-14 2023-09-12 中电信量子科技有限公司 基于量子密钥分发的otn加密通信方法及系统
CN116743380B (zh) * 2023-08-14 2023-10-31 中电信量子科技有限公司 基于量子密钥分发的otn加密通信方法及系统
CN117241267A (zh) * 2023-11-15 2023-12-15 合肥工业大学 一种基于区块链适用于v2i场景下量子组密钥分发方法
CN117241267B (zh) * 2023-11-15 2024-01-12 合肥工业大学 一种基于区块链适用于v2i场景下量子组密钥分发方法

Also Published As

Publication number Publication date
CN113038468B (zh) 2022-09-09
CN113038468A (zh) 2021-06-25

Similar Documents

Publication Publication Date Title
WO2022213564A1 (zh) 一种物联网无线终端量子密钥分发与协商方法
JP4944886B2 (ja) 展性攻撃に対して改良された安全性を有する技術（これに限定されない）を含む非ワンタイムパッド暗号で暗号化した署名鍵を用いた、暗号認証、及び／又は共有暗号鍵の設定
WO2020087805A1 (zh) 基于双密值和混沌加密的可信测控网络认证方法
CN110048849B (zh) 一种多层保护的会话密钥协商方法
US11044084B2 (en) Method for unified network and service authentication based on ID-based cryptography
CN109495274A (zh) 一种去中心化智能锁电子钥匙分发方法及系统
CN110087240B (zh) 基于wpa2-psk模式的无线网络安全数据传输方法及系统
WO2016058404A1 (zh) 基于预共享密钥的实体鉴别方法及装置
CN111756529B (zh) 一种量子会话密钥分发方法及系统
CN103763356A (zh) 一种安全套接层连接的建立方法、装置及系统
CN113630248B (zh) 一种会话密钥协商方法
CN108599926B (zh) 一种基于对称密钥池的HTTP-Digest改进型AKA身份认证系统和方法
WO2019100217A1 (zh) 生物识别信息传输建立方法、装置、系统及存储介质
WO2022142307A1 (zh) 一种基于安全中继的量子通信方法和通信网络
CN112165386B (zh) 一种基于ecdsa的数据加密方法及系统
CN111416712B (zh) 基于多个移动设备的量子保密通信身份认证系统及方法
CN114362946B (zh) 密钥协商方法及系统
TWI487308B (zh) 量子通訊方法
CN114499857A (zh) 一种实现大数据量子加解密中数据正确性与一致性的方法
CN114928503B (zh) 一种安全通道的实现方法及数据传输方法
CN113839786B (zh) 一种基于sm9密钥算法的密钥分发方法和系统
CN111526131B (zh) 基于秘密共享和量子通信服务站的抗量子计算的电子公文传输方法和系统
CN110365482B (zh) 一种数据通信方法和装置
Elboukhari et al. Integration of quantum key distribution in the TLS protocol
CN114157418B (zh) 一种基于量子网络的可信数据上链装置及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21935782

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21935782

Country of ref document: EP

Kind code of ref document: A1