WO2023227067A1

WO2023227067A1 - Quantum network communication method and apparatus, electronic device and storage medium

Info

Publication number: WO2023227067A1
Application number: PCT/CN2023/096317
Authority: WO
Inventors: 田野
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2022-05-25
Filing date: 2023-05-25
Publication date: 2023-11-30
Also published as: CN117176333A

Abstract

The present disclosure provides a quantum network communication method and apparatus, an electronic device and a storage medium. The method comprises: a first application or a first device sends first information to a first KM, wherein the first information is used for indicating a second KM which provides services for a second application or a second device.

Description

Quantum network communication methods, devices, electronic equipment and storage media

Cross-references to related applications

This application claims priority to Chinese Patent Application No. 202210583447.0 filed in China on May 25, 2022, the entire content of which is incorporated herein by reference.

Technical field

The present disclosure relates to the field of communication technology, and in particular, to a quantum network communication method, device, electronic equipment and storage medium.

Background technique

In the quantum secure communication network, before the first cryptographic application (Application, APP) establishes communication with the second cryptographic application, there is a problem that the quantum key manager (Key Manager, KM) that provides the service cannot be determined, resulting in Communication failed.

Contents of the invention

In order to solve related technical problems, embodiments of the present disclosure provide a quantum network communication method, device, electronic equipment and storage medium.

The technical solution of the embodiment of the present disclosure is implemented as follows:

Embodiments of the present disclosure provide a quantum network communication method, applied to a first application or a first device, and the method includes:

Send first information to the first KM; wherein the first information is used to indicate a second KM that provides services for the second application or the second device.

In the above solution, the method also includes:

The first information is determined according to the corresponding relationship between the application and the KM.

In the above solution, the first information is the identification and/or address of the second KM.

In the above solution, the corresponding relationship between the application and KM is at least one of the following:

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.

In the above solution, before sending the first information to the first KM, the method further includes:

The first information is obtained from the second application or the local configuration of the second device.

Send a first request to the second application or second device; the first request is used to query a second KM that provides services for the second application or second device;

Receive the returned query results.

In the above solution, the second device includes an application layer device or a user network management layer device in a quantum secure communication network;

And/or, the second application is a password application.

In the above solution, the first request also carries second information; the second information is used to indicate the first KM that provides services for the first application or the first device.

In the above solution, the method also includes:

When the first application or the first device accesses the quantum network for the first time, or when the KM that provides services for the first application or the first device changes, a third device is sent to the third device. 2 requests;

Wherein, the second request also carries third information; the third information is used to indicate the first KM that provides services for the first application or the first device.

In the above solution, the method also includes:

The following content is securely protected and transmitted: first information, second information, third information, first request and response result, second request and response result.

In the above solution, the first information also includes: the identification and/or address of the second application/the second device; the first information is also used for the first KM to transfer the second The identity and/or address of the application/second device is forwarded to the second KM for use by the second KM to determine the second application/second device to receive the quantum key.

An embodiment of the present disclosure also provides a quantum network communication device, including:

The first sending unit is configured to send first information to the first KM; wherein the first information is used to indicate the second KM that provides services for the second application or the second device.

An embodiment of the present disclosure also provides an electronic device, including a first processor and a first communication interface, wherein,

The first communication interface is used to send first information to a first KM; wherein the first information is used to indicate a second KM that provides services for a second application or a second device.

An embodiment of the present disclosure also provides an electronic device, including: a first processor and a first memory used to store a computer program capable of running on the first processor, wherein the first processor is used to run the computer program, perform the steps of either method above.

An embodiment of the present disclosure also provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

In the quantum network communication method, device, electronic device and storage medium provided by the embodiments of the present disclosure, the first application or the first device sends the first information to the first KM; the first information is used to indicate the second application or the first device. The second device provides services to the second KM. Since the first information is used to indicate the second KM, and both the first KM and the second KM are located in the key management layer in the QKD network, the first KM can query the second KM based on the first information, thereby communicating with the second KM Establish a session connection and negotiate a quantum key that can be used by the first application and the second application, so that the second KM can establish a session connection with the second application, thereby completing the first application-first KM-second KM-th End-to-end session creation between two applications can improve the probability of successful communication between applications.

Description of the drawings

Figure 1 is a schematic diagram of the quantum secure communication network architecture in related technologies;

Figure 2 is a schematic diagram of the quantum secure communication system architecture in related technologies;

Figure 3 is a schematic flow chart of the implementation of a quantum network communication method according to an embodiment of the present disclosure;

Figure 4 is a schematic interactive flow diagram of a quantum network communication method provided by an embodiment of the present disclosure;

Figure 5 is a schematic interactive flow diagram of a quantum network communication method provided by an embodiment of the present disclosure;

Figure 6 is a schematic diagram of a quantum network communication structure provided by an embodiment of the present disclosure;

Figure 7 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure.

Detailed ways

Figure 1 shows a schematic diagram of the quantum communication network architecture in related technologies. As shown in Figure 1, according to the current There is a standard definition: a quantum communication network consists of a quantum key distribution (QKD) network and a user network.

Among them, the QKD network is used to provide key distribution capabilities. The QKD network includes the quantum layer, key management layer, QKD Network (QKDN, QKDN) control layer and QKDN network management layer. In addition, the QKD network here can also be called quantum key distribution QKD network, quantum secure communication network, quantum communication network, quantum network, network layer, etc. The user network uses quantum keys distributed by the QKD network to achieve secure communication; the user network includes an application layer and a user network network management layer.

Figure 2 shows a schematic diagram of the quantum communication system architecture in related technologies. As shown in Figure 2, before cryptographic application A and cryptographic application B establish communication, cryptographic application A accesses the QKD network through the Ak interface and obtains the quantum key from KM _A that provides services for cryptographic application A. Cryptographic application B accesses the QKD network through the Ak interface. QKD network, obtains the same quantum key from KM _B serving cryptographic application B. Among them, the quantum key is used by cryptographic application A and cryptographic application B to encrypt and decrypt the transmitted data to achieve secure communication. The Ak interface can be an application programming interface (Application Programming Interface, API) or a message interface.

In the related technology, before the active-side application establishes communication with the passive-side application, the active-side application needs to establish a communication connection with the active-side KM. After the active-side application establishes a communication connection with the active-side KM, and after the active-side KM establishes a communication connection with the active-side application Before transmitting the key, it is necessary to complete the end-to-end session creation between the active end application-active end KM-passive end application-passive end KM. The relevant session creation process is as follows:

a) The active-side application initiates a session creation request to the active-side KM by calling the QKD_APP_OpenSession interface, and provides the passive-side application's application identification, key stream quality of service (QoS) requirements, key transmission mode and other information; where , the active end application refers to the application that initiates the request, the passive end application refers to the application that receives the request; the active end KM refers to the KM that provides services for the active end, and can also be called the source KM, and the passive end KM refers to the KM that provides services for the active end. The KM that provides services on the passive side can also be called the destination KM;

b) The active end KM determines the passive end KM based on the application identification provided by the active end application, and then establishes a communication connection with the passive end KM. The active end KM and the passive end KM conduct quantum key negotiation, and negotiate the available applications and passive end applications to the active end. Apply the provided QKD key stream identifier and key stream QoS parameters to complete the session connection establishment between the active end KM and the passive end KM;

c) The active-end KM returns information such as the QKD key stream identifier and key stream QoS parameters to the active-end application. After the active-end application confirms that the QoS meets the requirements, it completes the session establishment between the active-end application and the active-end KM.

In order to enable the active end KM to find the passive end KM and generate the same quantum key for the active end KM and the passive end KM through the QKD network, the active end application needs to provide the active end KM with the application identification of the passive end application. The application identifier of the passive-side application is used to query the QKDN network management system for the passive-side KM, but there is a technical problem that the passive-side KM cannot be found. Here’s why:

In the related technology, the active-side KM queries the QKDN network management system for the passive-side KM based on the identification information of the passive-side password application, but there is a technical problem that the passive-side KM cannot be found. Here’s why:

According to the definition of existing standards, the QKDN network management system is responsible for fault management, configuration management, billing management, performance management and security management (Fault, Configuration, Accounting, Performance and Security, FCAPS) of the entire QKD network, and supports communication with user networks Network management system connection. Among them, the more relevant configuration management function is responsible for the provision, configuration and discovery of QKDN resources, as well as the acquisition and management of QKDN topology. When QKDN supports the key relay function, the configuration management function can also assist the QKDN controller to provide key relay routing.

It can be seen from the above definition that the QKDN network management system of the QKD network mainly implements the management and maintenance of various resources within the QKD network, and is not responsible for maintaining the correspondence between the KM in the QKD key management layer and various upper-layer applications. . Therefore, the QKDN network management system cannot provide relevant query information for KM, causing the active KM to be unable to find the passive KM.

Based on this, in various embodiments of the present disclosure, the first application or the first device sends first information to the first KM; the first information is used to indicate the second KM that provides services for the second application or the second device. . Since the first information is used to indicate the second KM, and both the first KM and the second KM are located in the key management layer in the QKD network, the first KM can query the second KM based on the first information, thereby communicating with the second KM Establish a session connection and negotiate a quantum key that can be used by the first application and the second application, so that the second KM can establish a session connection with the second application, thereby completing the first application-first KM-second KM-th End-to-end session creation between two applications can improve the probability of successful communication between applications. The above solution can effectively separate the QKD network from the upper user network. Separation can prevent the QKDN network management system from intervening in the management and maintenance of upper-layer business information, reduce the operation and maintenance complexity of the QKD network management system, and contribute to the integrated development of the QKD network, user networks, and services.

The present disclosure will be described in further detail below with reference to the accompanying drawings and embodiments.

Embodiments of the present disclosure provide a quantum network communication method, applied to a first application or a first device. The first device may be an electronic device such as a terminal or a server. Referring to Figure 3, the method includes:

Step 301: Send the first information to the first KM.

Wherein, the first information is used to indicate a second KM that provides services for the second application or the second device.

Here, the first KM represents a KM that provides services for the first application or the first device. The first device is characterized as a first device running a first application. The first device may be called an active end device/source end device. The first application may be called an active end application/source end application and runs on the first device; The second device is characterized as a device running a second application. The second device may be called a passive end device/destination end device, and the second application may be called a passive end application/destination end application. It should be noted that multiple applications can run on the same device, and different applications can use different quantum keys. The first information may directly indicate or indirectly indicate the second KM.

Before sending the first information to the first KM, in an embodiment, the method further includes:

Here, when the first application or the first device determines the second application, it determines the second KM that provides services for the second application or the second device based on the corresponding relationship between the application and the KM, and determines the second KM based on the determined relationship. The second KM determines the first information.

Among them, the correspondence between an application and a KM may be one application corresponding to one KM, one application corresponding to multiple KMs, or multiple applications corresponding to one KM.

In one embodiment, the first information is the identification and/or address of the second KM. In one embodiment, the corresponding relationship between the application and the KM is at least one of the following:

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.

Here, the identifier of the application may be the name of the application.

In actual application, the first information can be stored locally in a preconfigured manner, and the first application or the first device maintains the corresponding relationship between the application and the KM. Based on this, in one embodiment, before sending to the first KM Before the first information, the method further includes:

The first information is obtained from the first application or a local configuration of the first device.

Here, when the second application or the second device is determined, the first application or the first device obtains the first information from the local configuration of the first application; or, obtains the first information from the local configuration of the first device. .

The corresponding relationship between the application and the KM may be maintained by the second application or the second device, and the first information may be obtained through message interaction with the second application or the second device. Based on this, in one embodiment, when sending Before the first KM sends the first information, the method further includes:

Send a first request to the second application or the second device; the first request is used to query a second KM that provides services for the second application or the second device;

Receive query results.

Here, when the second application or the second device is determined, the first application or the first device can send a first request to the second application, and receive the query result returned by the second application regarding the first request. The first request Used to query the second KM that provides services for the second application or the second device; the first application or the first device can also send a first request to the second device, and receive the query results returned by the second device regarding the first request. , the first request is used to query the second KM that provides services for the second application or the second device. The query results include the first information.

In one embodiment, the second device includes an application layer device or a user network management layer device in a quantum network;

And/or, the second application is a password application.

Here, when the second application is a cryptographic application, the first application may also be a cryptographic application.

Cryptozoological applications can be understood as various applications or businesses that require the use of quantum cryptography or quantum keys for secure communication. Cryptocurrency application is a general concept, and there may be many implementation methods in actual application. For example, cryptography application can be equipment, business systems, application systems and programs that directly need to use the keys generated by the QKD network, or it can It does not directly use the keys generated by the QKD network, but stores, manages or forwards the quantum keys, thereby satisfying the needs of middle-layer equipment, business systems or programs that need to use quantum keys.

On the basis of sending the first request to the second application or the second device, in one embodiment, the first request also carries second information; the second information is used to indicate that the first application or the second device is the first request. The first device provides the first KM of the service.

Here, when the second application or the second device receives the first request, it parses the second information from the first request and stores the second information; it can also update the relationship between the application and the KM based on the first information. corresponding relationship.

In actual application, a third device may be used to uniformly maintain the correspondence between the application and the KM. Based on this, in one embodiment, the method further includes:

When the first application or the first device accesses the quantum network for the first time, or when the KM that provides services for the first application or the first device changes, a third device is sent to the third device. Two requests.

Here, the second request may be a registration request or an update request. When the first application or the first device accesses the quantum network for the first time, the second request may be a registration request; when the KM that provides services for the first application or the first device changes, the second request may be an update request.

The third device may be a central system management device. For example, one of the functions of the third device is responsible for maintaining the correspondence between the application/device and the KM, and storing a correspondence list or mapping list between the application and the KM.

In order to protect the security of communication content during the quantum key agreement process, in an embodiment, the method further includes:

Here, the first request and the response result refer to the first request and the response result regarding the first request, and the response result can be understood as the query result. The second request and response result refer to the second request and the response result regarding the second request.

That is to say, the first application or the first device can perform security protection on the communication content. For example, the first application or the first device can communicate with other applications (such as the second application) or devices (such as the first KM, the second device). and third devices) for security protection.

Security protection can be understood as encryption and/or integrity protection, digital signature/signature verification, etc. The security protection method used here is based on the traditional cryptographic system and does not use quantum keys for protection. The quantum key negotiated between KMs is used to protect important applications or business data.

In one embodiment, the first information further includes: the identification and/or address of the second application/the second device; the first information is also used for the first KM to transfer the The identity and/or address of the second application/second device is forwarded to the second KM for use by the second KM to determine the second application/second device to receive the quantum key.

Here, when receiving the first information, the first KM parses out the identity and/or address of the second application or the second device contained in the first information, and converts the identity and/or address of the second application or the second device into The address is forwarded to the second KM, so that the second KM determines the second application to receive the quantum key based on the identity and/or address of the second application, or determines the second application to receive the quantum key based on the identity and/or address of the second device. Second device for quantum keys.

The solution for the first application or the first device to obtain the first information in the embodiment of the present disclosure will be further described below with reference to the interaction flow diagram.

As shown in Figure 4, in an application scenario where the second application/second device maintains the corresponding relationship between the application and the KM, the first application/first device obtains the first information through message interaction with the second application/second device. information.

Step 1: The first application/first device sends a first request to the second application/second device.

Wherein, the first request is used to query the second KM that provides services for the second application or the second device.

In one embodiment, the second device includes an application layer device or a user network management layer device in a quantum secure communication network; and/or the second application is a cryptographic application.

In an embodiment, the first request also carries second information; the second information is used to indicate the first KM that provides services for the first application or the first device.

Step 2: The first application/first device receives the query result.

Here, when the second application/second device receives the first request, based on the corresponding relationship between the application and the KM, the second KM is determined, and the first information is determined and sent to the first application/first device. Return query results. The first information is used to indicate the KM that provides services for the second application or the second device.

The first application/first device receives the query result returned by the second application/second device based on the first request, and associates and stores the second application with the first information. The query results include the first information.

In one embodiment, the first information is the identification and/or address of the second KM.

In one embodiment, the corresponding relationship between the application and the KM is at least one of the following:

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.

In an embodiment, the first application/first device can also securely protect and transmit the first information, the second information, the first request and the query result.

As shown in Figure 5, in an application scenario where the third device uniformly maintains the correspondence between the application and the KM, the first application/first device obtains the first information through message interaction with the third device.

Step 1: The second application/second device sends a second request to the third device.

The second request may be a registration request or an update request. Wherein, when the second application/second device accesses the quantum network for the first time, the second request sent to the third device may be a registration request; when the KM that provides services for the second application/second device changes, the second request sent to the third device may be a registration request; The second request sent by the three devices is an update request.

In one embodiment, the second request sent by the second application/second device also carries third information; the third information is used to indicate the second KM that provides services for the second application or the second device.

In actual application, the third device can be a centralized system management device. The first application and the second application are password applications.

Step 2: The third device returns a response to the second request to the second application/second device.

Step 3: The first application/first device sends a second request to the third device.

When the first application/first device accesses the quantum network for the first time, the second request is a registration request; when the KM that provides services for the first application/first device changes, the second request is an update request.

In one embodiment, the second request sent by the first application/first device also carries third information; the third information is used to indicate the first KM that provides services for the first application or the first device.

Step 4: The third device returns a response to the second request to the first application/first device.

Step 5: The first application/first device sends the first request to the third device.

Step 6: The third device returns the query result regarding the first request to the first application/first device.

Here, when receiving the first request, the third device determines the second KM based on the correspondence between the application and the KM, determines the first information, and returns the query result to the first application. The query results include the first information. The first information is used to indicate a second KM that provides services for the second application or the second device. In one embodiment, the first information is the identification and/or address of the second KM.

The first application/first device receives the query result returned by the third device based on the first request, and associates and stores the second application with the first information.

In an embodiment, the first application/first device can also securely protect and transmit the first information, the second information, the third information, the first request and query results, the second request and the response to the second request. .

In the quantum network communication method, device, electronic device and storage medium provided by the embodiments of the present disclosure, the first application or the first device sends the first information to the first KM; the first information is used to indicate the second application or the first device. The second device provides services to the second KM. Since the first information is used to indicate the second KM, and both the first KM and the second KM are located in the key management layer in the QKD network, the first KM can query the second KM based on the first information and establish a relationship with the second KM. The session is connected and the quantum key that can be used by the first application and the second application is negotiated, so that the second KM can establish a session connection with the second application, thereby completing the first application-first KM-second KM-second End-to-end session creation between applications can improve the probability of successful communication between applications.

In order to implement the quantum network communication method of the embodiment of the present disclosure, the embodiment of the present disclosure also provides a quantum network communication device, which is provided on the first device or the first application. As shown in Figure 6, the device includes:

The first sending unit 61 is configured to send first information to the first KM; wherein the first information is used to indicate the second KM that provides services for the second application or the second device.

In one embodiment, the device includes:

A determining unit, configured to determine the first information according to the corresponding relationship between the application and the KM.

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.

In one embodiment, the device further includes:

An obtaining unit, configured to obtain the first information from the first application or the local configuration of the first device.

In one embodiment, the device further includes:

The second sending unit is used to send a first request to the second application or the second device; the first request is used to query the second KM that provides services for the second application or the second device. ;

The first receiving unit is used to receive query results.

In one embodiment, the second device includes an application layer device or a user network management layer device in a quantum secure communication network;

And/or, the second application is a password application.

In an embodiment, the first request also carries second information; the second information is used to indicate a first KM that provides services for the first application or the first device.

In one embodiment, the device includes:

The third sending unit is configured to send a message to the quantum network when the first application or the first device accesses the quantum network for the first time, or when the KM that provides services for the first application or the first device changes. The third device sends a second request;

In one embodiment, the device further includes:

The processing unit is used to securely protect and transmit the following content: first information, second information, third information, first request and response result, and second request and response result.

In one embodiment, the first information further includes: the identification and/or address of the second application/the second device;

The first information is also used for the first KM to transfer the second application/the second device The identification and/or address are forwarded to the second KM for the second KM to determine the second application/second device to receive the quantum key.

In actual application, the first sending unit 61, the second sending unit, the third sending unit, the fourth sending unit and the first receiving unit can be implemented by the processor in the quantum network communication device in combination with the communication interface, and the determination unit, acquisition unit and processing unit The unit may be implemented by a processor in a quantum network communication device.

It should be noted that when the quantum network communication device provided in the above embodiment performs quantum network communication, only the division of the above program modules is used as an example. In actual applications, the above processing can be allocated to different program modules as needed. Completion means dividing the internal structure of the device into different program modules to complete all or part of the processing described above. In addition, the quantum network communication device provided by the above embodiments and the quantum network communication method embodiments belong to the same concept. Please refer to the method embodiments for the specific implementation process, which will not be described again here.

Based on the hardware implementation of the above program module, and in order to implement the quantum network communication method of the embodiment of the disclosure, the embodiment of the disclosure also provides an electronic device. As shown in Figure 7, the electronic device 7 includes:

The first communication interface 71 is capable of information exchange with other network nodes;

The first processor 72 is connected to the first communication interface 71 to implement information interaction with other network nodes, and is used to execute the method provided by one or more of the above technical solutions when running a computer program. The computer program is stored on the first memory 73 .

Specifically, the first communication interface 71 is used to send first information to the first KM; wherein the first information is used to indicate the second KM that provides services for the second application or the second device.

In an embodiment, the first processor 72 is configured to determine the first information according to the corresponding relationship between the application and the KM.

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.

In an embodiment, the first processor 72 is further configured to: obtain the data from the first application or the first The local configuration of the device obtains the first information.

In one embodiment, the first communication interface 71 is also used for:

Send a first request to the second application or the second device; the first request is used to query a second KM that provides services for the second application or the second device; and receive the returned query result.

In one embodiment, the first communication interface 71 is also used for:

When the first application or the first device accesses the quantum network for the first time, or when the KM that provides services for the first application or the first device changes, a third device is sent to the third device. Two requests; wherein the second request also carries third information; the third information is used to indicate the first KM that provides services for the first application or the first device.

In one embodiment, the first processor 72 is also configured to provide security protection for the following content and transmit: first information, second information, third information, first request and response result, second request and Response results.

In one embodiment, the first information further includes: the identification and/or address of the second application/the second device; the first information is also used for the first KM to transfer the The identity and/or address of the second application/second device is forwarded to the second KM for use by the second KM to determine the second application/second device to receive the quantum key. It should be noted that the specific processing procedures of the first processor 72 and the first communication interface 71 can be understood with reference to the above method.

Of course, in actual application, various components in the electronic device 7 are coupled together through the bus system 74 . It can be appreciated that the bus system 74 is used to implement connection communications between these components. In addition to the data bus, the bus system 74 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the various buses are labeled bus system 74 in FIG. 7 .

The first memory 73 in the embodiment of the present disclosure is used to store various types of data to support the operation of the electronic device 7 . Examples of such data include any computer program used to operate on the electronic device 7 .

The methods disclosed in the above embodiments of the present disclosure can be applied to the first processor 72, or Implemented by the first processor 72 . The first processor 72 may be an integrated circuit chip having signal processing capabilities. During the implementation process, each step of the above method can be completed by instructions in the form of hardware integrated logic circuits or software in the first processor 72 . The above-mentioned first processor 72 may be a general processor, a digital signal processor (Digital Signal Processor, DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 72 can implement or execute the disclosed methods, steps and logical block diagrams in the embodiments of the present disclosure. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly implemented by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 73. The first processor 72 reads the information in the first memory 73, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the electronic device 7 may be configured by one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC), DSP, programmable logic device (Programmable Logic Device, PLD), complex programmable logic device (Complex Programmable Logic Device (CPLD), Field-Programmable Gate Array (FPGA), general-purpose processor, controller, microcontroller (Micro Controller Unit, MCU), microprocessor (Microprocessor), or other electronic Component implementation, used to execute the aforementioned methods.

It can be understood that the memory (first memory 73) in the embodiment of the present disclosure may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory can be read-only memory (Read Only Memory, ROM), programmable read-only memory (Programmable Read-Only Memory, PROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory). , EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Random Access Memory (Ferromagnetic Random Access Memory, FRAM), Flash Memory, Magnetic Surface Memory , optical disk, or compact disc (Compact Disc Read-Only Memory, CD-ROM); the magnetic surface memory can be a magnetic disk memory or a magnetic tape memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of illustration but not limitation It has been shown that many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (Dynamic Random Access Memory, DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced Synchronous Dynamic Random Access Memory, ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), Direct Rambus Random Access Memory (DRRAM). Memories described in embodiments of the present disclosure are intended to include, but are not limited to, these and any other suitable types of memory.

In an exemplary embodiment, the embodiment of the present disclosure also provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, such as a first memory 73 that stores a computer program. The computer program can be stored in an electronic device 7 The first processor 72 executes to complete the steps described in the foregoing first terminal side method. The computer-readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM and other memories.

It should be noted that "first", "second", etc. are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

The term "and/or" in this article is just an association relationship that describes related objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and they exist alone. B these three situations. In addition, the term "at least one" in this article means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C, which can mean including from A, Any one or more elements selected from the set composed of B and C.

In addition, the technical solutions described in the embodiments of the present disclosure may be combined arbitrarily as long as there is no conflict.

The above descriptions are only preferred embodiments of the present disclosure and are not intended to limit the scope of the present disclosure.

Claims

A quantum network communication method, applied to a first application or a first device, the method includes:

First information is sent to the first quantum key manager KM; the first information is used to indicate a second KM that provides services for the second application or the second device.
The method of claim 1, further comprising:

The first information is determined according to the corresponding relationship between the application and the KM.
The method according to claim 2, wherein the first information is the identification and/or address of the second KM.
The method according to claim 2, wherein the corresponding relationship between the application and the KM is at least one of the following:

The correspondence between the application identifier and the KM identifier;

The correspondence between the application identifier and the KM address;

The correspondence between the application address and the KM address;

The correspondence between the application address and the KM identifier.
The method according to any one of claims 1 to 4, wherein before sending the first information to the first KM, the method further includes:

The first information is obtained from the first application or a local configuration of the first device.
The method according to any one of claims 1 to 4, wherein before sending the first information to the first KM, the method further includes:

Send a first request to the second application or the second device; the first request is used to query a second KM that provides services for the second application or the second device;

Receive the returned query results.
The method of claim 6, wherein

The second device includes an application layer device or a user network management layer device in a quantum secure communication network;

And/or, the second application is a password application.
The method according to claim 6, wherein the first request also carries second information; The second information is used to indicate a first KM that provides services for the first application or the first device.
The method according to any one of claims 1 to 4, further comprising:

When the first application or the first device accesses the quantum network for the first time, or when the KM that provides services for the first application or the first device changes, send a second request to the third device. ;

Wherein, the second request also carries third information; the third information is used to indicate the first KM that provides services for the first application or the first device.
The method according to any one of claims 1 to 4, further comprising:

The following content is securely protected and transmitted: first information, second information, third information, first request and response result, second request and response result.
The method according to claim 2 or 3, wherein the first information further includes:

The identification and/or address of the second application/the second device;

The first information is also used for the first KM to forward the identification and/or address of the second application/the second device to the second KM for the second KM to determine The second application/second device to receive the quantum key.
A quantum network communication device, including:

The first sending unit is configured to send first information to the first KM; wherein the first information is used to indicate the second KM that provides services for the second application or the second device.
An electronic device includes a first processor and a first communication interface, wherein the first communication interface is used to send first information to a first KM; wherein the first information is used to indicate a second application Or a second KM served by a second device.
An electronic device including: a first processor and a first memory for storing a computer program capable of running on the first processor,

Wherein, the first processor is configured to perform the steps of the method according to any one of claims 1 to 11 when running the computer program.
A storage medium having a computer program stored thereon, wherein the steps of the method according to any one of claims 1 to 11 are implemented when the computer program is executed by a processor.