Conceptio › Archive › Google Patents

Google Patentsopen access

Quantum key distribution system, method and apparatus based on trusted relay — Alibaba Group Holding Limited (US10348493B2)

Alibaba Group Holding Limited · Google Patents

Google Patents · Patents · License: Open Access

Open Source ↗

alibabagroupholdinglimited yingfangfu

patent, google patents, intellectual property, US10348493B2, Alibaba Group Holding Limited, Yingfang Fu, en, 2019

ABSTRACT

Abstract

A quantum key distribution system is provided. The quantum key distribution system includes a plurality of routing devices configured to relay keys and a quantum key distribution device connected with the routing devices and configured to use two or more different paths to perform corresponding quantum key negotiations with another quantum key distribution device to obtain shared keys. The two or more different paths each include one or more of the routing devices.

Description

CROSS-REFERENCE TO RELATED APPLICATION

The present application is based on and claims the benefits of priority to Chinese Application No. 201510009615.5, filed Jan. 8, 2015, the entire contents of which are incorporated herein by reference.

TECHNICAL FIELD

The present application relates to the field of quantum key distribution, specifically to a quantum key distribution system based on trusted relays. The present application also provides a quantum key distribution method based on trusted relays and a quantum key distribution apparatus based on trusted relays.

BACKGROUND

Quantum cryptography is a cross product of quantum mechanics and cryptography. The security of quantum cryptography is guaranteed by quantum mechanics principles. An operation with an attempt of intercepting or measuring the quantum key will change the quantum state. A receiving end may determine whether there is an eavesdropper in the communication process by detecting the change of quantum state so as to determine whether to abandon the key, thus providing guarantee of unconditional security to the communication. The quantum key negotiation protocols such as BB84, which is currently used, may realize an end-to-end Quantum Key Distribution (QKD).

With the development of end-to-end quantum key distribution technology, people begins to pay more attention to the QKD network, and some companies and research institutions have started to establish the QKD network in different mechanisms, including: the QKD network based on optical devices, the QKD network based on trusted relays, and a pure-quantum network based on quantum relays. The QKD network based on trusted relays may meet the requirements of multi-user and long-range transmission, and may even provide a global key distribution network theoretically. Under current technology, this network is easy to be implemented, and therefore, the trusted relay mechanism becomes an effective means for realizing a large-scale QKD network architecture. For example, the SECOQC quantum secured communication network established in Europe, the Tokyo high-speed quantum network established in Japan, and the quantum government affairs network established in China all use the trusted relay mechanism.

FIG. 1 shows a schematic diagram of a trusted relay quantum key transmission model, under which Alice and Bob can have a secured communication. There are three trusted relay nodes altogether in a key negotiation path between the two. First, a key distribution link is established between the sender Alice and a trusted relay node 1 for performing quantum key negotiation to generate a key K 1 ; subsequently, a key distribution link is established between the trusted relay node 1 and a trusted relay node 2 for performing quantum key negotiation to generate a shared key K 2 , and key K 1 is encrypted by using key K 2 and then transferred to the trusted relay node 2 ; . . . and so on, finally, Bob receives key K 1 encrypted by using a key K 4 , and Bob decrypts key K 1 by utilizing key K 4 to obtain key K 1 , so that the secured communication can be performed between Alice and Bob by using key K 1 .

As can be seen from the above description of the key relay process, a QKD network based on trusted relay requires that the relay nodes must be secure. If any one of the relay nodes is broken, the whole path will become insecure, and the security and stability of data communication will be greatly affected. By adopting the above key relay mechanism, the key code generating amount (i.e.: key distribution amount) is also relatively low, and cannot meet the requirements of certain application scenarios (such as cloud computing), which use relatively large key amount.

SUMMARY

One aspect of the present disclosure is directed to a quantum key distribution system. Consistent with some embodiments, the quantum key distribution system includes a plurality of routing devices configured to relay keys, and a quantum key distribution device connected with the routing devices and configured to use two or more different paths to perform corresponding quantum key negotiations with another quantum key distribution device to obtain shared keys. The two or more different paths each include one or more of the routing devices. According to one embodiment, the two or more different paths do not share any common routing device. The two or more different paths may be selected according to load balancing of the routing devices.

Consistent with some embodiments, the quantum key distribution device may be further configured to combine the shared keys to generate a new shared key. In one embodiment, the quantum key distribution device may be further configured to send, before initiating the corresponding quantum key negotiations, path information about the quantum key negotiations to a routing device in the path and to the another quantum key distribution device. According to another embodiment, the quantum key distribution device is connected to at least two of the routing devices.

According to some embodiments, the quantum key distribution device may be further configured to encrypt and decrypt data. The quantum key distribution system may further include a quantum gateway device through which the quantum key distribution device is connected to a data device, and the quantum gateway device is configured to encrypt and decrypt data by using a quantum key provided by the quantum key distribution device.

The quantum key distribution device may use wavelength division multiplexing and/or time division multiplexing to perform the key negotiations.

The routing device may use at least one of optical bifurcation multiplexing, optical cross interconnection, or optical packet switching, to forward data encrypted with the quantum key. The quantum key distribution system may be deployed in a cloud computing data center. The quantum key distribution device may be connected to a server in the cloud computing data center.

Another aspect of the present disclosure is directed to a quantum key distribution method. Consistent with some embodiments, the method may include selecting two or more paths each including one or more routing devices, the one or more routing devices connecting a quantum key distribution device with another quantum key distribution device, and performing key negotiations by the quantum key distribution device with the another quantum key distribution device through the two or more different paths to obtain shared keys. In some embodiments, the two or more different paths do not share any common routing device. In some other embodiments, the selecting the two or more paths may be based on a hop-by-hop dynamic routing mechanism. In some further embodiments, the two or more different paths are selected according to load balancing of the routing devices.

The quantum key distribution method may further include combining the shared keys to generate a new shared key. Before combining the shared keys, the method may further include acquiring, by the quantum key distribution device, a safety assessment result of performing key negotiation via each of the two or more paths, and determining whether the combining the shared keys is needed based on the safety assessment result. If the combining the shared keys is needed, the quantum key distribution device may select a key combination operation, communicate the selected key combination operation through a classical channel to the another quantum key distribution device. The quantum key distribution device and the another quantum key distribution device combine the shared keys with the key combination operation.

The quantum key distribution method may further include sending, by the quantum key distribution device, through a classical channel, path information of each selected path to the routing devices in the selected path. The routing devices may verify an identity of the quantum key distribution device using the path information. The quantum key distribution device may also send, through a classical channel, path information of each selected path to the another quantum key distribution device, and the another quantum key distribution device verifies an identity of the quantum key distribution device using the path information.

Consistent with some other embodiments, the quantum key distribution method may further include verifying, by the quantum key distribution device, an identity of the another quantum key distribution device through a classical channel. The quantum key distribution device may use an obtained shared key to encrypt data to be transmitted. The quantum key distribution device may forward the encrypted data to the another quantum key distribution device. The another quantum key distribution device may use a copy of the obtained shared key to decrypt the received data.

A further aspect of the present disclosure is directed to a quantum key distribution device. The quantum key distribution device may include a multi-path negotiation unit configured to perform key negotiations with another quantum key distribution device through two or more different paths. In some embodiments, the two or more different paths each include one or more routing devices and the two or more different paths do not share any common routing device. The device may further include a combination determination unit configured to determine whether a combination operation is required to be performed on shared keys obtained through the key negotiations, and a combination unit configured to, if the combination operation is required to be performed on the shared keys obtained through the key negotiation process, combine the shared keys to generate a new shared key. The device may further include a path acquisition unit configured to select the two or more different paths through which the key negotiations are performed with the another quantum key distribution device according to topology information about a quantum key distribution system including the quantum key distribution device.

Additional features and advantages of the present disclosure will be set forth in part in the following detailed description, and in part will be obvious from the description, or may be learned by practice of the present disclosure. The features and advantages of the present disclosure will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a quantum key transmission model based on trusted relays in the prior art;

FIG. 2 is a schematic diagram of a quantum key distribution system based on trusted relays of one embodiment of the present disclosure;

FIG. 3 is a schematic diagram of a system architecture of a cloud user access data center according to one embodiment of the present disclosure;

FIG. 4 is a schematic diagram of system architectures of a distributed data center and a cloud user access distributed data center according to one embodiment of the present disclosure;

FIG. 5 is a flow chart of a quantum key distribution method based on trusted relays according to one embodiment of the present disclosure;

FIG. 6 is a processing flow chart of adopting multiple paths for performing key negotiations according to one embodiment of the present disclosure; and

FIG. 7 is a schematic diagram of a quantum key distribution device based on trusted relays according to one embodiment of the present disclosure.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Reference will now be made in detail to exemplary embodiments, examples of which are illustrated in the accompanying drawings. The following description refers to the accompanying drawings in which the same numbers in different drawings represent the same or similar elements unless otherwise represented. The implementations set forth in the following description of exemplary embodiments do not represent all implementations consistent with the invention. Instead, they are merely examples of apparatuses and methods consistent with aspects related to the invention as recited in the appended claims.

The present disclosure provides a quantum key distribution system based on trusted relays, a quantum key distribution method based on trusted relays, and a corresponding apparatus. The detailed description will be made in the following embodiments.

FIG. 2 shows a schematic diagram of a quantum key distribution system based on trusted relays according to one embodiment of the present disclosure. The quantum key distribution system comprises: quantum key distribution devices, routing devices for relaying a key and forwarding encrypted data, and data devices for data transmission at source ends or destination ends. Each of the quantum key distribution devices may be connected to at least one of the routing devices and at least one of the data devices. The routing devices are connected to each other, with the sender quantum and/or the receiver quantum distribution device to form a network (topology). The quantum key distribution device uses two or more different paths to perform corresponding key negotiations with an opposite-end (i.e. another) quantum key distribution device, and uses a preset strategy to determine whether shared keys obtained by the negotiations need to be combined, and executes a corresponding combination operation when necessary. The âopposite-endâ may define a relationship between a sender and a receiver. For example, an opposite-end quantum key distribution device of a quantum key distribution receiver device may be a quantum key distribution sender device. The two or more different paths may each include one or more of the routing devices and may not share any common routing device.

The existing quantum key distribution network based on trusted relays cannot guarantee the security of a key if relay node is broken on the one hand, and also has a relatively low key distribution amount on the other hand. According to some embodiments of the present disclosure, based on that the routing devices are connected to each other to form a network topology, a quantum key distribution device can use two or more different paths to perform key negotiations with the opposite-end quantum key distribution device. The two or more two different paths according to the embodiments of the present disclosure mean that the routing devices contained in any two paths are not all the same.

According to some embodiments, different paths for performing quantum key negotiations may be selected by using a static routing (also referred to as designated routing). The quantum key distribution device may maintain topology information about the whole network through mechanisms, such as network flooding. Before initiating a quantum key negotiation process, the quantum key distribution device may implement a load balancing strategy, considering load conditions of routing devices and occupation conditions of links in the network topology. The routing devices and links which are relatively idle are selected to form two or more different paths. Each routing device to which each path connects performs key negotiation and relaying along the path. Alternatively, a dynamic routing mechanism may be used. The quantum key distribution device and the routing device use a hop-by-hop dynamic routing mechanism, and according to routing table information which is locally stored and based on strategies, such as load balancing, choose next-hop routing to reach an opposite-end quantum key distribution device.

In so

CROSS-REFERENCE TO RELATED APPLICATION

TECHNICAL FIELD

BACKGROUND

SUMMARY

The quantum key distribution device may use wavelength division multiplexing and/or time division multiplexing to perform the key negotiations.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not restrictive of the invention, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a quantum key transmission model based on trusted relays in the prior art;

FIG. 2 is a schematic diagram of a quantum key distribution system based on trusted relays of one embodiment of the present disclosure;

FIG. 3 is a schematic diagram of a system architecture of a cloud user access data center according to one embodiment of the present disclosure;

FIG. 4 is a schematic diagram of system architectures of a distributed data center and a cloud user access distributed data center according to one embodiment of the present disclosure;

FIG. 5 is a flow chart of a quantum key distribution method based on trusted relays according to one embodiment of the present disclosure;

FIG. 6 is a processing flow chart of adopting multiple paths for performing key negotiations according to one embodiment of the present disclosure; and

FIG. 7 is a schematic diagram of a quantum key distribution device based on trusted relays according to one embodiment of the present disclosure.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In some other embodiments, each quantum key distribution device is connected to at least two routing devices. Since the routing devices are connected to each other by using the network topology, the quantum key distribution device may use multiple paths which are completely unrelated when performing key negotiation. In some embodiments, neither of any two paths therein has a common routing device.

As shown in FIG. 2 , secured data transmission is performed between a data device A and a data device B, and a quantum key distribution device A 1 uses a path 1 and a path 2 to perform key negotiations with an opposite-end quantum key distribution device B 1 . The path 1 includes routing devices R 1 , R 2 and R 3 , and the path 2 includes routing devices R 4 and R 5 . Since the path 1 and the path 2 do not include the same routing device, they are two separate paths.

The quantum key distribution device uses two or more different paths to perform key negotiations with the opposite-end quantum key distribution device. In each path, every two neighboring devices use a QKD link therebetween to acquire a shared key between the two through phases, such as key transmission, data screening, data coordinating and privacy amplification, and uses the shared key on a section-by-section basis to perform âencryption-decryption-encryption . . . decryptionâ relaying forwarding operations on a shared key acquired by a sender quantum key distribution device, and finally, a receiver quantum key distribution device and the sender quantum key distribution device acquire the same shared key. Since multipath negotiation is used, both receiver and sender may acquire multiple shared keys. For example, in the example shown in FIG. 2 , the quantum key distribution device A 1 and the quantum key distribution device B 1 acquire two shared keys key 1 and key 2 through key negotiation processes on two paths.

With regard to the acquired two or more shared keys, the quantum key negotiation devices of the receiver and the sender may use a preset strategy to determine whether the shared key obtained through the negotiation processes need to be combined, and a corresponding combination operation is performed when needed.

The preset strategy includes determining whether a key combination operation is required from the safety perspective according to a bit error rate and/or risk probability during the key negotiation process. During the key negotiation process by means of relaying, each two adjacent devices may estimate bit error rate of the key negotiation and may further calculate risk probabilities of various potential attacks (such as amplified light blindness attack, beam splitting attack, dead-time attack, and the like), and may gather the bit error rate estimate values and/or risk probabilities for each section of a relay link of each path. If the above data of a certain path exceeds a preset safety range, it may be considered that the key negotiation of the path has the risk of being attacked, and the relay node (i.e., the routing device described in the present embodiment) also has safety risk of being broken. In this case, combination of the shared keys obtained through negotiation can be performed to lower the risk resulted from breaking a relay node and enhance the safety of quantum key distribution.

The described combination of the shared keys obtained through the key negotiation process refers to a process for processing a plurality of shared keys obtained through multipath negotiation and generating a new key by using a preset algorithm. For example, an XOR operation may be performed on the plurality of shared keys, or the XOR operation may be performed after a shift operation, etc. A person having ordinary skill in the art should appreciate that many other combination algorithms can be used.

For example, in the example shown in FIG. 2 , the quantum key distribution devices A 1 and B 1 obtain a shared key 1 through the negotiation of the path 1 and a shared key 2 through the negotiation of the path 2 , and calculate an indicator value characterizing the safety of the key negotiation process after gathering the bit error rate estimate values and risk probabilities for each section of the relay link in the path 1 . The indicator value exceeding the preset safety range illustrates that the key negotiation process via path 1 may be attacked, and safety risk exists for each relay node. If the corresponding indicator value of path 2 does not exceed the safety range, the quantum key distribution devices A 1 and B 1 can perform combination operation on key 1 and key 2 by using the preset XOR algorithm and generate a new key 3 . That is, key 3 = key 1 xor key 2 , and use the key 3 to perform encryption and decryption on data transmitted between the data device A and the data device B.

In the above example, if the safety indicator values do not exceed the preset safety range, which means that the key negotiation process based on path 1 and path 2 are safe and each relay node is also safe, the key combination operation may not be performed. The quantum key distribution devices A 1 and B 1 have obtained two share keys through the negotiation and can use the two keys for the secured communication between the data devices A and B.

As can be seen from the above analysis, for the quantum key distribution system provided by the embodiments of the present disclosure, under the application scenarios with relatively high network security, as multiple paths are used for key negotiation, the key distribution amount is increased by improving the utilization rate of the routing devices and links. Under the application scenarios with relatively low network security, even if the relay nodes of a certain path or a plurality of paths are broken, and the corresponding key obtained through negotiation is no longer safe, a new shared key still can be generated by performing the combination operation on keys of different paths as long as one of the paths is secure (i.e., all the relay nodes are not attacked), so that the potential safety hazard that some relay nodes are attacked can be cured, improving the security of the whole quantum key distribution network.

A person having ordinary skill in the art should appreciate that the above-described are exemplary embodiments, and modification or adjustment can be made in specific implementations. For example, instead of gathering the bit error rate and risk probability of each relay link, the bit error rate and risk probability of certain links are gathered and used to calculate the indicator value. The bit error rate and/or risk probability may also not be used as a security evaluation parameter, but other indexes, such as indexes obtained through monitoring the security of the relay nodes are used. The strategy of how to determine whether combination is needed according to the evaluation parameter or indexes can also be adjusted according to practical application needs. The specific combination algorithm can also be different from the above example. The above are all modifications of the embodiments of the present disclosure, without departing from the core of the present disclosure, and all fall within the scope of protection of the present disclosure.

Furthermore, for possible attacks from man-in-the-middle (attacks by means of interception and retransmission by a man-in-the-middle) in a quantum key negotiation process, the present disclosure also provides a path validation technology. For example, in some embodiments, before the quantum key distribution devices of the receiver and sender perform the corresponding key negotiations, the quantum key distribution device that initiates quantum key negotiation sends the path information about the key negotiations to various routing nodes included in the path and the quantum key distribution device of the receiver through classical channels. As each path consists of section by section relay links, the path information includes the node information of each section of a link in the path, and therefore, it is also referred to as path link information.

The routing device and the quantum key distribution device of the receiver store the received path link information, and in a subsequent quantum key negotiation process, verify, according to the path link information, the identity legality of (i.e. authenticate) the routing device or quantum key distribution device that performs key negotiation therewith. If the identify is inconsistent with the path link information, it shows that the man-in-the-middle attack may be present, and then this quantum key negotiation process may be quitted, and other paths may be reselected for quantum key negotiation.

Generally, the embodiments described above are used in conjunction with the static routing mechanism. Before starting the quantum key negotiation process, the initiator of quantum key negotiation process can acquire the complete path link information of this negotiation, and thus can send the path link information to the devices in the path in advance.

If the dynamic routing mechanism is used, a path link verification function similar to the above can also be realized by providing a monitoring node inside the network. For example, the monitoring node can obtain information about each relay node in the path where the negotiation process passes through by monitoring the key negotiation process, and identify whether there is an abnormal intermediate node through performing an analysis on the information, so as to determine whether there are attacks from the man-in-the-middle. If there are attacks from man-in-the-middle, the shared key obtained in the key negotiation process is given up.

The legality of the identity of each node in the quantum key negotiation process can be verified by using the path link verification technology, avoiding the man-in-the-middle attack and further ensuring security of the quantum key negotiation process.

Based on the multipath key negotiation described above and according to some embodiments, Wavelength Division Multiplex (WDM) technology is used to realize key negotiation among multiple quantum channels. The WDM technology divides the low loss window of optical fiber into several channels according to the difference of optical frequencies (or wavelengths) of each channel in order to make full use of the huge bandwidth resources in low-loss region of single-mode fiber. Respective information is transmitted with the different wavelengths, and does not interfere with each other even on the same fiber, so as to increase a communication capacity of optical fiber.

In this embodiment, different optical wavelength negotiation keys can be used at the same time in any path that performs multipath key negotiation when quantum key negotiation is performed between the quantum key distribution device and the routing device as the relay node and between the routing devices.

Similarly, the time division multiplexing technology can also be adopted in the above key negotiation process to achieve the object of multi-channel transmission and improve the dispensed amount of key. The time-division multiplex technology includes adopting different periods of the same physical connection to transmit different signals. Both the wavelength-division multiplexing and the time division multiplexing are mature technologies, and will not be repeated herein.

In some embodiments, the quantum key distribution device can also be used for performing encryption and decryption on the data transmitted between data devices, in addition to possessing the function of multipath key negotiation. In the example shown in FIG. 2 , the quantum key distribution device A 1 uses a shared key obtained through negotiation with B 1 , and encrypts the data transmitted by the data device A; the encrypted data is forwarded to the quantum key distribution device B 1 by each routing device, B 1 also adopts the shared key obtained through negotiation with A 1 to decrypt the received data, then the decrypted data is sent to the data device B, so as to complete the secret communication between the data device A and the data device B.

In some other embodiments, the function of encrypting and decrypting the data can be taken away from the quantum key distribution device, and be completed by the quantum gateway. In other words, the quantum key distribution system described above can further comprise a quantum gateway device, and the quantum key distribution device can be connected with data devices through the quantum gateway device. The quantum key distribution device is responsible for performing the multipath key negotiation, and providing the quantum key obtained through negotiation to the quantum gateway device connected thereto, and the quantum gateway device then adopts the quantum key to perform encryption and decryption on the data transmitted between the data devices.

In one embodiment, one of the two kinds of encryption and decryption modes described above can be selected according to actual needs. The encrypted data is forwarded via the routing device, finally arrives at the opposite-end quantum key distribution device, and after being decrypted, is sent to the data device at the destination end in this data transmission. In the process that the routing device forwards encrypted data, one or more of OADM, optical bifurcation multiplexing, optical cross connecting, and optical packet switching can be used. The dispensed amount of key can be improved because of adopting the multipath key negotiation mode, and therefore, the capacity of encrypted data transmission can also be effectively improved. The above-mentioned optical transmission technology can include the following:

1) optical add/drop multiplex (OADM) is for inserting or separating the optical signals from a wavelength division multiplexing transmission link by an optical filter or demultiplexer. The WDM system selects the optical wavelength signal having desired upper/lower rate, form and protocol type, that is: only the desired wavelength signals are branched/inserted on a node, and other wavelength signals are then passed through this node in an optically transparent way;

2) the optically cross interconnection, used for the device of fiber optic network nodes, can efficiently and flexibly manage optical fiber transmission network by performing cross connection on the optical signals, and it is an important means to realize reliable network protection/recovery and automatic wiring and monitoring; and

3) the optical packet switching including all-optical packet switching can be classified into two categories: timeslot and non-timeslot. In the timeslot network, the packet length is fixed, and transmits in the timeslot. The length of timeslot should be greater than the time limit of the packet so as to set protection intervals in the front and back of the packet. In a non-timeslot network, the size of packet is variable, and before switching, arrangement is not required, each packet is switched asynchronously and freely.

In one embodiment, in the process of performing the key negotiation or data encrypting and deciphering interaction, the quantum key distribution system can comprehensively use wavelength-division multiplexing, time division multiplexing, and the above-mentioned optical transmission technologies to achieve the multipath key negotiation, improving key distribution amount and data interactive throughput.

In some embodiments described above, by employing multipath key negotiation mechanisms, the system can obtain the beneficial effects of improving key distribution amount and improving key distribution safety.

In some embodiments, in the cloud computing environment, data interaction between each server of the cloud backbone network, the remote backup and interaction of data in each data center of the cloud network, and cloud user accessing cloud resource all demand key security. The encryption method in a classic network cannot provide a reliable security, and existing various miniature quantum key distribution networks cannot meet the requirements of cloud key security distribution, either. The requirements may be based on, for example, the throughput and code-forming amount of quantum key distribution network, the transmission distance of keys, multi-user participation, and ensuring that any user can communicate with the cloud backbone network and for convergence with existing public network.

In some embodiments, based on the above-mentioned consideration, the quantum key distribution system based on trusted relay can be applied to the cloud network architecture, thereby solving the above-mentioned problem. The three aspects are described below according to some embodiments: the cloud backbone network (data center), cloud user accessing data center, and distributed data center.

(I) Cloud Backbone System Architecture.

A cloud backbone network of the cloud operator (i.e., the data center), may include various server clusters, such as file server cluster, Web server cluster, application server cluster, management server cluster, and list server cluster. Each cluster comprises several servers, with a large data volume transmitting among themselves, and have high demand for the key distributing amount and data transmission among the whole network.

The quantum key distribution system based on trusted relay according to one embodiment is deployed in the above-mentioned cloud computing data center, and the data devices for data transmission at the source ends or destination ends are the above-mentioned various servers. The plurality of servers connected with each quantum key distribution device can be the servers with identical function (such as file servers), also can be servers with different functions from each other (such as web server and management server etc.).

In some embodiments, the existing cloud computing data center may adopt a three-tier architecture, and the quantum key distribution system provided by the present embodiment may adopt a flat architecture based on the routing device. In order to realize smooth transition between the existing three-tier architecture and the flat architecture, and to extend the limited port number of the quantum key distribution device to realize the access of more servers, an optical switch can be introduced in the data center network architecture. A routing device can be connected with one or more optical switches, and an optical switch is connected with one or more quantum key distribution devices.

In some embodiments, the quantum key distribution system provided by the present embodiment is deployed in the cloud computing data center. In order to realize the secret communication between data center servers, the quantum key distribution device connected with the server adopts two or more paths to perform key negotiation, and adopts the preset strategy to perform the desired combination operation of the key. In addition, the path link verification, wavelength-division multiplexing, time division multiplexing and other optical transport technologies, described above can be applied to the data center for achieving the object of improving key distribution amount, data interactive throughput, and improving key distribution procedure security, thereby meeting the requirements of the cloud computing data center.

(II) The System Architecture for Cloud User Accessing Data Center.

The quantum key distribution system may also comprise: a cloud user network having a quantum key distribution device. The quantum key distribution device of the cloud user network is connected to two or more quantum key distribution devices of the cloud computing data center.

FIG. 3 shows a schematic diagram of the system architecture for cloud user accessing data center provided by an embodiment of the present disclosure. In this example, a cloud computing data center and two cloud user networks (network A and network B) are included. The cloud user network A uses its quantum key distribution device to connect with three quantum key distribution devices of the cloud computing data center by an incoming optical fiber. The cloud user network B uses its quantum key distribution device to connect with two quantum key distribution devices of the cloud computing data center by an incoming optical fiber. Cloud user network generally also comprises an internal gateway and multiple terminal devices for accessing the cloud computing data center, which is not illustrated in this schematic diagram.

In some embodiments, the quantum key distribution device of the cloud user network can use two or more different paths to perform key negotiation with an opposite-end quantum key distribution device of the cloud computing data center, determine whether a shared key obtained by the negotiation needs to be combined using the preset strategy, and execute a corresponding combination operation when necessary. By a multipath negotiation mechanism, the security of quantum key distribution process and the distribution amount of the quantum key are increased. In the process of key negotiation in any of the paths, the quantum key distribution device of the cloud user network can realize the key negotiation of a multiple-quantum channel by the wavelength-division multiplexing technology and/or time-division multiplexing technology, to further improve the key distribution amount. In addition, the path link verification, OADM technology, and the optical cross interconnection technology, optical packet switching technology described above also can be applied to the system architecture for cloud user accessing data center to improve the key distribution amount and the data interactive throughput.

In one embodiment, based on business needs, the cloud user network can provide two or more quantum key distribution devices, and each quantum key distribution device is connected with the two or more quantum key distribution devices of the cloud computing data center.

(III) System Architecture of Distributed Data Center.

In some embodiments, cloud service providers offer business service to the cloud users through the data center, and generally perform data backup by using a backup data center. Alternatively, the cloud providers adopt dual-active data center to provide business service to the cloud users. In addition, with the development of cloud computing technology, the cloud providers providing a single data center may not be able meet the requirements of cloud users. Multiple data centers usually set up in different areas. Under the above-mentioned distributed architecture based on many data centers, the requirement of distributed cloud computing to key distribution amount and key security can be met by disposing the quantum key distribution network.

For example, the quantum key distribution system is respectively deployed in multiple data centers of a distributed cloud computing network, the data device can be a server of each data center, and the multiple data centers are connected through the quantum key distribution device to form a network topology.

FIG. 4 shows a schematic diagram for a system architecture of the distributed data center and the cloud user accessing data center according to some embodiments. In one example, four dual-active data centers of cloud supplier are connected through the quantum key distribution device to form a network topology. When data backup or data transmission is performed on the four data centers, the quantum key distribution device of the data center as the source end can perform key negotiation with the opposite-end quantum key distribution device positioned in different data centers by adopting two or more different paths, determine whether a shared key obtained by the negotiation needs to be combined by adopting the preset strategy, and execute a corresponding combination operation when necessary. The security of quantum key distribution process and the distribution amount of the quantum key are improved by a multipath agreement mechanism. Furthermore, in some embodiments, the system also comprises a cloud user network with quantum key distribution devices, which is connected to the quantum key distribution device of two or more data centers through the quantum key distribution device thereof.

In the example described above, two cloud user networks, i.e., network A and network B, are connected with the quantum key distribution devices of two data center respectively through fibers. Cloud user network usually may also comprise an internal gateway and multiple terminal devices for accessing the cloud computing data center, which is not illustrated in this schematic diagram. The quantum key distribution device of the cloud user network can perform key negotiation with an opposite-end quantum key distribution device of the data center by adopting two or more different paths, and determine whether a shared key obtained through the negotiation needs to be combined by adopting the preset strategy and executing a corresponding combination operation when necessary. The security of quantum key distribution process and the distribution amount of the quantum key are increased by the multipath agreement mechanism. In the process of key negotiation in any of the paths, the quantum key distribution device of the cloud user network can realize the key negotiation of a multiple-quantum channel by the wavelength-division multiplexing technology and/or time-division multiplexing technology, to further improve the key distribution amount. In addition, in some examples, the path link verification, OADM technology, the optical cross-interconnection technology, and the optical packet switching technology can also be applied to the system architectures of a distributed cloud computing data center and a cloud user accessing data center so as to improve the key distribution amount and the data interactive throughput.

The quantum key distribution system based on trusted relays can implement a corresponding quantum key distribution method. FIG. 5 shows a flow chart of a quantum key distribution method 500 based on trusted relays, consistent with some embodiments of the present disclosure.

The method comprises:

Step 501 : a sender quantum key distribution device uses two or more different path to perform corresponding key negotiations with a receiver quantum key distribution device. The two or more different paths each include one or more routing devices configured to relay keys.

Performing multipath quantum key negotiation can improve the code-forming amount of the quantum keys and can fend off attacks to the relaying node (i.e., the routing device). In order to further improve the security of quantum key negotiation process, in one embodiment, both the receiver and sender perform identity verification and verify the key negotiation path, and the present step is further described below with reference to FIG. 6 .

Step 501 - 1 : the sender and receiver quantum key distribution devices perform identity verification on a partner device through a classical channel.

For example, the sender quantum key distribution device (referred to as an A device) first sends a key negotiation request to a receiver quantum key distribution device (referred to as a B device) through a classical channel. The request at least contains identity information about the A device (for example, account information). The request is forwarded to the B device by several routing devices, and the B device verifies the legality of the identity of the A device carried in the request. If the identity is legal, a response is sent to the A device, and at the same time, the identity information about the B device may be carried in the response. Similarly, the A device verifies the identity of the B device after receiving the response. If both the A device and the B device recognize each other being legal (i.e. authenticated) after the above-mentioned verification process, the following processing can be continued, otherwise the present method is completed.

In some embodiments, other identity verification mechanisms can be used, such as the mechanism of using a digital certificate, as long as it can confirm whether the identity of the opposite-end quantum key distribution device which performs quantum key negotiation with is legal.

Step 501 - 2 : the sender quantum key distribution device selects two or more different paths performing key negotiation with the receiver quantum key distribution device according to the topology information of a quantum key distribution system.

The sender quantum key distribution device may select two or more different paths according to the network topology information obtained in advance. The routing devices involved in any two paths may be different routing devices. The different paths may not share any common routing device. When the sender quantum key distribution device chooses a routing path, the sender quantum key distribution device can use a load balancing strategy.

Step 501 - 3 : the sender quantum key distribution device sends each piece of path information to the one or more routing devices in the path and the receiver quantum key distribution device through the classical channel.

The relevant information of each node in path may be contained in the path information, and after routing, the sender quantum key distribution device can send the path information of each path to the routing device in the path and the receiver quantum key distribution device through the classical channel. These devices can verify other's identity in the process of relaying quantum key, as described below with reference to step 501 - 4 .

Step 501 - 4 : the quantum key negotiation device and routing device of both receiver and sender perform key negotiations through the two or more different paths, and perform path validation in this process.

In some embodiments, in order to meet the requirements of long-distance transmission, trusted relaying may be used. In each path, every two neighboring devices can obtain shared keys through the key negotiation process of a quantum channel, and realize the relay forwarding of key, and finally allow the quantum key distribution devices of both the receiver and sender obtain the same shared key. In one example, the shared keys between every two neighboring devices can be obtained by adopting the above-mentioned dynamic negotiation, and can also adopt the initial key preset during factory manufacture or the shared key pre-negotiated by both sides, which could likewise realize the above-mentioned relay function.

In some embodiments, the multiple paths performing key negotiation are generally selected by adopting the load-balancing mechanism, and may any common routing device. As a result, the routing device may only conduct the forwarding operation, may need to conduct a combination operation through various multiplexing means, or conduct respective splitting operation through corresponding de-multiplexing means, and finally complete the end-to-end quantum key negotiation process in multiple paths.

Furthermore, in order to prevent attacks from a man-in-the-middle, in some embodiments, a path verification technology can be used. Each routing device and receiver quantum key distribution device first performs verification on the identity of the neighboring device according to received path information, before performing key negotiation with a neighboring device and a corresponding relaying operation. If the verification succeeds, key negotiation is performed with the neighboring device and a key relaying operation of the present node is completed; otherwise, the sender quantum key distribution device is notified to quit the key negotiation process of a corresponding path.

In on example, dynamic routing also can be performed through a routing device based on a load balancing strategy so as to realize performing the key negotiation via two or more different paths. If a dynamic routing mechanism is used, path verification can be performed after completing the quantum key negotiation process, i.e., a sender or receiver quantum key distribution device or a monitoring node verifies the legality of the identity of each device participating in each path key negotiation process by collecting path information about the current key negotiation. If an illegal device (indicating that man-in-the-middle attack may be present) is detected, the sender and receiver quantum key distribution devices are notified to give up the shared keys acquired through the corresponding path negotiation. In addition, in order to fully fend off the attack on a relaying node, the paths used in the present step for performing end-to-end quantum key negotiation can be multiple paths which are completely unrelated, which means that the attack on any one relaying node only has influence on the security of a path and does not influence other paths.

Step 502 : the sender or receiver quantum key distribution device determines whether to combine shared keys acquired through the key negotiation process according to a preset strategy; if so, step 503 is performed.

The quantum key distribution devices of the receiver and sender generally can acquire multiple shared keys (being consistent with the path number) through the multipath negotiation process of step 501 , and it is determined whether a combination operation is requ

CLAIMS

Claims ( 29 )

What is claimed is:

1. A quantum key distribution system, comprising:

a plurality of routing devices configured to relay keys; and

a quantum key distribution device connected with the routing devices and configured to use two or more different paths to perform corresponding quantum key negotiations with another quantum key distribution device to obtain shared keys, wherein the two or more different paths each include one or more of the routing devices.

2. The quantum key distribution system according to claim 1 , wherein:

the quantum key distribution device is further configured to combine the shared keys to generate a new shared key.

3. The quantum key distribution system according to claim 1 , wherein:

the quantum key distribution device is further configured to send, before initiating the corresponding quantum key negotiations, path information about the quantum key negotiations to a routing device in the path or to the another quantum key distribution device.

4. The quantum key distribution system according to claim 1 , wherein:

the system further comprises a quantum gateway device through which the quantum key distribution device is connected to a data device; and

the quantum gateway device is configured to encrypt and decrypt data by using a quantum key provided by the quantum key distribution device.

5. The quantum key distribution system according to claim 1 , wherein:

the quantum key distribution system is deployed in a cloud computing data center; and

the system further includes a server connected to the quantum key distribution device.

6. The quantum key distribution system according to claim 5 , wherein the system further comprises a cloud user network including the another quantum key distribution device.

7. The quantum key distribution system according to claim 1 , wherein the quantum key distribution device is in a data center of a distributed cloud computing network.

8. The quantum key distribution system of claim 1 , wherein the two or more different paths involves a first path using a sequence of one or more of the routing devices different from a sequence of one or more of the routing devices utilized by other paths of the two or more different paths.

9. A quantum key distribution method, comprising:

selecting two or more paths each including one or more routing devices, the one or more routing devices connecting a quantum key distribution device with another quantum key distribution device; and

performing key negotiations by the quantum key distribution device with the another quantum key distribution device through the two or more different paths to obtain shared keys.

10. The quantum key distribution method according to claim 9 , further comprising:

combining the shared keys to generate a new shared key.

11. The quantum key distribution method according to claim 10 , wherein, before combining the shared keys, the method further comprises:

acquiring, by the quantum key distribution device, a safety assessment result of performing key negotiation via each of the two or more paths;

determining whether the combining the shared keys is needed based on the safety assessment result; and

if the combining the shared keys is needed, the method further comprising:

selecting a key combination operation;

communicating by the quantum key distribution device the selected key combination operation through a classical channel to the another quantum key distribution device; and

combining the shared keys with the key combination operation by the quantum key distribution device and the another quantum key distribution device.

12. The quantum key distribution method according to claim 9 , further comprising:

sending, by the quantum key distribution device, through a classical channel, path information of each selected path to the routing devices in the selected path; and

verifying, by the routing devices, an identity of the quantum key distribution device using the path information.

13. The quantum key distribution method according to claim 9 , further comprising:

sending, by the quantum key distribution device, through a classical channel, path information of each selected path to the another quantum key distribution device; and

verifying, by the another quantum key distribution device, an identity of the quantum key distribution device using the path information.

14. The quantum key distribution method according to claim 9 , further comprising:

verifying, by the quantum key distribution device, an identity of the another quantum key distribution device through a classical channel.

15. The quantum key distribution method according to claim 9 , further comprising:

using, by the quantum key distribution device, an obtained shared key to encrypt data to be transmitted.

16. The quantum key distribution method according to claim 15 , further comprising:

forwarding, by the quantum key distribution device, the encrypted data to the another quantum key distribution device; and

using, by the another quantum key distribution device, a copy of the obtained shared key to decrypt the received data.

17. The quantum key distribution method according to claim 9 , wherein:

the quantum key distribution device and the another quantum key distribution device are connected to servers.

18. A quantum key distribution device, comprising:

a memory storing a set of instructions;

a processor configured to execute the set of instructions to cause the apparatus to:

perform key negotiations with another quantum key distribution device through two or more different paths, wherein the two or more different paths each include one or more routing devices;

determine whether a combination operation is required to be performed on shared keys obtained through the key negotiations; and

combine the shared keys to generate a new shared key if the combination operation is required to be performed on the shared keys obtained through the key negotiation process.

19. The device according to claim 18 , wherein the processor is further configured to execute the set of instructions to cause the device to:

select the two or more different paths through which the key negotiations are performed with the another quantum key distribution device according to topology information about a quantum key distribution system including the quantum key distribution device.

20. The device according to claim 19 , wherein the processor is further configured to execute the set of instructions to cause the device to:

send, through a classical channel, each path infatuation of a selected path to a routing device in the selected path and to the another quantum key distribution device.

21. A non-transitory computer-readable storage medium having stored therein instructions that are executable by one or more processors of a device to cause the device to perform a quantum key distribution method comprising:

selecting two or more paths each including one or more routing devices, the one or more routing devices connecting a quantum key distribution device with another quantum key distribution device; and

performing key negotiations by the quantum key distribution device with the another quantum key distribution device through the two or more different paths to obtain shared keys.

22. The non-transitory computer readable medium of claim 21 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

combining the shared keys to generate a new shared key.

23. The non-transitory computer readable medium of claim 22 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

acquiring, by the quantum key distribution device, a safety assessment result of performing key negotiation via each of the two or more paths;

determining whether the combining the shared keys is needed based on the safety assessment result; and

if the combining the shared keys is needed:

selecting a key combination operation;

communicating by the quantum key distribution device the selected key combination operation through a classical channel to the another quantum key distribution device; and

combining the shared keys with the key combination operation by the quantum key distribution device and the another quantum key distribution device.

24. The non-transitory computer readable medium of claim 21 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

sending, by the quantum key distribution device, through a classical channel, path information of each selected path to the routing devices in the selected path; and

verifying, by the routing devices, an identity of the quantum key distribution device using the path information.

25. The non-transitory computer readable medium of claim 21 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

sending, by the quantum key distribution device, through a classical channel, path information of each selected path to the another quantum key distribution device; and

verifying, by the another quantum key distribution device, an identity of the quantum key distribution device using the path information.

26. The non-transitory computer readable medium of claim 21 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

verifying, by the quantum key distribution device, an identity of the another quantum key distribution device through a classical channel.

27. The non-transitory computer readable medium of claim 21 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

using, by the quantum key distribution device, an obtained shared key to encrypt data to be transmitted.

28. The non-transitory computer readable medium of claim 27 , wherein the instructions are executable by the one or more processors of the device to cause the device to further perform:

forwarding, by the quantum key distribution device, the encrypted data to the another quantum key distribution device; and

using, by the another quantum key distribution device, a copy of the obtained shared key to decrypt the received data.

29. The non-transitory computer readable medium of claim 21 , wherein the quantum key distribution device and the another quantum key distribution device are connected to servers.

US14/989,586

2015-01-08

2016-01-06

Quantum key distribution system, method and apparatus based on trusted relay

Active

2036-08-03

US10348493B2

( en )

Applications Claiming Priority (3)

Application Number

Priority Date

Filing Date

Title

CN201510009615.5

2015-01-08

CN201510009615.5A

CN105827397B

( en )

2015-01-08

Quantum key distribution system, method and device based on trusted relay

CN201510009615

2015-01-08

Publications (2)

Publication Number

Publication Date

US20160248581A1

US20160248581A1 ( en )

2016-08-25

US10348493B2

true

US10348493B2 ( en )

2019-07-09

Family

ID=56356379

Family Applications (1)

Application Number

Title

Priority Date

Filing Date

US14/989,586

Active

2036-08-03

US10348493B2

( en )

2015-01-08

2016-01-06

Quantum key distribution system, method and apparatus based on trusted relay

Country Status (7)

Country

Link

( 1 )

US10348493B2

( en )

( 1 )

EP3243295B1

( en )

( 1 )

JP6783772B2

( en )

( 1 )

KR20170115055A

( en )

( 1 )

CN105827397B

( en )

( 1 )

TWI676384B

( en )

( 1 )

WO2016112086A1

( en )

Cited By (15)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

CN112422286A

( en )

2020-11-30

2021-02-26

ä¸éæå¨è¯¢è®¾è®¡ç ç©¶é¢æéå¬å¸

Quantum key distribution method based on trust center

US10997521B1

( en )

2019-10-23

2021-05-04

Bank Of America Corporation

Quantum-resilient computer cluster

RU2752844C1

( en )

2020-12-10

2021-08-11

Key generation and distribution system and method for distributed key generation using quantum key distribution (options)

US11251946B2

( en )

2019-10-31

2022-02-15

Bank Of America Corporation

Quantum key synchronization within a server-cluster

US11387991B2

( en )

2019-12-06

2022-07-12

At&T Intellectual Property I, L.P.

Quantum enabled hybrid fiber cable loop

US11436517B2

( en )

2019-08-26

2022-09-06

Bank Of America Corporation

Quantum-tunneling-enabled device case

US20220294616A1

( en )

2021-03-15

2022-09-15

evolutionQ

System and Method for Optimizing the Routing of Quantum Key Distribution (QKD) Key Material in A Network

US11468356B2

( en )

2019-10-31

2022-10-11

Bank Of America Corporation

Matrix-based quantum-resilient server-cluster

US11569989B2

( en )

2019-10-23

2023-01-31

Bank Of America Corporation

Blockchain system for hardening quantum computing security

US20230344622A1

( en )

2020-11-30

2023-10-26

At&T Intellectual Property I, L.P.

Quantum Key Distribution Networking as a Service

US20240048370A1

( en )

2021-01-29

2024-02-08

Kabushiki Kaisha Toshiba

Quantum key delivery service platform

US20240323004A1

( en )

2023-03-20

2024-09-26

Kabushiki Kaisha Toshiba

Key manager, qkdn control device, quantum cryptographic communication system, information processing device, key management method, qkdn control method, information processing method, and program product

RU2831046C1

( en )

2024-05-20

2024-11-29

Method for generating key between nodes of computer network using quantum key distribution system

GB2634920A

( en )

2023-10-25

2025-04-30

Toshiba Kk

A node for a quantum communication network, a quantum communication network and a method of producing a signed message

EP4560973A1

( en )

2023-11-22

2025-05-28

Thales Alenia Space Italia S.p.A. Con Unico Socio

Innovative quantum key distribution transmission system

Families Citing this family (108)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

CN106470345B

( en )

2015-08-21

2020-02-14

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Video encryption transmission method, video decryption method, video encryption transmission device, video decryption device and video encryption transmission system

CN107086907B

( en )

2016-02-15

2020-07-07

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Key synchronization and packaging transfer method and device for quantum key distribution process

CN107086908B

( en )

2016-02-15

2021-07-06

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

A kind of quantum key distribution method and device

CN107347058B

( en )

2016-05-06

2021-07-23

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Data encryption method, data decryption method, device and system

CN107370546B

( en )

2016-05-11

2020-06-26

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Eavesdropping detection method, data transmission method, device and system

CN107404461B

( en )

2016-05-19

2021-01-26

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Data secure transmission method, client and server method, device and system

CN106230582B

( en )

2016-07-17

2019-03-26

è¥¿å®çµåç§æå¤§å¦

Random Routing Methods in Quantum Secure Communication Networks

CN107959656B

( en )

2016-10-14

2021-08-31

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Data security assurance system, method and device

CN107959567B

( en )

2016-10-14

2021-07-27

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Data storage method, data acquisition method, device and system

CN107959566A

( en )

2016-10-14

2018-04-24

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Quantal data key agreement system and quantal data cryptographic key negotiation method

CN112217637B

( en )

2016-11-04

2024-03-15

åä¸ºææ¯æéå¬å¸

A quantum key relay method and device based on centralized management and control network

US10164778B2

( en )

2016-12-15

2018-12-25

Alibaba Group Holding Limited

Method and system for distributing attestation key and certificate in trusted computing

CN108206738B

( en )

2016-12-16

2022-04-12

å±±ä¸éåç§å¦ææ¯ç ç©¶é¢æéå¬å¸

Quantum key output method and system

CN108270555A

( en )

2016-12-30

2018-07-10

å±±ä¸éåç§å¦ææ¯ç ç©¶é¢æéå¬å¸

A kind of relay key transmission method

CN108270557B

( en )

2016-12-30

2021-02-19

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Backbone network system based on quantum communication and relay method thereof

CN106878006B

( en )

2016-12-31

2019-11-05

åäº¬é®çµå¤§å¦

Quantum key channel transmission method and system based on Optical Time Division Multiplexing

CN106888084B

( en )

2017-01-04

2021-02-19

æµæ±ç¥å·éåç½ç»ç§ææéå¬å¸

Quantum fort machine system and authentication method thereof

DE102017202239A1

( en )

2017-02-13

2018-08-16

Robert Bosch Gmbh

Method and device for agreeing a common key between a first node and a second node of a computer network

CN107124266B

( en )

2017-03-07

2020-10-27

èå·ç§è¾¾ç§æè¡ä»½æéå¬å¸

Video communication system and method based on quantum encryption

CN108667608B

( en )

2017-03-28

2021-07-27

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Data key protection method, device and system

CN108667773B

( en )

2017-03-30

2021-03-12

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Network protection system, method, device and server

CN108736981A

( en )

2017-04-19

2018-11-02

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

It is a kind of wirelessly to throw screen method, apparatus and system

CN109286489A

( en )

2017-07-20

2019-01-29

ä¸å½ç§å¦ææ¯å¤§å¦

A quantum communication method and network based on secondary encryption

CN109286443B

( en )

2017-07-20

2020-05-12

ä¸å½ç§å¦ææ¯å¤§å¦

A quantum communication method and network based on trusted relay nodes

CN107317681A

( en )

2017-08-10

2017-11-03

å½å®¶çµç½å¬å¸

A kind of credible networking authentication method of quantum secret communication and system

CN107453868B

( en )

2017-09-01

2019-09-24

ä¸å½çµåç§æéå¢å¬å¸ç¬¬ä¸åç ç©¶æ

A kind of safe and efficient quantum key method of servicing

CN109995510B

( en )

2017-12-29

2022-07-15

æé½é¶åéåç§ææéå¬å¸

A Quantum Key Relay Service Method

CN108322464B

( en )

2018-01-31

2020-11-17

ä¸å½èåç½ç»éä¿¡éå¢æéå¬å¸

Key verification method and device

CN110380844B

( en )

2018-04-13

2021-01-29

åä¸ºææ¯æéå¬å¸

A quantum key distribution method, device and storage medium

CN108537537A

( en )

2018-04-16

2018-09-14

æå·ç½çç§ææéå¬å¸

A kind of safe and reliable digital cash Wallet System

CN108768629B

( en )

2018-05-24

2021-03-30

ä¸å½ç§å¦é¢ä¿¡æ¯å·¥ç¨ç ç©¶æ

A trusted relay quantum communication method and system

GB2574597B

( en )

2018-06-08

2021-10-20

Toshiba Kk

A Quantum communication network

CN109104428A

( en )

2018-08-28

2018-12-28

åäº¬èªç©ºèªå¤©å¤§å¦

Internet of things data quantum encrypted transmission equipment and transmission method

KR102765991B1

( en )

2018-10-11

2025-02-12

ì£¼ìíì¬ ì¼ì´í°

Method for controlling quantum cryptography communication network and system thereof

CN109450620B

( en )

2018-10-12

2020-11-10

åæ°åè¿ææ¯æéå¬å¸

Method for sharing security application in mobile terminal and mobile terminal

CN109257274B

( en )

2018-11-12

2024-02-02

ä¸å±ä¸å¤®åå¬åçµåç§æå¦é¢

Switching node device for quantum secret communication network system and communication network system comprising the same

CN109245887B

( en )

2018-11-12

2024-01-30

ä¸å±ä¸å¤®åå¬åçµåç§æå¦é¢

Relay device for quantum secret communication network system and communication network system comprising the same

CN111277549B

( en )

2018-12-05

2022-05-03

æå·å¸æç§ææéå¬å¸

Security service method and system adopting block chain

WO2020125967A1

( en )

2018-12-19

2020-06-25

Telefonaktiebolaget Lm Ericsson (Publ)

Quantum key distribution apparatus and method

CN111404672B

( en )

2019-01-02

2023-05-09

ä¸å½ç§»å¨éä¿¡æéå¬å¸ç ç©¶é¢

Quantum key distribution method and device

GB2581528B

( en )

2019-02-22

2022-05-18

Toshiba Kk

A method, a communication network and a node for exchanging a cryptographic key

CN111865567B

( en )

2019-04-29

2021-11-30

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Relay method, device, system, equipment and storage medium of quantum key

US11411722B2

( en )

2019-05-03

2022-08-09

Quantumxchange, Inc.

Method of operation of a quantum key controller

US11469888B2

( en )

2019-05-03

2022-10-11

Quantumxchange, Inc.

Tamper detection in a quantum communications system

US11424918B2

( en )

2019-05-03

2022-08-23

Quantumxchange, Inc.

Method of operation of a trusted node software in a quantum key distribution system

CN110224815B

( en )

2019-05-08

2021-02-09

åäº¬é®çµå¤§å¦

QKD network resource allocation method and system

CN110247705B

( en )

2019-06-21

2020-12-08

Multi-core fiber-based optical quantum fusion network implementation method and system

US11483140B2

( en )

2019-08-02

2022-10-25

Quantumxchange, Inc.

Secure out-of-band symmetric encryption key delivery

CN110690928B

( en )

2019-09-01

2020-10-16

æé½éå®åºåé¾ç§ææéå¬å¸

Quantum relay link virtualization method and device

CN110690960B

( en )

2019-09-01

2022-02-22

æé½éå®åºåé¾ç§ææéå¬å¸

Routing service method and device of relay node

CN112367163B

( en )

2019-09-01

2023-09-26

æé½éå®åºåé¾ç§ææéå¬å¸

Quantum network virtualization method and device

CN110661620B

( en )

2019-09-06

2022-04-01

æé½éå®åºåé¾ç§ææéå¬å¸

Shared key negotiation method based on virtual quantum link

KR102595369B1

( en )

2019-09-16

2023-10-30

ì£¼ìíì¬ ì¼ì´í°

Method, apparatus and system for quantum cryptography key distribution

US11228431B2

( en )

2019-09-20

2022-01-18

General Electric Company

Communication systems and methods for authenticating data packets within network flow

CN110557253B

( en )

2019-10-14

2023-06-06

æé½éå®åºåé¾ç§ææéå¬å¸

Relay route acquisition method, device and application system

CN111181717B

( en )

2019-11-11

2021-06-15

åäº¬é®çµå¤§å¦

A key distribution method and device

CN110868290B

( en )

2019-11-21

2022-05-31

æé½éå®åºåé¾ç§ææéå¬å¸

Key service method and device without central control

US11429519B2

( en )

2019-12-23

2022-08-30

Alibaba Group Holding Limited

System and method for facilitating reduction of latency and mitigation of write amplification in a multi-tenancy storage drive

CN111953487B

( en )

2020-08-14

2022-04-22

èå·æµªæ½®æºè½ç§ææéå¬å¸

Key management system

CN114389797A

( en )

2020-10-16

2022-04-22

ä¸åä¸º(æé½)éåéä¿¡ææ¯æéå¬å¸

Relay link routing method, device and quantum cloud server based on quantum cloud key agreement

CN114389796A

( en )

2020-10-16

2022-04-22

ä¸åä¸º(æé½)éåéä¿¡ææ¯æéå¬å¸

Quantum cloud key negotiation method, device and system, quantum and quantum cloud server

JP7414688B2

( en )

2020-10-26

2024-01-16

æ ªå¼ä¼ç¤¾æ±è

Communication devices, communication methods, programs and communication systems

NL2027091B1

( en )

2020-12-10

2022-07-08

Abn Amro Bank N V

Orchestrated quantum key distribution

CN114679256A

( en )

2020-12-24

2022-06-28

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Multipath key relay method, device and related equipment

CN114697002B

( en )

2020-12-28

2024-07-19

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Distributed quantum cryptography network group key distribution method and system

CN114697015A

( en )

2020-12-31

2022-07-01

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Key management method and key distribution method for trusted relay node

CN114765543B

( en )

2020-12-31

2024-07-19

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Encryption communication method and system of quantum cryptography network expansion equipment

CN112787807B

( en )

2020-12-31

2022-03-18

æ¸åå¤§å¦

Quantum communication method and communication network based on secure relay

CN113179514B

( en )

2021-03-25

2022-08-05

åäº¬é®çµå¤§å¦

Quantum key distribution method and related equipment in relay coexistence scenario

CN112994883B

( en )

2021-04-22

2021-08-13

æµæ±ä¹å·éåä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Symmetric key negotiation system and method based on quantum key and true random number source

CN113472453B

( en )

2021-06-29

2022-04-08

Distributed quantum sensing networking method based on time division multiplexing centralized detection

KR102778317B1

( en )

2021-11-08

2025-03-10

íêµê³¼íê¸°ì ì ë³´ì°êµ¬ì

Management apparatus for quantum key, and control method thereof

CN113765665B

( en )

2021-11-10

2022-02-08

Block chain network based on quantum key and data secure transmission method

CN114362929B

( en )

2021-11-23

2024-12-27

åäº¬é®çµå¤§å¦

Protection method, device and electronic device based on quantum key distribution network

CN114422122B

( en )

2021-12-23

2024-08-27

å±±ä¸å·¥åå¦é¢

Quantum key negotiation method and system with semi-trusted third party

CN116418490B

( en )

2021-12-30

2026-03-03

ç§å¤§å½ç¾éåææ¯è¡ä»½æéå¬å¸

Multi-path key relay method, quantum key distribution equipment and system

CN114448620B

( en )

2022-01-07

2023-10-03

åäº¬é®çµå¤§å¦

Business path selection method and related equipment for multi-protocol quantum key distribution network

CN114124385B

( en )

2022-01-26

2022-04-22

å½ç½æµæ±ççµåæéå¬å¸éåä¾çµå¬å¸

Backup link system applied to quantum secret communication

CN114268441B

( en )

2022-03-03

2022-05-31

æé½éå®åºåé¾ç§ææéå¬å¸

Quantum security application method, client device, server device and system

JP7781690B2

( en )

2022-03-29

2025-12-08

æ ªå¼ä¼ç¤¾æ±è

Encrypted communication system, encrypted communication device, and encrypted communication method

JP7673019B2

( en )

2022-04-14

2025-05-08

æ ªå¼ä¼ç¤¾æ±è

Encrypted communication system, encrypted communication device, and encrypted communication method

JP2023157175A

( en )

2022-04-14

2023-10-26

æ ªå¼ä¼ç¤¾æ±è

User base equipment, encrypted communication system, encrypted communication method

US12192328B1

( en )

2022-05-10

2025-01-07

Wells Fargo Bank, N.A.

Systems and methods for secure communication based on random key derivation

KR102814559B1

( en )

2022-05-30

2025-05-29

íêµê³¼íê¸°ì ì ë³´ì°êµ¬ì

Network apparatus for quantum key distribution, and operation method for quantum key distribution network

GB2619776B

( en )

2022-06-17

2024-06-05

Arqit Ltd

Quantum key distribution protocol

CN115426104B

( en )

2022-07-08

2025-09-02

åäº¬é®çµå¤§å¦

Proprietary and shared protection methods and related equipment for quantum key provisioning

JP7775157B2

( en )

2022-07-22

2025-11-25

æ ªå¼ä¼ç¤¾æ±è

QKD system, monitoring device, multiplexing device and program

CN115276976B

( en )

2022-07-25

2023-07-07

åäº¬ç¾åº¦ç½è®¯ç§ææéå¬å¸

Quantum key distribution method, device and electronic equipment

CN115314198B

( en )

2022-08-08

2025-02-14

A quantum secure network rights management system and method

CN115442034A

( en )

2022-09-02

2022-12-06

å½ç½å±±ä¸ççµåå¬å¸ä¸´æ²ä¾çµå¬å¸

Quantum key distribution system and method for power communication network

JP2024098810A

( en )

2023-01-11

2024-07-24

Communication network control device

CN115811400A

( en )

2023-02-03

2023-03-17

æè¿éç§ææéå¬å¸

Handheld device key sharing method and system

CN116155492B

( en )

2023-02-22

2026-03-31

ä¸å½ç§å¦ææ¯å¤§å¦

A segmented key distribution method and system for hybrid relay QKD networks

JP7735340B2

( en )

Quantum key distribution system, method and apparatus based on trusted relay — Alibaba Group Holding Limited (US10348493B2)

Related documents