CN109005034B - Multi-tenant quantum key supply method and device - Google Patents

Abstract

The invention discloses a multi-tenant quantum key supply method and device. The method comprises the following steps: acquiring parameter information of a quantum key distribution network; after receiving a plurality of tenant requests, recording parameter information of each tenant request and inquiring quantum key information associated with the tenant requests; and determining the quantum key supplied for each tenant according to the parameter information of the quantum key distribution network, the parameter information of each tenant request and the quantum key information associated with the tenant request. The scheme provided by the invention can improve the configuration flexibility of the multi-tenant quantum key and the supply efficiency of the quantum key in the quantum key distribution network.

Description

A kind of multi-tenant quantum key supply method and device

technical field

The present invention relates to the field of communication technologies, in particular to a multi-tenant quantum key supply method and device.

Background technique

In the information age, information network security and confidentiality are very important. QKD (Quantum Key Distribution, Quantum Key Distribution) technology can provide theoretically "unconditionally secure" quantum keys for users with high security requirements, thereby ensuring secure communication of user secrets and sensitive data. The QKD network can be used as a support network for users' secure communication, but the current deployment of the QKD network is costly and difficult, and some institutions with high security requirements (such as financial institutions, government agencies, etc.) are difficult to deploy a proprietary QKD network. The QKD network can continuously generate and store quantum keys, and multiple tenants (one tenant corresponds to an institution with high security requirements) can rent the same QKD network and obtain the required quantum keys from it to ensure secure communication. The quantum keys obtained by multiple tenants are different, and the quantum keys are destroyed after being used once.

In the QKD network, multiple tenants arrive and leave dynamically, and each tenant is unknown until they arrive. How to achieve efficient supply and demand matching between the quantum keys supplied by the QKD network and the quantum keys required by dynamic multi-tenancy becomes very critical. The existing QKD network lacks an efficient dynamic multi-tenant quantum key supply method. In related technologies, manual methods are mainly used to complete the multi-tenant quantum key supply and configuration one by one, so it is difficult to realize the quantum key and dynamic multi-tenancy provided by the QKD network. The efficient supply and demand matching of the required quantum keys results in the problems of inflexible configuration of multi-tenancy in the existing QKD network and inefficient supply of quantum key resources.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present invention is to provide a multi-tenant quantum key supply method and device, which can improve the multi-tenant configuration flexibility and the quantum key supply efficiency.

According to an aspect of the present invention, a multi-tenant quantum key provisioning method is provided, comprising:

Obtain the parameter information of the quantum key distribution network;

After receiving multiple tenant requests, record the parameter information requested by each tenant and query the quantum key information associated with the tenant request;

The quantum key provided for each tenant is determined according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request.

Preferably, the obtaining parameter information of the quantum key distribution network includes:

Obtain the topology information of the quantum key distribution network;

Obtain the quantum key generation rate, quantum key storage threshold, and quantum key reserved storage between each pair of distribution nodes.

Preferably, the recording of parameter information requested by each tenant includes:

Record the node set requested by each tenant, the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant;

The querying quantum key information associated with the tenant request includes:

Query the information of the previous tenant's request for quantum key supply between each pair of distribution nodes, and the amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant.

Preferably, the quantum key provided for each tenant is determined according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request, including:

According to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant, determine the required quantum key between each pair of distribution nodes corresponding to each tenant request quantity;

According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes . The amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and determines the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request;

According to the comparison result between the theoretical quantum key storage amount and the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes;

According to the comparison result of the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, the quantum key provided for each tenant is determined.

Preferably, the amount of quantum keys available between each pair of distribution nodes is determined according to the comparison result between the theoretical quantum key storage amount and the quantum key storage amount threshold, including:

When the theoretical quantum key storage volume is greater than the quantum key storage volume threshold, determine the quantum key storage volume threshold available between each pair of distribution nodes and select the quantum key storage volume threshold;

When the theoretical quantum key storage amount is less than or equal to the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes and select the theoretical quantum key storage amount.

Preferably, the quantum key provided for each tenant is determined according to the comparison result between the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, including:

When the amount of quantum keys available between each pair of distribution nodes is greater than or equal to the required amount of quantum keys between each pair of distribution nodes, the required amount of quantum keys is selected from the corresponding distribution nodes, and supplied to the tenant to request the corresponding amount of quantum keys node.

Preferably, the method further includes:

Monitor and update the real-time remaining quantum key amount between each pair of distribution nodes in the quantum key distribution network.

According to another aspect of the present invention, there is provided a multi-tenant quantum key supply device, comprising:

The network information acquisition module is used to acquire the parameter information of the quantum key distribution network;

A tenant recording and query module, configured to record the parameter information of each tenant request and query the quantum key information associated with the tenant request after receiving multiple tenant requests;

The quantum key supply module is used for the parameter information of the quantum key distribution network obtained by the network information obtaining module, the parameter information requested by each tenant recorded by the tenant record and the query module, and the queried relationship with the tenant. Request the associated quantum key information to determine the quantum key provisioned for each tenant.

Preferably, the network information acquisition module includes:

The topology information acquisition module is used to acquire the topology information of the quantum key distribution network;

The rate information acquisition module is used to acquire the quantum key generation rate between each pair of distribution nodes;

The storage information acquisition module is used to acquire the quantum key storage threshold between each pair of distribution nodes;

The reserved information acquisition module is used to acquire the reserved quantum key storage amount between each pair of distribution nodes.

Preferably, the tenant record and query module includes:

The node record module is used to record the node set requested by each tenant;

Time recording module to record the arrival time and duration of each tenant request;

The demand recording module is used to record the quantum key demand between each pair of distribution nodes in the node set requested by each tenant;

The query module is used to query the information of the previous tenant's request for quantum key supply between each pair of distribution nodes, and the quantum key amount remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant.

Preferably, the quantum key supply module includes:

A computing module, configured to determine the interval between each pair of distribution nodes corresponding to each tenant request according to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant According to the quantum key generation rate between each pair of distribution nodes, the quantum key reserved storage, the arrival time and duration of each tenant’s request, and the completion of quantum keys between each pair of distribution nodes The supplied information of the previous tenant's request, the quantum key amount remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request is determined;

The judgment module is used for judging whether the theoretical quantum key storage amount is greater than the quantum key storage amount threshold, and judging whether the quantum key amount available between each pair of distribution nodes is greater than or equal to the required quantum key amount between each pair of distribution nodes ;

a decision module, configured to determine the quantum key amount available between each pair of distribution nodes according to the comparison result of the theoretical quantum key storage amount and the quantum key storage amount threshold in the judgment module;

The execution module is configured to determine the amount of quantum keys available between each pair of distribution nodes in the decision module, and the amount of quantum keys available between each pair of distribution nodes in the judgment module and the amount of quantum keys available between each pair of distribution nodes. The results of the comparison of the required quantum keys amount to determine the quantum keys supplied for each tenant.

Preferably, the quantum key supply module further includes:

The monitoring module is used to monitor and update the real-time remaining quantum key amount between each pair of distribution nodes in the quantum key distribution network.

To sum up, the technical solutions of the embodiments of the present invention can obtain parameter information of the quantum key distribution network, and after receiving multiple tenant requests, record the parameter information requested by each tenant and query the information associated with the tenant request. quantum key information, and then determine the quantum key provided for each tenant according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request. Therefore, the solution of the present invention can automatically calculate the quantum key provided for each tenant according to the relevant parameter information, and can also automatically adjust the quantum key provided for each tenant when the parameter information changes, so there is no need to use manual methods one by one. Complete the multi-tenant quantum key supply and configuration, so as to realize the efficient supply and demand matching between the quantum keys supplied by the QKD network and the quantum keys required by dynamic multi-tenancy, and improve the flexible configuration of multi-tenant quantum keys in the quantum key distribution network. security and supply efficiency of quantum keys.

Description of drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the more detailed description of the exemplary embodiments of the present disclosure taken in conjunction with the accompanying drawings, wherein the same reference numerals generally refer to the exemplary embodiments of the present disclosure. same parts.

Figure 1 is a schematic diagram of a quantum key distribution network;

2 is a schematic flowchart of a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention;

3 is a schematic flowchart of step 201 in a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention;

4 is a schematic flowchart of step 202 in a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention;

5 is a schematic flowchart of step 203 in a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention;

6 is a schematic diagram of an application example of a quantum key distribution network according to an embodiment of the present invention;

7 is a schematic block diagram of a multi-tenant quantum key supply device in a quantum key distribution network according to an embodiment of the present invention;

Fig. 8 is another schematic block diagram of a multi-tenant quantum key supply apparatus in a quantum key distribution network according to an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

The invention provides a multi-tenant quantum key supply method, which can improve the configuration flexibility of multi-tenant quantum keys and the supply efficiency of quantum keys in a quantum key distribution network.

The technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Figure 1 is a schematic diagram of a quantum key distribution network.

As shown in Figure 1, the QKD network includes node A, node B, node C, node D, and node E, where the QKD node is located at the user-end node with high security requirements, and the QKD link contains quantum optical signals and synchronous optical signals. The quantum channel of the signal and the negotiation channel that carries negotiation information such as basis vector comparison and bit error check. Due to the unclonable nature of quantum states, quantum signals cannot be amplified, and multiple trusted relay nodes can be deployed between QKD nodes to extend the QKD distance. The QKD node includes multiple QKD senders, multiple QKD receivers, key management servers and other components. Any pair of QKD nodes in the QKD network can use the QKD link to connect the QKD sender and the QKD receiver for quantum key distribution, generating a theoretically "unconditionally secure" quantum key, and storing the quantum key in the key in the management server. Among them, the key management server can control the quantum key distribution sender and the quantum key distribution receiver to generate quantum keys synchronously, store quantum keys, supply quantum keys for tenants with high security requirements, and use quantum keys once Then destroy the quantum key.

FIG. 2 is a schematic flowchart of a method for supplying a multi-tenant quantum key in a quantum key distribution network according to an embodiment of the present invention. The method can be applied to a multi-tenant quantum key supply device in a quantum key distribution network.

Regarding the multi-tenancy in the embodiment of the present invention, multiple logically isolated tenants may coexist on the same underlying network and share resources in their network. The unique properties of quantum key resources make quantum keys continuously generated between QKD nodes and continuously consumed by multiple tenants. Quantum keys cannot be reused and will be destroyed after being used once. Each tenant request in the QKD network consists of several user end nodes with high security requirements and the corresponding quantum key requirements between each pair of user end nodes. General quantum key requirements can include two types of quantum key volume requirements and quantum key rate requirements. Multiple tenants arrive and leave dynamically, and each tenant is unknown until they arrive. The invention uses the idea of multi-tenancy to realize the complete separation of QKD network infrastructure and users with high security requirements, so that multiple users can obtain quantum key resources that meet their security requirements by renting the QKD network, without caring about the specific underlying layer. The QKD networking details (cost, difficulty, etc.) greatly improve the utilization of quantum key resources in the QKD network.

Aiming at the shortcomings of the prior art and the unique properties of quantum key resources in the QKD network, the present invention proposes a dynamic multi-tenant quantum key supply method in the QKD network. Efficient supply and demand matching of quantum keys required by tenants.

Referring to Figure 2, the method includes:

Step 201: Obtain parameter information of the quantum key distribution network.

The step includes acquiring topology information of the quantum key distribution network; acquiring the quantum key generation rate, quantum key storage threshold, and quantum key reserved storage between each pair of distribution nodes.

Step 202: After receiving multiple tenant requests, record parameter information of each tenant request and query quantum key information associated with the tenant request.

The recording of the parameter information requested by each tenant includes: recording the node set requested by each tenant, the arrival time and duration of each tenant request, and the quantum secret between each pair of distribution nodes in the node set requested by each tenant. key requirements;

The querying of quantum key information associated with the tenant request includes: querying the previous tenant request information for completing quantum key supply between each pair of distribution nodes, and each pair of distribution nodes requesting the supply of quantum keys for the previous tenant The amount of quantum key remaining after that.

Step 203: Determine the quantum key provided for each tenant according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request.

This step can include:

According to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant, determine the required quantum key between each pair of distribution nodes corresponding to each tenant request quantity;

According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes . The amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and determines the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request;

According to the comparison result between the theoretical quantum key storage amount and the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes;

According to the comparison result of the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, the quantum key provided for each tenant is determined.

The technical solution of the embodiment of the present invention can obtain the parameter information of the quantum key distribution network, after receiving multiple tenant requests, record the parameter information requested by each tenant and query the quantum key information associated with the tenant request, The quantum key provided for each tenant is then determined according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request. Therefore, the solution of the present invention can automatically calculate the quantum key provided for each tenant according to the relevant parameter information, and can also automatically adjust the quantum key provided for each tenant when the parameter information changes, so there is no need to use manual methods one by one. Complete the multi-tenant quantum key supply and configuration, so as to realize the efficient supply and demand matching between the quantum keys supplied by the QKD network and the quantum keys required by dynamic multi-tenancy, and improve the flexible configuration of multi-tenant quantum keys in the quantum key distribution network. security and supply efficiency of quantum keys.

FIG. 3 is a schematic flowchart of step 201 in a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention.

In Figure 3 include:

Step 301: Obtain quantum key distribution network topology information.

Among them, the QKD nodes in the underlying QKD network topology correspond to the client nodes with high security requirements.

Step 302: Obtain the quantum key generation rate between each pair of quantum key distribution nodes.

Among them, each pair of quantum key distribution nodes will continuously generate quantum keys at a certain rate after the QKD link is connected.

Step 303: Obtain the quantum key storage threshold K _max between each pair of quantum key distribution nodes.

Among them, the quantum key storage threshold in the key management server between each pair of quantum key distribution nodes is determined by the size of the storage space.

Step 304: Obtain the quantum key reserved storage amount between each pair of quantum key distribution nodes.

Among them, before the dynamic multi-tenant request arrives, a certain amount of quantum key storage is reserved between each pair of quantum key distribution nodes, which can avoid the multi-tenant quantum key storage caused by insufficient quantum key storage when the QKD network first starts to operate. Key provisioning failed.

It should be noted that there is no necessary sequence relationship among steps 301 , 302 , 303 and 304 .

FIG. 4 is a schematic flowchart of step 202 in a method for supplying multi-tenant quantum keys in a quantum key distribution network according to an embodiment of the present invention.

In Figure 4 include:

Step 401: Record the set of tenant end nodes with high security requirements requested by each tenant.

Among them, each node with high security requirements in the node set has a corresponding relationship with the quantum key distribution node in the underlying quantum key distribution network.

Step 402, record the arrival time and duration of each tenant request.

The arrival times and durations of multiple tenant requests may be the same or different.

Step 403: Record the quantum key requirement between each pair of nodes in the node set requested by each tenant.

Among them, the quantum key requirements can include two types of quantum key volume requirements and quantum key rate requirements.

Step 404 , query the information of the previous tenant request that completes quantum key supply between each pair of quantum key distribution nodes corresponding to each tenant request.

Step 405: Query the amount of quantum keys remaining in real time between each pair of QKD nodes after completing the request for supplying quantum keys for the previous tenant.

It should be noted that steps 401 , 402 and 403 do not have a necessary sequence relationship.

FIG. 5 is a schematic flowchart of step 203 in a method for supplying a multi-tenant quantum key in a quantum key distribution network according to an embodiment of the present invention.

In Figure 5 include:

Step 501: Calculate the required quantum key amount K _r between each pair of QKD nodes corresponding to each tenant request.

According to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of nodes in the node set requested by each tenant, calculate the quantum key amount K _r required between each pair of QKD nodes corresponding to each tenant request (i.e. the amount of quantum keys that need to be provisioned).

Step 502: Calculate the theoretical quantum key storage amount Ks between each pair of quantum key distribution nodes.

According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes , Between each pair of distribution nodes, the amount of quantum keys remaining after the previous tenant requests to supply quantum keys, calculate the theoretical quantum key between each pair of quantum key distribution nodes in the quantum key distribution network when each tenant's request arrives Storage amount Ks (that is, the theoretical quantum key storage amount).

Step 503 , determine whether the theoretical quantum key storage amount Ks is greater than the quantum key storage amount threshold K _max , if yes, go to step 504 , if not, go to step 505 .

Step 504 , it is determined that the quantum key quantity Kc available in real time between each pair of quantum key distribution nodes is equal to the quantum key storage quantity threshold K _max , and the process goes to step 506 .

Step 505 , it is determined that the quantum key amount Kc available in real time between each pair of quantum key distribution nodes is equal to the theoretical quantum key storage amount Ks, and the process goes to step 506 .

Step 506, determine whether the quantum key amount Kc available in real time between each pair of quantum key distribution nodes is greater than or equal to the required quantum key amount K _r between each pair of quantum key distribution nodes; if so, go to step 507, if not, Go to step 508 .

Step 507 , use the first hit method to select the required quantum key amount K _r from the corresponding quantum key distribution nodes to supply the node to which the tenant requests the corresponding node, and then go to step 509 .

The first hit method refers to numbering the available resources in the order from front to back, and then selecting the resources according to the order of the numbers from small to large. The first hit is a common method of network resource allocation, that is, each time a network resource (such as the key resource here) is allocated, the first available resource (ie, the lowest number) is selected according to the number sequence for allocation.

Step 508 , if the quantum key requirement requested by the tenant cannot be satisfied, the corresponding tenant will be blocked or waited, and the process proceeds to step 509 .

Step 509: Monitor and update the real-time remaining quantum key amount between each pair of quantum key distribution nodes in the quantum key distribution network.

In this step, after completing the quantum key supply, monitor and update the real-time remaining quantum key amount between each pair of quantum key distribution nodes in the quantum key distribution network. It should be noted that, after a new tenant request arrives, steps 202 and 203 in FIG. 2 are repeatedly executed in sequence.

It should be noted that steps 501 and 502 do not have a necessary sequence relationship.

FIG. 6 is a schematic diagram of an application example of a quantum key distribution network according to an embodiment of the present invention.

间的量子密钥生成速率为

QKD节点

间的量子密钥生成速率为

QKD节点

间的量子密钥生成速率为

获取每对QKD节点间的量子密钥存储量阈值K_max，在本发明实施例中，每对QKD节点间的量子密钥存储量阈值相同；获取每对QKD节点间的量子密钥预留存储量K_a，在本发明实施例中每对QKD节点间的量子密钥预留存储量相同。As shown in Figure 6, before the arrival of dynamic multi-tenancy, obtain the topology information of the underlying QKD network, obtain the bottom 6 QKD nodes and the QKD link information connecting the QKD nodes; obtain the quantum key generation rate between each pair of QKD nodes , such as the QKD node

The quantum key generation rate between

QKD node

The quantum key generation rate between

QKD node

The quantum key generation rate between

Obtain the quantum key storage threshold K _max between each pair of QKD nodes. In the embodiment of the present invention, the quantum key storage threshold between each pair of QKD nodes is the same; obtain the quantum key reserved storage between each pair of QKD nodes The quantum key reserved storage amount is the same between each pair of _QKD nodes in the embodiment of the present invention.

的量子密钥速率需求为

节点

的量子密钥量需求为

节点

的量子密钥速率需求为

查询租户1请求的到达时间t_a1；查询QKD节点

完成为租户1请求供应量子密钥后实时剩余的量子密钥量

QKD节点

完成为租户1请求供应量子密钥后实时剩余的量子密钥量

QKD节点

完成为租户1请求供应量子密钥后实时剩余的量子密钥量

计算租户2请求对应的QKD节点

间需求量子密钥量为

租户2请求对应的QKD节点

间需求量子密钥量为

租户2请求对应的QKD节点

间需求量子密钥量为

计算租户2请求对应的QKD节点

间理论量子密钥存储量

QKD节点

间理论量子密钥存储量

QKD节点

间理论量子密钥存储量

其中，

均小于K_max，则QKD节点

间实时可用的量子密钥量

QKD节点

间实时可用的量子密钥量

QKD节点

间实时可用的量子密钥量

其中，

分别对应小于

利用首次命中方法从对应的QKD节点中选择量子密钥量

供应给租户2请求对应的节点。最后，完成租户2请求的量子密钥供应，监控并更新底层QKD网络中每对QKD节点间实时剩余的量子密钥量。Tenant 1 requests that quantum key provisioning has completed before tenant 2's request arrives. When the tenant 2 request arrives, record the node set {A, B, C} requested by the tenant 2; record the arrival time t _a2 and the duration t _h2 requested by the tenant 2; record the node set {A, B, C requested by the tenant 2 } middle node

The quantum key rate requirement for

node

The quantum key requirement for

node

The quantum key rate requirement for

Query the arrival time t _a1 requested by tenant 1; query the QKD node

The amount of quantum keys remaining in real time after completing the request for provisioning quantum keys for Tenant 1

QKD node

The amount of quantum keys remaining in real time after completing the request for provisioning quantum keys for Tenant 1

QKD node

The amount of quantum keys remaining in real time after completing the request for provisioning quantum keys for Tenant 1

Calculate the QKD node corresponding to the request of tenant 2

The required quantum key size is

Tenant 2 requests the corresponding QKD node

The required quantum key size is

Tenant 2 requests the corresponding QKD node

The required quantum key size is

Calculate the QKD node corresponding to the request of tenant 2

Inter-theoretical quantum key storage

QKD node

Inter-theoretical quantum key storage

QKD node

Inter-theoretical quantum key storage

in,

are less than K _max , then the QKD node

amount of quantum keys available in real time

QKD node

amount of quantum keys available in real time

QKD node

amount of quantum keys available in real time

in,

corresponding to less than

Select the quantum key amount from the corresponding QKD nodes using the first hit method

Supply to the node corresponding to the tenant 2 request. Finally, complete the quantum key supply requested by tenant 2, monitor and update the real-time remaining quantum key amount between each pair of QKD nodes in the underlying QKD network.

The above describes in detail a multi-tenant quantum key supply method in a quantum key distribution network of the present invention, and the following introduces a multi-tenant quantum key supply device in a quantum key distribution network corresponding to the present invention.

Fig. 7 is a schematic block diagram of a multi-tenant quantum key supply apparatus in a quantum key distribution network according to an embodiment of the present invention.

Referring to FIG. 7 , the multi-tenant quantum key supply device 70 includes: a network information acquisition module 71 , a tenant record and query module 72 and a quantum key supply module 73 .

The network information acquisition module 71 is used for acquiring parameter information of the quantum key distribution network.

Wherein, obtaining the parameter information of the quantum key distribution network includes obtaining the topology information of the quantum key distribution network; obtaining the quantum key generation rate, quantum key storage threshold, quantum key reserved storage capacity, etc. between each pair of distribution nodes .

The tenant recording and query module 72 is configured to, after receiving multiple tenant requests, record the parameter information of each tenant request and query the quantum key information associated with the tenant request.

The recording of the parameter information requested by each tenant includes: recording the node set requested by each tenant, the arrival time and duration of each tenant request, and the quantum secret between each pair of distribution nodes in the node set requested by each tenant. key requirements; wherein the querying quantum key information associated with the tenant request includes: querying the previous tenant request information for quantum key supply between each pair of distribution nodes, and requesting supply for the previous tenant between each pair of distribution nodes Amount of quantum key remaining after quantum key.

The quantum key supply module 73 is used to obtain the parameter information of the quantum key distribution network obtained by the network information obtaining module 71, the parameter information requested by each tenant recorded by the tenant record and query module 72, and the query and the combination. The tenant requests associated quantum key information to determine the quantum key provided for each tenant.

Wherein, the requirement between each pair of distribution nodes corresponding to each tenant request can be determined according to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant quantum key amount;

According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes . The amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and determines the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request;

According to the comparison result between the theoretical quantum key storage amount and the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes;

According to the comparison result of the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, the quantum key provided for each tenant is determined.

Fig. 8 is another schematic block diagram of a multi-tenant quantum key supply apparatus in a quantum key distribution network according to an embodiment of the present invention.

8 , the multi-tenant quantum key supply device 80 includes: a network information acquisition module 71 , a tenant record and query module 72 , a quantum key supply module 73 , and a control module 74 .

The control module 74 is responsible for controlling the work of the entire device. The network information acquisition module 71 , the tenant recording and query module 72 , and the quantum key supply module 73 perform different operations under the control of the control module 74 .

The network information acquisition module 71 includes: a topology information acquisition module 711 , a rate information acquisition module 712 , a storage information acquisition module 713 , and a reservation information acquisition module 714 .

The topology information acquisition module 711 is configured to acquire topology information of the quantum key distribution network.

The rate information acquisition module 712 is configured to acquire the quantum key generation rate between each pair of distribution nodes.

The storage information obtaining module 713 is configured to obtain the quantum key storage threshold value between each pair of distribution nodes.

The reservation information acquisition module 714 is configured to acquire the quantum key reserved storage amount between each pair of distribution nodes.

The tenant recording and querying module 72 includes: a node recording module 721 , a time recording module 722 , a demand recording module 723 , a querying module 724 , and an information storage module 725 .

The node recording module 721 is configured to record the set of nodes with high security requirements requested by each tenant.

The time recording module 722 is used to record the arrival time and duration of each tenant request.

The demand recording module 723 is configured to record the quantum key demand between each pair of distribution nodes in the node set requested by each tenant.

The query module 724 is configured to query the information of the previous tenant's request for quantum key supply between each pair of distribution nodes, and the quantum key amount remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant.

The information storage module 725 is used to store detailed information and status of each tenant request.

The quantum key supply module 73 includes: a calculation module 731 , a judgment module 732 , a decision module 733 , an execution module 734 , and a monitoring module 735 .

The calculation module 731 is configured to determine each pair of distribution nodes corresponding to each tenant request according to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant According to the quantum key generation rate between each pair of distribution nodes, the quantum key reserved storage, the arrival time and duration of each tenant’s request, and the quantum encryption completed between each pair of distribution nodes The previous tenant's request information for key supply, the quantum key amount remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request is determined .

The judgment module 732 is used for judging whether the theoretical quantum key storage amount is greater than the quantum key storage amount threshold, and judging whether the quantum key amount available between each pair of distribution nodes is greater than or equal to the required quantum key between each pair of distribution nodes quantity.

The decision module 733 is used to determine the quantum key amount available between each pair of distribution nodes according to the comparison result of the theoretical quantum key storage amount and the quantum key storage amount threshold in the judgment module 732, and determine the tenant Whether the requested quantum key requirement can be met.

The execution module 734 is used to determine the quantum key amount available between each pair of distribution nodes according to the decision module 733, and the quantum key amount available between each pair of distribution nodes in the judgment module 732 and each pair. The results of the comparison of the required quantum keys among the distribution nodes determine the quantum keys supplied for each tenant; that is, the first hit method is performed to select the quantum keys from the corresponding QKD nodes and supply them to the nodes corresponding to the tenant's request.

The monitoring module 735 is configured to monitor and update the real-time remaining quantum key amount between each pair of distribution nodes in the quantum key distribution network.

To sum up, the technical solutions of the embodiments of the present invention can obtain parameter information of the quantum key distribution network, and after receiving multiple tenant requests, record the parameter information requested by each tenant and query the information associated with the tenant request. quantum key information, and then determine the quantum key provided for each tenant according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request. Therefore, the solution of the present invention can automatically calculate the quantum key provided for each tenant according to the relevant parameter information, and can also automatically adjust the quantum key provided for each tenant when the parameter information changes, so there is no need to use manual methods one by one. Complete the multi-tenant quantum key supply and configuration, so as to realize the efficient supply and demand matching between the quantum keys supplied by the QKD network and the quantum keys required by dynamic multi-tenancy, and improve the flexible configuration of multi-tenant quantum keys in the quantum key distribution network. security and supply efficiency of quantum keys.

The technical solution according to the present invention has been described in detail above with reference to the accompanying drawings.

Those skilled in the art will also appreciate that the various exemplary logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein may be implemented as electronic hardware, computer software, or combinations of both.

Those of ordinary skill in the art should understand: the above are only specific embodiments of the present invention, and are not intended to limit the present invention. Any modification, equivalent replacement, improvement made within the spirit and principle of the present invention etc., should be included within the protection scope of the present invention.

Claims (8)

1. a multi-tenant quantum key supply method, is characterized in that, comprises: Obtain the parameter information of the quantum key distribution network, including: obtaining the topology information of the quantum key distribution network; Obtain the quantum key generation rate, quantum key storage threshold, and quantum key reserved storage between each pair of distribution nodes; After receiving multiple tenant requests, record parameter information requested by each tenant and query quantum key information associated with the tenant request, and the recording parameter information requested by each tenant includes: Record the node set requested by each tenant, the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant; The querying quantum key information associated with the tenant request includes: Query the information of the previous tenant's request for quantum key supply between each pair of distribution nodes, and the amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant; The quantum key provided for each tenant is determined according to the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the tenant request. 2. The method according to claim 1, wherein the parameter information of the quantum key distribution network, the parameter information requested by each tenant, and the quantum key information associated with the request of the tenant are determined as each Tenant-supplied quantum keys, including: According to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant, determine the required quantum key between each pair of distribution nodes corresponding to each tenant request quantity; According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes . The amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and determines the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request; According to the comparison result between the theoretical quantum key storage amount and the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes; According to the comparison result of the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, the quantum key provided for each tenant is determined. 3. The method according to claim 2, wherein the quantum key available between each pair of distribution nodes is determined according to the comparison result of the theoretical quantum key storage amount and the quantum key storage amount threshold amount, including: When the theoretical quantum key storage volume is greater than the quantum key storage volume threshold, determine the quantum key storage volume threshold available between each pair of distribution nodes and select the quantum key storage volume threshold; When the theoretical quantum key storage amount is less than or equal to the quantum key storage amount threshold, determine the quantum key amount available between each pair of distribution nodes and select the theoretical quantum key storage amount. 4. The method according to claim 3, wherein, according to the comparison result of the quantum key amount available between each pair of distribution nodes and the required quantum key amount between each pair of distribution nodes, it is determined as each tenant. Supplied quantum keys, including: When the amount of quantum keys available between each pair of distribution nodes is greater than or equal to the required amount of quantum keys between each pair of distribution nodes, the required amount of quantum keys is selected from the corresponding distribution nodes, and supplied to the tenant to request the corresponding amount of quantum keys node. 5. The method according to claim 4, wherein the method further comprises: Monitor and update the real-time remaining quantum key amount between each pair of distribution nodes in the quantum key distribution network. 6. A multi-tenant quantum key supply device, comprising: The network information acquisition module is used to acquire the parameter information of the quantum key distribution network; A tenant recording and query module, configured to record the parameter information of each tenant request and query the quantum key information associated with the tenant request after receiving multiple tenant requests; The quantum key supply module is used for the parameter information of the quantum key distribution network obtained by the network information obtaining module, the parameter information requested by each tenant recorded by the tenant record and the query module, and the queried relationship with the tenant. Request the associated quantum key information to determine the quantum key provided for each tenant; The network information acquisition module includes: The topology information acquisition module is used to acquire the topology information of the quantum key distribution network; The rate information acquisition module is used to acquire the quantum key generation rate between each pair of distribution nodes; The storage information acquisition module is used to acquire the quantum key storage threshold between each pair of distribution nodes; The reserved information acquisition module is used to acquire the quantum key reserved storage capacity between each pair of distribution nodes; The tenant record and query module includes: The node record module is used to record the node set requested by each tenant; Time recording module to record the arrival time and duration of each tenant request; The demand recording module is used to record the quantum key demand between each pair of distribution nodes in the node set requested by each tenant; The query module is used to query the information of the previous tenant's request for quantum key supply between each pair of distribution nodes, and the quantum key amount remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant. 7. The device according to claim 6, wherein the quantum key supply module comprises: A computing module, configured to determine the interval between each pair of distribution nodes corresponding to each tenant request according to the arrival time and duration of each tenant request, and the quantum key requirement between each pair of distribution nodes in the node set requested by each tenant The required quantum key amount; According to the quantum key generation rate between each pair of distribution nodes, the reserved storage capacity of quantum keys, the arrival time and duration of each tenant's request, and the information of the previous tenant's request for quantum key supply between each pair of distribution nodes . The amount of quantum keys remaining after each pair of distribution nodes requests the supply of quantum keys for the previous tenant, and determines the theoretical quantum key storage capacity between each pair of distribution nodes corresponding to each tenant's request; The judgment module is used for judging whether the theoretical quantum key storage amount is greater than the quantum key storage amount threshold, and judging whether the quantum key amount available between each pair of distribution nodes is greater than or equal to the required quantum key amount between each pair of distribution nodes ; a decision module, configured to determine the quantum key amount available between each pair of distribution nodes according to the comparison result of the theoretical quantum key storage amount and the quantum key storage amount threshold in the judgment module; The execution module is configured to determine the amount of quantum keys available between each pair of distribution nodes in the decision module, and the amount of quantum keys available between each pair of distribution nodes in the judgment module and the amount of quantum keys available between each pair of distribution nodes. The results of the comparison of the required quantum keys amount to determine the quantum keys supplied for each tenant. 8. The device according to claim 6, wherein the quantum key supply module further comprises: a monitoring module for monitoring and updating the real-time remaining quantum key between each pair of distribution nodes in the quantum key distribution network quantity.

Images