HK1233078A - Method, device and system for outputting quantum key and method, device and system for verifying memeory consistency of quantum key - Google Patents

Description

Quantum key output method, storage consistency verification method, device and system

Technical Field

The application relates to a quantum key output technology, in particular to a quantum key output method and device. The application also relates to a quantum key obtaining method and device, a quantum key storage output method and device, a quantum key distribution storage method and device, a quantum key output system, and a method and device for verifying quantum key storage consistency.

Background

In order to ensure the security of data transmission, the data device of the sending party usually uses an encryption algorithm to encrypt, and the data device of the receiving party uses a corresponding decryption algorithm to decrypt the received data. The classic cryptography can well solve the data security transmission problem for a long time, but the security of the classic cryptography is based on the computational complexity, and the classic cryptography faces a great risk of being cracked along with the rapid improvement of the computing power of cloud computing, quantum computing and the like. The quantum cryptography is a cross product of quantum mechanics and cryptography, the safety of the quantum cryptography is guaranteed based on the quantum mechanics principle (the inaccurate measurement principle, the collapse measurement principle and the unclonable principle of unknown quantum states), the quantum cryptography is unrelated to the calculation capacity and the storage capacity of an attacker, and the safety guarantee can be well provided for data transmission; in addition, since the quantum key belongs to a symmetric key, the computation cost for performing data encryption and decryption operations is low, and the execution efficiency is high, so that the quantum key becomes an ideal choice for data secure transmission.

Please refer to fig. 1, which is a schematic diagram of a quantum key output system. The basic process of data secure transmission using quantum keys is as follows: the quantum key distribution equipment at the sender and the receiver negotiates a quantum key through a quantum key distribution protocol, and provides the quantum key stored in the same address interval to corresponding key management equipment according to the requirement of the key management equipment; the key management devices of the transmitting side and the receiving side store the received quantum keys in the same address interval, and output the quantum keys stored in the same address interval to the data device according to the key acquisition request of the corresponding data device, the data device of the transmitting side performs encryption transmission on data to be transmitted by using the acquired quantum keys, and the data device of the receiving side decrypts the received data by using the acquired quantum keys, so that efficient and safe transmission of the data is realized.

In practical application, the above treatment process has the following defects:

(1) when the quantum key acquired by the quantum key distribution device is sent and written into the corresponding quantum key management device, due to network packet loss, hard disk data write error and other reasons, the quantum keys output by the key management devices of the transmitting and receiving parties to the data devices of the transmitting and receiving parties according to the same storage address may not be the same, which is also called as asymmetry or inconsistency, so that the data device of the receiving party cannot execute correct decryption operation, and thus correct original data cannot be acquired;

(2) when the number of times that the quantum keys acquired by the data devices of the two transceivers are inconsistent exceeds a preset threshold, the quantum key management devices of the two transceivers usually empty all the acquired quantum keys in a restarting manner and other manners, so that the problem of inconsistency of the output quantum keys can be solved, which is a waste of the generated quantum keys.

Disclosure of Invention

The embodiment of the application provides a quantum key output method and device, which are used for solving the problem that the quantum keys output by the existing key management equipment of the transmitting side and the receiving side are inconsistent. The embodiment of the application also provides a quantum key obtaining method and device, a quantum key storage output method and device, a quantum key distribution storage method and device, a quantum key output system and a method and device for verifying quantum key storage consistency.

The application provides a quantum key output method, which comprises the following steps:

the data equipment of the transmitting and receiving parties respectively sends a key obtaining request to the respective key management equipment;

after receiving the key acquisition request, the key management devices of the transmitting and receiving parties send the quantum keys passing the consistency verification to the corresponding data devices for the corresponding data devices to execute data encryption and decryption operations;

the consistency verification means that after the key management devices of the two transmitting and receiving parties store the quantum keys acquired from the quantum key distribution devices corresponding to the key management devices in the same address interval, the key management devices verify whether the quantum keys stored in the same address interval are the same; if the two are the same, the consistency verification is considered to be passed.

Optionally, the method includes:

the quantum key distribution device corresponding to the key management devices of the two parties of the transceiver stores the quantum key obtained through negotiation of the quantum key distribution protocol in the same address interval, verifies the consistency of the quantum keys stored in the same address interval by the two parties, and takes the quantum key passing the consistency verification as the quantum key which can be obtained by the corresponding key management device.

Optionally, the quantum key passing the consistency verification is pre-stored in the key management devices of the two parties before the data devices of the two parties send the key obtaining request;

correspondingly, before the data devices of the transmitter and the receiver respectively send the key acquisition requests to the key management devices, the following operations are executed:

the quantum key distribution equipment of the two parties of the transceiver negotiates a quantum key through a quantum key distribution protocol, and stores the quantum key by adopting the same address interval;

the key management equipment of the transmitting and receiving parties sends a key acquisition request to the respective quantum key distribution equipment;

the quantum key distribution equipment of the transmitting and receiving parties sends the quantum key stored in the same address interval to the corresponding key management equipment;

the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval and verifies the consistency of the quantum keys stored in the same address interval by the transmitting and receiving parties;

correspondingly, the sending the quantum key passing the consistency verification to the corresponding data device comprises:

and the key management equipment of the transmitting and receiving parties selects the quantum keys stored in the same address interval from the quantum keys passing the consistency verification and sends the quantum keys to the corresponding data equipment.

Optionally, before executing that the key management devices of the two transceivers send a key obtaining request to their respective quantum key distribution devices, the following operations are executed:

and the quantum key distribution devices of the transmitting and receiving parties inform the respective key management devices of the quantity of the quantum keys available for acquisition.

Optionally, after the key management device of the both transceiver and receiver receives the key obtaining request and before the quantum key passing the consistency verification is sent to the corresponding data device, the following operations are performed:

the key management devices of the two transmitting and receiving parties respectively send the key acquisition requests to the respective quantum key distribution devices;

the quantum key distribution equipment of the two parties of the transceiver negotiates a quantum key through a quantum key distribution protocol, and stores the quantum key by adopting the same address interval;

the quantum key distribution equipment of the transmitting and receiving parties sends the quantum key stored in the same address interval to the corresponding key management equipment;

the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval and verifies the consistency of the quantum keys stored in the same address interval by the transmitting and receiving parties;

correspondingly, the sending the quantum key passing the consistency verification to the corresponding data device comprises:

and the key management equipment of the transmitting and receiving parties selects the quantum keys stored in the same address interval from the quantum keys passing the consistency verification and sends the quantum keys to the corresponding data equipment.

Optionally, when the key management devices of the two transceivers verify that the quantum keys stored in the same address interval are inconsistent, the following operations are performed:

and clearing the quantum keys stored in the same address interval, and transmitting a key acquisition request to respective quantum key distribution equipment to execute the steps.

Optionally, after the quantum key distribution devices of the two transceivers negotiate a quantum key through a quantum key distribution protocol and store the quantum key in the same address interval, the following operations are performed:

and the quantum key distribution equipment of the transmitting and receiving parties verifies the consistency of the quantum keys stored in the same address interval and takes the quantum keys passing the consistency verification as the quantum keys capable of being sent to the key management equipment.

Optionally, when the quantum key distribution device of the two transceivers verifies that the quantum keys stored in the same address interval are inconsistent, the following operations are performed:

and clearing the quantum key stored in the same address interval, and executing the steps that the quantum key distribution devices of the receiving and forwarding parties negotiate the quantum key through a quantum key distribution protocol.

Optionally, the method includes: and the quantum key distribution equipment of the both transmitting and receiving parties regularly executes the operation of verifying the consistency of the quantum keys stored in the same address interval by the both transmitting and receiving parties.

Optionally, the quantum key distribution device of the two transceivers verifies the consistency of the quantum keys stored in the same address interval by the two transceivers, and the key management device of the two transceivers verifies the consistency of the quantum keys stored in the same address interval by the two transceivers, respectively implemented by the following manners:

one of the two pieces of equipment adopts a preset hash algorithm to calculate the hash value of the quantum key stored in the address interval, adopts the quantum key which is obtained by the two pieces of equipment in the previous time and passes consistency verification to encrypt the hash value and the address interval information, and sends the encrypted information to the other piece of equipment;

and the other party equipment decrypts the received information by adopting the corresponding secret key to obtain address interval information, calculates the hash value of the quantum secret key stored in the local corresponding address interval by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value or not, returns a verification passing response to the other party equipment if the calculated hash value is the same as the received hash value, and returns a non-passing response if the calculated hash value is not the same as the received hash value.

Optionally, after the key management device of the transmitting and receiving parties sends the quantum key to the corresponding data device, the following operations are performed:

and the data equipment of the transmitting side and the receiving side verifies the consistency of the received quantum key, and takes the quantum key passing the consistency verification as a key used for executing data encryption and decryption operation.

Optionally, when the quantum keys obtained by the data devices of the two transceivers are not consistent, the step of sending a key obtaining request to the key management device of the data devices of the two transceivers is carried out.

Optionally, the verifying, by the data device of the both transceivers, the consistency of the obtained quantum key includes:

one of the two pieces of equipment adopts a preset hash algorithm to calculate the hash value of the obtained quantum key, adopts the quantum key which is obtained by the two pieces of equipment at the previous time and passes consistency verification to encrypt the hash value, and sends the encrypted information to the other piece of equipment;

and after the other party equipment decrypts the received information by adopting the corresponding key, the hash value of the locally acquired quantum key is calculated by adopting the preset hash algorithm, whether the calculated hash value is the same as the received hash value or not is judged, if so, a verification passing response is returned to the other party equipment, and otherwise, a non-passing response is returned.

Optionally, the quantum key obtained by the quantum key distribution device of the both transceiver and receiver through negotiation of the quantum key distribution protocol has a key tag sequence corresponding thereto, and each key tag in the key tag sequence is a unique identifier of a different quantum bit in the quantum key;

correspondingly, after the quantum key distribution equipment of the transmitting and receiving parties stores the quantum key by adopting the same address interval, the following operations are executed: establishing a one-to-one correspondence relationship between the storage address of each quantum bit and the key label;

the information sent to the corresponding key management equipment by the quantum key distribution equipment of the both sides of the transceiver not only comprises the quantum key, but also comprises a key label sequence corresponding to the quantum key; after the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval, the following operations are executed: establishing a one-to-one correspondence relationship between the storage address of each quantum bit and the key label;

the quantum key distribution equipment of the two parties of the transceiver verifies the consistency of the quantum keys stored in the same address interval by the two parties, and the key management equipment of the two parties of the transceiver verifies the consistency of the quantum keys stored in the same address interval by the two parties of the transceiver, which are respectively realized by adopting the following modes:

one device calculates a hash value of a character string formed by splicing a key label sequence of the quantum key and an address sequence formed by a storage address of each quantum bit in the quantum key by adopting a preset hash algorithm, encrypts the hash value and the address sequence or encrypts the hash value and the key label sequence by adopting the quantum key which is acquired by the two devices at the previous time and passes consistency verification, and sends the encrypted information to the other device;

and after the other party equipment decrypts by adopting the corresponding key, acquiring a corresponding key label sequence from the local according to the extracted address sequence, or acquiring a corresponding address sequence from the local according to the extracted key label sequence, calculating a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the other party equipment, and otherwise, returning a non-passing response.

Optionally, the information sent by the key management device of the transmitting and receiving parties to the corresponding data device includes not only the quantum key but also a key tag sequence of the quantum key;

correspondingly, after receiving the information sent by the respective key management devices, the data devices of the two transceivers execute the following operations to verify the consistency of the quantum keys acquired by the data devices of the two transceivers, and if the quantum keys do not agree, the data devices of the two transceivers switch to the steps of sending key acquisition requests to the respective key management devices to execute:

one of the two devices adopts a preset hash algorithm to calculate a hash value of a character string formed by splicing the acquired quantum key and the key label sequence, adopts a quantum key which is acquired by the two devices at the previous time and passes consistency verification to encrypt the hash value and the key label sequence, and sends encrypted information to the other device;

and after the other party equipment decrypts by adopting the corresponding key, acquiring the corresponding quantum key from the local according to the extracted key label sequence, calculating the hash value of the character string formed by splicing the quantum key and the key label sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value or not, if so, returning a verification passing response to the other party equipment, and otherwise, returning a non-passing response.

Optionally, the key tag includes: and timestamp information of the quantum bit, wherein the timestamp information is acquired by quantum key distribution equipment of the transmitting party and the receiving party in the process of negotiating the quantum key.

Optionally, the interaction process between the devices via the classical channel is based on HTTPS connection.

Optionally, before interaction, each device performs bidirectional identity authentication, and performs subsequent interaction operation after authentication is passed.

Correspondingly, the present application also provides a quantum key output device, including:

the data equipment key request unit is used for sending and receiving the key acquisition requests to the respective key management equipment by the data equipment of both sides;

and the management device key output unit is used for sending the quantum key which is acquired from the corresponding quantum key distribution device and passes the consistency verification of the key management devices of the transmitting and receiving parties to the corresponding data device after the key management devices of the transmitting and receiving parties receive the key acquisition request, so that the corresponding data device can execute data encryption and decryption operation.

Optionally, the apparatus includes: a distribution device key agreement verification unit;

and the key negotiation verification unit of the distribution equipment is used for storing the quantum keys acquired through the quantum key distribution protocol negotiation in the same address interval with the quantum key distribution equipment corresponding to the key management equipment of the both sides of the transmitter and the receiver, verifying the consistency of the quantum keys stored in the same address interval by the both sides of the receiver and the transmitter, and taking the quantum keys which pass the consistency verification as the quantum keys which can be acquired by the corresponding key management equipment.

Optionally, the apparatus includes a distribution device key negotiation unit, a management device key request unit, a distribution device key sending unit, and a management device key verification unit, and the units are started before the data device key request unit operates:

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the management device key request unit is used for sending and receiving key acquisition requests to the respective quantum key distribution devices by the key management devices of the two parties;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select quantum keys stored in the same address interval from quantum keys passing consistency verification after the key acquisition requests are received by the key management devices of the transmitting and receiving parties, and send the quantum keys to corresponding data devices.

Optionally, the apparatus includes:

the management equipment key request forwarding unit is used for sending the key acquisition requests to the respective quantum key distribution equipment by the key management equipment of the receiving and sending parties after the data equipment key request unit receives the key acquisition requests;

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select, from the quantum keys passing the consistency verification, the quantum keys stored in the same address interval by the key management devices of the transmitting and receiving parties, and send the quantum keys to the corresponding data device.

Optionally, the apparatus includes:

a management device key clearing unit, configured to, when the verification result of the management device key verification unit is: and when the quantum key does not pass the verification, the key management devices of the transmitting and receiving parties remove the quantum key stored in the verified same address interval, and trigger units for respectively sending key acquisition requests to the respective quantum key distribution devices by the key management devices of the transmitting and receiving parties to work.

Optionally, the apparatus includes:

and the distribution equipment key verification unit is used for verifying the consistency of the quantum keys stored in the same address interval by the receiving and sending party quantum key distribution equipment after the distribution equipment key negotiation unit finishes the quantum key negotiation process and adopts the same address interval to store the quantum keys, and taking the quantum keys passing the consistency verification as the quantum keys capable of being sent to the key management equipment.

Optionally, the apparatus includes:

a distribution device key clearing unit configured to, when the verification result of the distribution device key verification unit is: and when the quantum key does not pass the verification, the quantum key distribution equipment of the transmitting and receiving parties clears the quantum key stored in the verified same address interval and triggers the key negotiation unit of the distribution equipment to work.

Optionally, the distribution device key verification unit and the management device key verification unit each include a verification request subunit and a verification execution subunit;

the verification request subunit is configured to calculate, by using a preset hash algorithm, a hash value of the quantum key stored in the address interval by one device participating in verification, encrypt the hash value and the address interval information by using a quantum key which is obtained by the two devices participating in verification and passes consistency verification in the previous time, and send the encrypted information to the other device participating in verification;

the verification execution subunit is configured to, after decrypting the received information by using the corresponding key, obtain address interval information, calculate, by using the preset hash algorithm, a hash value of the quantum key stored in the local corresponding address interval, determine whether the calculated hash value is the same as the received hash value, if so, return a verification-passing response to the other party device participating in the verification, and otherwise, return a non-passing response.

Optionally, the apparatus includes:

and the data equipment key verification unit is used for verifying the consistency of the received quantum keys by the data equipment of the receiving and sending parties after the management equipment key output unit sends the quantum keys to the corresponding data equipment, and taking the quantum keys passing the consistency verification as keys adopted for executing data encryption and decryption operations.

Optionally, the distribution device key negotiation unit negotiates the obtained quantum key through a quantum key distribution protocol, and has a key tag sequence corresponding to the quantum key; accordingly, the method can be used for solving the problems that,

the key negotiation unit of the distribution equipment comprises a mapping relation establishing subunit besides an ontology subunit for realizing the functions of the key negotiation unit, wherein the mapping relation establishing subunit is used for establishing the one-to-one corresponding relation between the storage address of each quantum bit and the key label;

the information sent to the management device key verification unit by the distribution device key sending unit not only comprises a quantum key, but also comprises a key tag sequence corresponding to the quantum key;

the management equipment key verification unit comprises a storage subunit, a management equipment key verification subunit and a mapping relation establishment subunit; the storage subunit is used for storing the received quantum key in the same address interval by the key management devices of the transmitting party and the receiving party; the mapping relation establishing subunit is used for establishing a one-to-one correspondence relation between the storage address of each quantum bit and the key label and triggering the key verification subunit of the management equipment to work; the management device key verification subunit is used for verifying the consistency of quantum keys stored in the same address interval by the two parties;

the distribution equipment key verification unit and the management equipment key verification subunit respectively comprise a label verification request subunit and a label verification execution subunit;

the label verification request subunit is used for one party of equipment participating in verification to calculate a hash value of a character string formed by splicing a key label sequence of the quantum key and an address sequence formed by a storage address of each quantum bit in the quantum key by adopting a preset hash algorithm, and to encrypt the hash value and the address sequence or encrypt the hash value and the key label sequence by adopting a quantum key which is acquired by two parties of equipment participating in verification and passes consistency verification in the previous time, and to send the encrypted information to the other party of equipment participating in verification;

and the tag verification execution subunit is used for decrypting the encrypted information by adopting a corresponding key after the other party equipment receives the encrypted information, locally acquiring a corresponding key tag sequence according to the extracted address sequence, or locally acquiring a corresponding address sequence according to the extracted key tag sequence, calculating a hash value of a character string formed by splicing the key tag sequence and the address sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the other party equipment participating in verification, and otherwise, returning a non-passing response.

In addition, the present application also provides a quantum key obtaining method, which is implemented on a data device that encrypts and decrypts data by using a quantum key, and includes:

sending a key acquisition request to the key management device;

and receiving the quantum key which passes the consistency verification and is sent by the key management equipment as a key for encrypting and decrypting data.

Optionally, after receiving the quantum key that passes the consistency verification and is sent by the key management device, the following operations are performed:

and verifying the consistency of the obtained quantum key and the quantum key obtained by the opposite-end data equipment, and using the quantum key passing through the consistency verification as a key for encrypting and decrypting data.

Optionally, if the obtained quantum key and the quantum key obtained by the peer data device do not pass consistency verification, the step of sending the quantum key obtaining request to the key management device is performed.

Correspondingly, the present application further provides a quantum key obtaining apparatus, where the apparatus is deployed on a data device that encrypts and decrypts data by using a quantum key, and includes:

a key acquisition request sending unit configured to send a key acquisition request to the key management device;

and the symmetric key receiving unit is used for receiving the quantum key which passes the consistency verification and is sent by the key management equipment, and the quantum key is used as a key for encrypting and decrypting data.

In addition, the present application also provides a quantum key storage output method implemented on a key management device that provides a quantum key to a data device, including:

receiving a key acquisition request sent by data equipment;

and sending the quantum key passing the consistency verification to the data equipment according to the same address interval negotiated with the opposite-end key management equipment.

Optionally, the quantum key passing consistency verification is pre-stored before receiving a key acquisition request sent by the data device;

correspondingly, before receiving the key acquisition request sent by the data device, the following operations are performed:

sending a key acquisition request to quantum key distribution equipment;

receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device, and taking the quantum key passing the consistency verification as the quantum key capable of being sent to the data device.

Optionally, after receiving the key obtaining request sent by the data device, before sending the quantum key passing the consistency verification to the data device according to the same address interval negotiated with the opposite-end key management device, the following operations are performed:

sending the key acquisition request to quantum key distribution equipment;

receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device.

Optionally, if the quantum key stored in the address interval and the quantum key stored in the same address interval by the peer management device do not pass consistency verification, the following operations are performed:

and clearing the quantum key stored in the address interval, and transmitting a key acquisition request to the quantum key distribution equipment to execute the step.

Accordingly, the present application also provides a quantum key storage output apparatus, which is disposed on a key management device that provides a quantum key to a data device, and includes:

a key acquisition request receiving unit, configured to receive a key acquisition request sent by a data device;

and the symmetric key output unit is used for sending the quantum key passing the consistency verification to the data equipment according to the same address interval negotiated with the opposite-end key management equipment.

In addition, the present application also provides a quantum key distribution storage method, which is implemented on a quantum key distribution device, and includes:

negotiating a quantum key with an opposite-end quantum key distribution device through a quantum key distribution protocol, and storing the obtained quantum key in the same address interval as the opposite-end quantum key distribution device;

verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end quantum key distribution equipment;

and according to a received key acquisition request from the key management device, sending the quantum key passing the consistency verification to the key management device according to the same address interval negotiated with the opposite-end quantum key distribution device.

Optionally, if the quantum key stored in the address interval and the quantum key stored in the opposite-end quantum key distribution device in the same address interval do not pass consistency verification, the following operations are performed:

and clearing the quantum key stored in the address interval, and transferring to the step of negotiating the quantum key with the opposite-end quantum key distribution equipment through a quantum key distribution protocol.

Correspondingly, the present application also provides a quantum key distribution storage apparatus, where the apparatus is deployed on a quantum key distribution device, and includes:

the key distribution storage unit is used for negotiating a quantum key with opposite-end quantum key distribution equipment through a quantum key distribution protocol and storing the obtained quantum key in the same address interval as the opposite-end quantum key distribution equipment;

the key verification unit is used for verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end quantum key distribution equipment;

and the symmetric key sending unit is used for sending the quantum key passing the consistency verification to the key management equipment according to the key acquisition request received from the key management equipment and the same address interval negotiated with the opposite-end quantum key distribution equipment.

In addition, the present application also provides a quantum key output system, including: two subsystems respectively deployed at a transmitting side and a receiving side; the two subsystems respectively comprise: the quantum key acquisition device according to any one of the above items, the quantum key storage output device according to any one of the above items, and the quantum key distribution storage device according to any one of the above items.

In addition, the present application also provides a method for verifying quantum key storage consistency, where the method is implemented on a first device and a second device participating in verification, and includes:

the first equipment sends information which is acquired through a quantum key negotiation process and represents a quantum key to be verified and address interval information which stores the quantum key to be verified to the second equipment;

the second device compares the received information with corresponding local information to judge whether the information corresponding to the address interval and representing the quantum key to be verified of the two devices is the same, if so, a verification passing response is returned to the first device, otherwise, a non-passing response is returned;

the information for representing the quantum key to be verified is composed of sub-information units corresponding to the bit number of the quantum key, and each sub-information unit is a unique identifier of different quantum bits in the quantum key to be verified and corresponds to the storage address of the identified quantum bit one by one.

Optionally, the information characterizing the quantum key to be verified includes: the quantum key itself to be verified;

correspondingly, the sending, by the first device, information representing the quantum key to be verified, which is obtained through the quantum key agreement process, and address interval information storing the quantum key to be verified to the second device includes:

the first device calculates a hash value of the quantum key to be verified by adopting a preset hash algorithm, and sends the hash value and the address interval information to the second device;

the second device compares the received information with corresponding local information to determine whether the information representing the quantum key to be verified, corresponding to the address interval, of the two devices is the same as the information representing the quantum key to be verified, and the method includes:

the second device extracts address interval information for storing the quantum key to be verified from the received information, calculates the hash value of the quantum key stored in the local same address interval by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, and judges that the information corresponding to the address interval and representing the quantum key to be verified of the two devices is the same if the calculated hash value is the same as the received hash value.

Optionally, the information characterizing the quantum key to be verified includes: a key label sequence of the quantum key to be verified, wherein each key label in the key label sequence is the sub-information unit; the address interval information for storing the quantum key to be verified comprises: an address sequence formed by the storage address of each quantum bit in the quantum key to be verified;

correspondingly, the sending, by the first device, information representing the quantum key to be verified, which is obtained through the quantum key agreement process, and address interval information storing the quantum key to be verified to the second device includes:

the first device calculates a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting a preset hash algorithm, and sends the hash value and the address sequence or the hash value and the key label sequence to the second device;

the second device compares the received information with corresponding local information to determine whether the information representing the quantum key to be verified, corresponding to the address interval, of the two devices is the same as the information representing the quantum key to be verified, and the method includes:

and the second equipment acquires a corresponding key label sequence from the local according to the address sequence extracted from the received information, or acquires a corresponding address sequence from the local according to the extracted key label sequence, calculates a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, and judges that the information which corresponds to the address interval and represents the quantum key to be verified of the two equipment is the same if the calculated hash value is the same as the received hash value.

Optionally, the key tag includes: time stamp information of the qubit.

Optionally, the method further includes:

the first equipment encrypts information to be sent by adopting a key agreed with the second equipment in advance;

correspondingly, after receiving the information sent by the first device, the second device performs subsequent comparison and judgment operations after decrypting the information by using the corresponding key.

Correspondingly, the application also provides a device for verifying the storage consistency of the quantum key, which comprises the following steps:

a key verification request sending unit, configured to send, by a first device, information representing a quantum key to be verified, which is obtained through a quantum key agreement process, and address interval information in which the quantum key to be verified is stored, to a second device;

the key verification execution unit is used for comparing the received information with local corresponding information by the second equipment, judging whether the information corresponding to the address interval and representing the quantum key to be verified of the two pieces of equipment is the same, if so, returning a verification passing response to the first equipment, and otherwise, returning a non-passing response;

the information for representing the quantum key to be verified is composed of sub-information units corresponding to the bit number of the quantum key, and each sub-information unit is a unique identifier of different quantum bits in the quantum key to be verified and corresponds to the storage address of the identified quantum bit one by one.

Compared with the prior art, the method has the following advantages:

according to the quantum key output method and system, the data devices of the two transmitting and receiving parties respectively send key obtaining requests to the key management devices of the two transmitting and receiving parties, and after the key management devices of the two transmitting and receiving parties receive the key obtaining requests, the quantum keys passing consistency verification are sent to the corresponding data devices, and the corresponding data devices execute data encryption and decryption operations. The key management devices of the transmitter and the receiver carry out consistency verification on the quantum keys stored in the same address interval, so that the synchronism and the usefulness of the quantum keys output by a quantum key output system are ensured, namely: the quantum keys output to the data device are identical and symmetrical, so that the correct execution of the data encryption and decryption process is guaranteed. In particular, even if the quantum keys acquired by the data transmitting and receiving parties are asymmetric due to network transmission and other reasons, the quantum keys stored by the quantum key management devices of the transmitting and receiving parties do not need to be emptied in a restarting mode and other modes, and therefore waste of quantum key resources is avoided.

According to the method for verifying the storage consistency of the quantum keys, the two pieces of equipment participating in verification judge whether the quantum keys stored in the same address interval by the two pieces of equipment are the same or not by comparing the two pieces of equipment with the information corresponding to the same address interval and representing the quantum keys to be verified, so that a basis is provided for the two pieces of equipment to output symmetric quantum keys outwards, and guarantee is provided for safe and efficient transmission of user data. Particularly, by adopting the verification method based on the key label, the characteristic that the quantum bit can be uniquely identified by the key label and the corresponding relation between the key label and the storage address of the quantum bit are utilized, so that the consistency verification can be realized without transmitting the quantum key, and the safety of the quantum key is further ensured.

Drawings

Fig. 1 is a schematic diagram of a quantum key output system provided by an embodiment of the present application;

FIG. 2 is a flow chart of an embodiment of a quantum key output method of the present application;

fig. 3 is a processing flow chart of a quantum key output method based on a real-time acquisition mode according to an embodiment of the present application;

fig. 4 is a flowchart of interaction between devices based on a real-time acquisition mode according to an embodiment of the present application;

fig. 5 is a processing flow chart of a quantum key output method based on a pre-acquisition manner according to an embodiment of the present application;

fig. 6 is a flowchart of interaction between devices based on a pre-acquisition mode according to an embodiment of the present application;

FIG. 7 is a schematic diagram of an embodiment of a quantum key output device of the present application;

FIG. 8 is a flow chart of an embodiment of a quantum key acquisition method of the present application;

fig. 9 is a schematic diagram of an embodiment of a quantum key acquisition apparatus of the present application;

FIG. 10 is a flow chart of an embodiment of a quantum key storage output method of the present application;

FIG. 11 is a schematic diagram of an embodiment of a quantum key storage output device of the present application;

FIG. 12 is a flow diagram of an embodiment of a quantum key distribution storage method of the present application;

FIG. 13 is a schematic diagram of an embodiment of a quantum key distribution storage apparatus of the present application;

FIG. 14 is a schematic diagram of an embodiment of a quantum key output system of the present application;

FIG. 15 is a flow diagram of one embodiment of a method for verifying quantum key memory consistency of the present application;

FIG. 16 is a schematic diagram of an embodiment of an apparatus for verifying quantum key storage consistency according to the present application.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. This application is capable of implementation in many different ways than those herein set forth and of similar import by those skilled in the art without departing from the spirit and scope of this application, and it is therefore not limited to the specific implementations disclosed below.

In the present application, a method and an apparatus for quantum key output, a method and an apparatus for quantum key acquisition, a method and an apparatus for quantum key storage output, a method and an apparatus for quantum key distribution storage, a system for quantum key output, and a method and an apparatus for verifying quantum key storage consistency are provided, and detailed descriptions are made in the following embodiments one by one. Before describing the embodiments in detail, various devices and two main processing flows related to the present technical solution will be briefly described.

Referring to fig. 1, a schematic diagram of a quantum key output system is shown. From the perspective of data encryption and decryption transmission, the quantum key output system comprises two symmetrical sides, wherein one side comprises: quantum Key Distribution equipment QKD-A (Quantum Key Distribution is QKD for short), Key management equipment QKS-A (Quantum Key System is QKS for short), data equipment A, the other side includes: quantum key distribution device QKD-B, key management device QKS-B, data device B. For convenience of description, an expression manner of devices of both the transmitting and receiving parties is adopted in the present application, for example, a quantum key distribution device of both the transmitting and receiving parties, a key management device of both the transmitting and receiving parties, and a data device of both the transmitting and receiving parties.

The QKD devices of both the transmitting and receiving parties are used for performing quantum key agreement, the QKS devices of both the transmitting and receiving parties are used for storing the quantum key obtained from the QKD devices and outputting the quantum key to the data devices, and the data devices of both the transmitting and receiving parties respectively perform corresponding data encryption or data decryption operations by using the obtained quantum key. Aiming at the problem that quantum keys output by QKS devices of a transmitting and receiving party to data devices of the transmitting and receiving party are asymmetric due to the possibility of packet loss in the network transmission process between a QKD device and an QKS device and the possibility of errors in the process of storing the quantum keys by the QKS device, the technical scheme of the application verifies the consistency of the quantum keys between the QKS devices of the transmitting and receiving party and sends the quantum keys passing the consistency verification to the data devices, so that the quantum keys output to the data devices of the transmitting and receiving party are guaranteed to be symmetric from the perspective of QKS devices.

The description that follows herein also proceeds on the basis of the architecture shown in fig. 1. It should be noted that the schematic diagram is described from the perspective of outputting quantum keys, in an actual implementation, the QKD devices of both transceivers, the QKS devices of both transceivers, and the data devices of both transceivers may be connected through a classical channel in the form of wire or wireless, etc., for performing operations such as negotiation and data transmission between each other, and this connection relationship is not shown in the figure.

Please refer to fig. 2, which is a flowchart illustrating an embodiment of a quantum key output method according to the present application, the method includes the following steps:

step 201, the data devices of the both sides of the transceiver respectively send key obtaining requests to the respective key management devices.

Step 202, after receiving the key obtaining request, the key management devices of the transmitting and receiving parties send the quantum key passing the consistency verification to the corresponding data device, so that the corresponding data device performs data encryption and decryption operations.

In the process of implementing the method specifically, the data device may acquire the secret key from the secret key management device in a manner of acquiring the quantum secret key in real time (for short, a real-time acquisition manner), or in a manner of acquiring the quantum secret key in advance (for short, a pre-acquisition manner). The real-time acquisition mode is that the data device a and the data device B send requests for acquiring quantum keys to the QKS-a device and the QKS-B device respectively, and at this time, the QKS-a device and the QKS-B device already have pre-stored quantum keys which pass through consistency verification and can directly output the quantum keys to the data device a and the data device B.

The pre-acquisition mode is that a data device A and a data device B send requests for acquiring quantum keys to respective QKS-A devices and QKS-B devices, no pre-stored quantum key exists in QKS-A devices and QKS-B devices, the QKS-A devices and the QKS-B devices respectively forward the requests to QKD-A devices and QKD-B devices, the QKD-A devices and the QKD-B devices negotiate quantum key pairs for the data device A and the data device B through a quantum key distribution protocol and send the quantum key pairs to QKS-A devices and QKS-B devices, the QKS-A devices and the QKS-B devices carry out consistency verification on the stored quantum keys, and finally the quantum keys which pass the consistency verification are sent to the data device A and the data device B.

The two quantum key obtaining modes can realize the purpose of outputting the symmetric quantum key to the data device A and the data device B by carrying out the consistency verification of the quantum key between the QKS-A device and the QKS-B device. These two embodiments are described in the following in this embodiment, and it should be noted that in the embodiments described below, all the private information transmitted through the classical channel, for example: the quantum key information may be encrypted by using a key agreed by both communication parties, for example, the quantum key obtained by both communication parties at the previous time may be used for encryption, and for the initial transmission, a preset shared key may be used for encryption, which will not be described repeatedly below.

Please refer to fig. 3, which is a processing flowchart of the quantum key output method based on the real-time obtaining manner according to the embodiment of the present application, and for easy understanding, the embodiment also provides an interaction flowchart between devices based on the real-time obtaining manner, please refer to fig. 4. The method comprises the following steps:

step 301, the quantum key distribution devices of the both transceivers negotiate a quantum key through a quantum key distribution protocol, and store the quantum key by using the same address interval.

QKD-a and QKD-B devices negotiate a symmetric quantum key (this process is also referred to as a quantum key agreement process) via a quantum key distribution protocol, such as the BB84 protocol, and store the quantum key in the same address space of respective storage media, the storage media comprising: cache, disk, etc. The same address interval can be set by the QKD-a device and the QKD-B device through negotiation, or determined by the two parties in an accumulation manner according to the number of quantum keys obtained through the negotiation on the basis of the address interval used by the two parties for executing the storage operation last time, as long as the two parties can be guaranteed to store the quantum keys in the same address interval.

Considering that an abnormality such as a write data error may occur in the process of storing the quantum key by the QKD-a device or the QKD-B device, which causes asymmetry of the quantum keys stored in the same address interval by the QKD-a device and the QKD-B device, this embodiment provides a preferred embodiment: and the QKD-A device and the QKD-B device verify the consistency of quantum keys stored in the same address interval by both sides, and use the quantum keys passing the consistency verification as quantum keys capable of being sent to the key management device.

In a specific implementation, the hash values of the quantum keys stored in the same address interval by both parties may be compared, and since the quantum key consistency verification between QKD devices or QKS devices may be performed in the same manner, reference may be made to the relevant text in step 304 for this part of the description, and the description will not be repeated here.

Further, in the above verification method, the hash value of the quantum key needs to be transmitted over the network, and once the hash value is intercepted by a malicious attacker, the security of the quantum key has a certain hidden danger.

In order to implement the above preferred embodiment, the quantum key obtained by the QKD devices of the transmitting and receiving parties through the quantum key distribution protocol negotiation has a key tag sequence corresponding thereto, and each key tag in the key tag sequence is a unique identifier of a different quantum bit in the quantum key; and after the QKD devices of the transmitter and the receiver store the quantum key in the same address interval, establishing the one-to-one correspondence relationship between the storage address of each quantum bit and the key label.

In specific implementation, the timestamp information of each qubit can be used as the key tag, and the timestamp information of each qubit can be obtained in the process of negotiating the quantum key by the QKD devices of the transmitter and the receiver. For example, the quantum key negotiation process performed by the BB84 protocol is based on clock synchronization, each obtained qubit has unique timestamp information corresponding thereto, and the timestamp information of each qubit is different, so this embodiment may use the timestamp information of the qubit as its key tag.

Since the same key tag-based approach can be used for quantum key consistency verification between QKD devices, or between QKS devices, reference can be made to the associated written description in step 304 for this portion of the description, and a repeated description is not provided herein.

If the QKD-B device finds that the quantum keys stored in the same address interval by the two parties are different through verification, a failed response can be returned to the QKD-A device, and the QKD-A device and the QKD-B device can clear the quantum keys stored in the same address interval and negotiate the quantum keys through a quantum key distribution protocol again. In specific implementation, the QKD-a device and the QKD-B device may also overwrite the same address interval with a new quantum key obtained by the next quantum key agreement, instead of clearing the quantum key stored in the same address interval.

With the above-described preferred embodiment, after the QKD device stores the acquired quantum key each time, the consistency verification is performed, and the quantum key that passes the consistency verification is used as the quantum key that can be sent to the corresponding QKS device, so if the subsequent transceiver QKS device finds that the quantum key acquired from the corresponding QKD device is inconsistent, it can be generally considered as caused by network transmission abnormality (e.g., packet loss), and therefore, the transceiver QKS device can acquire the quantum key from the corresponding QKD device again, without having to clear all the stored quantum keys in the QKD-a device and the QKD-B device by restarting or the like, thereby reducing waste of the quantum key that has been acquired by the QKD device.

In order to further guarantee the consistency of the quantum keys stored by the QKD-A device and the QKD-B device, in specific implementation, the consistency of the quantum keys stored in the same address interval by the QKD-A device and the QKD-B device can be periodically verified according to preset interval time.

In addition, after the QKD-a device and the QKD-B device acquire quantum keys through a quantum key agreement process and store the quantum keys in the same address interval, a notification may also be sent to the corresponding QKS device to inform the corresponding QKS device of the number of quantum keys that are currently stored, so that the device QKS may refer to the quantum keys when sending the key acquisition request.

Step 302, the key management devices of the both sending and receiving parties send key obtaining requests to the respective quantum key distribution devices.

The QKS-a device and the QKS-B device may negotiate in advance that both sides acquire length information of a quantum key from respective QKD devices, and send a key acquisition request carrying the length information to the respective QKD devices.

Step 303, the quantum key distribution devices of the both sending and receiving parties send the quantum key stored in the same address interval to the corresponding key management device.

After receiving the key acquisition request, the QKD-a device and the QKD-B device may determine, in a negotiation manner, an address interval for quantum key extraction for the QKS device according to the key length information carried in the request, extract the quantum key according to the negotiated same address interval, and send the quantum key to the corresponding key management device.

If the quantum key consistency verification is performed between the QKD-a device and the QKD-B device in step 301, the QKD-a device and the QKD-B device in this step may determine, in a negotiation manner, an address interval for extracting the quantum key passing the consistency verification for the corresponding QKS device, then extract the quantum key according to the negotiated same address interval, and send the quantum key to the corresponding QKS device.

If QKS-A and QKS-B devices are to be quantum key consistency verified by the key labels in subsequent step 304, then in this step the QKD-A and QKD-B devices may send the quantum key to their respective QKS devices along with their key label sequences.

And step 304, the key management devices of the transmitting and receiving parties store the received quantum keys in the same address interval, and verify the consistency of the quantum keys stored in the same address interval by the both parties.

QKS-A device and QKS-B device store the received quantum key in the same address interval, the same address interval can be set by QKS-A device and QKS-B device through negotiation, or can be determined by both parties through accumulation according to the number of the quantum keys obtained by the negotiation on the basis of the address interval used by the last time of memory operation, as long as both parties can be guaranteed to store the obtained quantum keys in the same address interval.

The QKS-a device and the QKS-B device verify the consistency of quantum keys stored in the same address space by both parties and can be implemented in various ways, and several alternative ways are listed below.

1) The consistency verification is achieved by comparing the hash values of the quantum keys stored by both parties in the same address interval.

The QKS-A device adopts a preset hash algorithm to calculate the hash value of the quantum key stored in the address interval, then adopts the quantum key which is obtained by the two parties in the previous time and passes the consistency verification to encrypt the hash value and the address interval information, and sends the encrypted information to the other party; QKS-B equipment receives the information sent by QKS-A equipment, decrypts the information by adopting a corresponding key to obtain address interval information, calculates the hash value of the quantum key stored in the corresponding local address interval by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, returns a verification passing response to QSK-A if the calculated hash value is the same as the received hash value, and otherwise returns a non-passing response.

In specific implementation, the address interval information sent by the QKS-a device to the QKS-B device may include a head address and a tail address of the address interval, or may include a head address and an interval length, or a head address and a quantum key length to be verified for consistency, as long as the QKS-B device can know a specific address interval according to the received information; the preset hashing algorithm comprises SHA-1, SHA-2 or SHA-3 and other possible hashing algorithms as long as QKS-A equipment and QKS-B equipment adopt the same hashing algorithm; in order to ensure the security of the transmission process, the QKS-a device encrypts the information to be transmitted by using the quantum key which is obtained last time by the device and QKS-B device and passes the consistency verification, if the consistency verification is performed for the first time, the shared key preset by both sides can be used for encryption, and the corresponding QKS-B device also uses the preset shared key for decryption. In the implementation given above, the QKS-a device initiates the authentication process and the QKS-B device returns an authentication reply, in other implementations, the QKS-B device may also initiate the authentication process. The above-described various modifications of the embodiments are also applicable to the corresponding contents in the other two verification methods described below, and are not described in detail later.

2) And a first verification mode is performed by utilizing the corresponding relation between the key tag and the quantum bit storage position.

In order to avoid the potential safety hazard caused by the fact that the hash value of the quantum key to be verified is intercepted in the transmission process, the embodiment provides a preferred implementation mode for performing consistency verification by using the characteristic that the key tag can uniquely identify the quantum bit and the corresponding relation between the key tag and the storage position. With this preferred embodiment, the information obtained by the QKS-A device and the QKS-B device from their respective QKD devices includes not only the quantum key, but also a sequence of key labels for the quantum key, each key label in the sequence of key labels being a unique identification of a different quantum bit in the quantum key. QKS-A device and QKS-B device establish a one-to-one correspondence between the storage address of each quantum bit and the key label after storing the received quantum key in the same address interval.

For convenience of description, a key tag sequence of a quantum key to be verified on the QKS-a device side is denoted as Lab1, an address sequence composed of memory addresses of each qubit in the quantum key to be verified is denoted as Locate1, hash () represents a preset hash algorithm, and information in { } is encrypted data. QKS-A device and QKS-B device may verify the consistency of quantum keys stored by both parties in the same address space as follows:

QKS-A equipment adopts preset hash algorithm to calculate the hash value of Lab1, and adopts the quantum key which passes the consistency verification and obtained by the two parties last time to encrypt the hash value and Locate1, and sends the encrypted information to QKS-B equipment, namely QKS-A equipment sends the following information to QKS-B equipment: verify-a ═ { hash (Lab1), Locate1 };

QKS-B equipment decrypts the received information by adopting a corresponding key, acquires a hash value and an address sequence, acquires a corresponding key label sequence from local according to the address sequence, calculates the hash value of the acquired key label sequence by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, returns a verification passing response to QKS-A equipment if the calculated hash value is the same as the received hash value, and returns a non-passing response if the calculated hash value is not the same as the received hash value.

In a specific implementation, the above manner may also be adjusted, for example, the QKS-a device may send Verify-a ═ { hash (Locate1), Lab1} to the QKS-B device, and correspondingly, the QKS-B device obtains the corresponding address sequence from the local according to the received key tag sequence, and determines whether the consistency verification is passed by using the same way of calculating the hash value and comparing.

3) And a second way of verifying by using the corresponding relation between the key tag and the quantum bit storage position.

One way of performing consistency verification using the correspondence of key tags to qubit storage locations is provided above, and another way of performing consistency verification using the correspondence is provided herein (still following the description provided in the previous way):

QKS-A equipment adopts a preset hash algorithm to calculate the hash value of a character string formed by splicing Lab1 and Locate1, adopts a quantum key which is obtained by the two parties in the previous time and passes consistency verification to encrypt the hash value and the Locate1, and sends the encrypted information to QKS-B equipment, namely QKS-A equipment sends the following information to QKS-B equipment: verify-a ═ hash (Lab1, Locate1), Locate1 };

QKS-B equipment decrypts the received information by adopting a corresponding key, acquires a hash value and an address sequence, acquires a corresponding key label sequence from the local according to the address sequence, calculates the hash value of a character string formed by splicing the key label sequence and the address sequence by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, returns a verification passing response to QKS-A equipment if the calculated hash value is the same as the received hash value, and returns a non-passing response if the calculated hash value is not the same as the received hash value.

In a specific implementation, the above manner may also be adjusted, for example, the QKS-a device may send Verify-a ═ { hash (Lab1, Locate1), Lab1} to the QKS-B device, and correspondingly, the QKS-B device obtains the corresponding address sequence from the local according to the received key tag sequence, and determines whether the consistency verification is passed by using the same way of calculating the hash value and comparing.

So far, three ways of verifying the consistency of quantum keys stored in the same address interval by QKS-a and QKS-B devices have been described, wherein the first way is relatively simple and does not require the use of key labels, but may have a certain potential safety hazard; the second and third ways are relatively complex, utilize the characteristic that the key label can uniquely identify the qubit, and establish the corresponding relationship between the key label and the storage location of the qubit, so that it is not necessary to transmit quantum key information on the network, but verify whether the address sequences of the qubits stored in the two devices and the corresponding key label sequences are the same, and if the two devices are the same, it can be proved that the quantum keys stored in the same address interval are the same, i.e. pass consistency verification.

If the quantum keys stored in the same address interval by the QKS-a device and the QKS-B device are not the same after the consistency verification is performed by the QKS-a device and the QKS-B device, that is, the consistency verification is not passed, the QKS-a device and the QKS-B device may clear the quantum keys stored in the same address interval, and go to step 302 to perform, and obtain the quantum keys from the respective QKD devices again. In particular implementations, it is also possible that the QKS-A device and the QKS-B device do not clear the quantum keys stored in the same address interval, but instead overwrite the same address interval with a new quantum key that is next obtained from the respective QKD device.

Since the QKS devices of the two transceivers need to perform consistency verification after storing the quantum key obtained from the corresponding QKD device each time, and each time the quantum key is output to the corresponding data device, the quantum key is selected from the quantum keys passing the consistency verification, if the quantum key obtained from the corresponding QKS-a device is found to be inconsistent by the data devices of the two transceivers, which may be generally considered to be caused by network transmission abnormality (e.g., packet loss), the data devices of the two transceivers need to obtain the quantum key from the corresponding QKS device again, and it is not necessary to clear all the stored quantum keys in the QKS-a device and the QKS-B device by restarting and the like, thereby avoiding waste of the obtained quantum key.

It should be noted that this step provides three quantum key consistency verification methods for QKS-a and QKS-B devices, which can also be applied to the quantum key consistency verification between QKD-a and QKD-B devices. In other embodiments, other manners different from the above-described manner may be adopted, and as long as the consistency of the quantum keys stored in the same address range by both devices can be verified, the method does not depart from the core of the present application, and is within the protection scope of the present application.

Step 305, the data devices of the both transceivers send key obtaining requests to the respective key management devices.

The data device a and the data device B may negotiate in advance a length for requesting the QKS device to acquire a quantum key, and send a quantum key acquisition request to the respective QKS devices, where the request carries the length information.

And step 306, after the key management devices of the transmitter and the receiver receive the key acquisition request, selecting the quantum keys stored in the same address interval from the quantum keys passing the consistency verification, and sending the quantum keys to corresponding data devices.

QKS-A equipment and QKS-B equipment receive a key acquisition request sent by corresponding data equipment, and according to key length information carried in the request, an address interval for outputting a quantum key passing consistency verification for the data equipment can be determined in a negotiation mode, and then the quantum key in the negotiated same address interval is sent to the corresponding data equipment.

Therefore, QKS-a device and QKS-B device output the quantum key passing the consistency verification to the respective corresponding data devices, so that data device a and data device B can perform corresponding encryption and decryption operations on the data needing to be transmitted in a secret manner by using the received quantum key.

Considering that QKS devices and corresponding data devices may also have a phenomenon of packet loss during transmission, this embodiment also provides a preferred implementation manner for performing quantum key consistency verification between the data devices, that is, after the transceiver QKS devices send the quantum keys to the corresponding data devices, the data device a and the data device B verify the consistency of the obtained quantum keys, and use the quantum keys that pass through the consistency verification as keys used for performing data encryption and decryption operations.

The data device a and the data device B verify the consistency of the quantum keys obtained by both sides, and may be implemented in various ways, and two optional ways are listed below.

1) And the consistency verification is realized by comparing the hash values of the quantum keys acquired by the two parties.

The method is relatively simple and convenient, and the specific implementation can be that the data device A adopts a preset hash algorithm to calculate the hash value of the obtained quantum key, adopts the quantum key which is obtained by the two parties at the previous time and passes the consistency verification to encrypt the hash value, and sends the encrypted information to the data device B; and after the data equipment B decrypts the received information by adopting the corresponding key, calculating the hash value of the locally acquired quantum key by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value or not, if so, returning a verification passing response to the data equipment A, and otherwise, returning a non-passing response.

2) And realizing consistency verification by utilizing the corresponding relation between the quantum key and the key label sequence.

With this verification method, the information sent by the transceiver QKS device to the corresponding data device includes not only the quantum key but also the key tag sequence of the quantum key. For convenience of description, a quantum Key received by the data device a is denoted as Key1, a corresponding Key tag sequence is denoted as Lab1, hash () represents a preset hash algorithm, and information in { } is encrypted data. After receiving the quantum key and the key label sequence sent by the QKS device, the data device a and the data device B execute the following operations to realize the consistency verification of the quantum key:

the data equipment A adopts a preset hash algorithm to calculate the hash value of a character string formed by splicing the acquired quantum Key1 and the Key label sequence Lab1, adopts the quantum Key which is acquired by two parties at the previous time and passes consistency verification to encrypt the hash value and the Key label sequence Lab1, and sends the encrypted information to the data equipment B, namely the data equipment A sends the following information to the data equipment B: verify-a ═ { hash (Key1, Lab1), Lab1 };

and after decrypting the received information by the data equipment B by adopting the corresponding key, locally acquiring a corresponding quantum key according to the acquired key label sequence, calculating a hash value of a character string spliced by the quantum key and the key label sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the data equipment A, and otherwise, returning a non-passing response.

If the data device a and the data device B perform the consistency verification, and find that the quantum keys obtained by the two parties are different, that is, the consistency verification is not passed, then the data device a and the data device B may give up the quantum key obtained this time, go to step 305 to perform, and send key obtaining requests to the respective QKS devices again.

Since the quantum keys output by the QKS device to the data device are all the stored quantum keys that have been verified to be consistent, if the quantum keys obtained by the data devices of the transmitting and receiving parties are inconsistent, usually due to network transmission abnormality (e.g., packet loss), in this case, it is not necessary to flush all the stored quantum keys in the QKS-a device and the QKS-B device by means of rebooting or the like, so as to avoid waste of the obtained quantum keys.

So far, the flow of implementing the technical solution of the present application by using the real-time acquisition mode is described in detail through the above steps 301 to 306. It should be noted that, in order to further ensure security, all data interactions in the classical channel in the above processing flow may be performed based on HTTPS connection, and digital certificates adopted by each device participating in the interactions in the authentication process are issued by a trusted third party; before data interaction is performed between every two devices, bidirectional identity authentication can be performed in advance, for example, a preset digital certificate and the like are adopted, and the data interaction process is started after the two devices pass the identity authentication of the other device.

The above describes a process of implementing the technical solution of the present application by using a real-time acquisition mode, and the following describes a process of implementing the technical solution of the present application by using a pre-acquisition mode. Please refer to fig. 5, which is a processing flowchart of the quantum key output method based on the pre-fetching mode provided in the embodiment of the present application, and for easy understanding, the embodiment also provides an interaction flowchart between devices based on the pre-fetching mode, please refer to fig. 6. The method comprises the following steps:

step 501, the data devices of the both sides of the transceiver respectively send key obtaining requests to the respective key management devices.

Step 502, the key management devices of the both sending and receiving parties respectively send the key obtaining request to the respective quantum key distribution device.

The transceiver QKS device forwards the received request to the respective QKD device because it does not pre-store a quantum key that passes the consistency verification.

Step 503, the quantum key distribution devices of the both transceivers negotiate the quantum key through the quantum key distribution protocol, and store the quantum key by using the same address interval.

And step 504, the quantum key distribution devices of the transmitter and the receiver send the quantum keys stored in the same address interval to the corresponding key management device.

And 505, the key management devices of the both sides store the received quantum keys in the same address interval, and verify the consistency of the quantum keys stored in the same address interval.

Step 506, the key management devices of the transmitting and receiving parties select the quantum keys stored in the same address interval from the quantum keys passing the consistency verification, and send the quantum keys to the corresponding data devices.

As can be seen by referring to the steps described above and fig. 4 and 6, the pre-acquisition mode differs from the real-time acquisition mode in that the interaction process between the devices differs. In the pre-acquisition mode, the transceiver QKS device does not pre-store the quantum key with the consistency verification as in the real-time acquisition mode, but after receiving the key acquisition request of the data device, acquires the quantum key from the corresponding QKD device, performs the consistency verification of the quantum key, and then sends the quantum key with the consistency verification to the data device.

In the specific implementation of the technical scheme, the core of the pre-acquisition mode is the same as the real-time acquisition mode: that is, the transceiver QKS device verifies the consistency of the quantum keys stored in the same address space by both parties, thereby ensuring that the keys output to the data device are symmetric. Furthermore, consistency verification can be performed on the stored quantum key between the QKD devices of the two parties of the transmitting and receiving, and consistency verification can be performed on the received quantum key between the data devices of the two parties of the transmitting and receiving. The specific processing procedures are described in detail in the above description of the real-time obtaining manner, and are not described herein again, and reference may be made to the related description in the real-time obtaining manner.

It should be noted that, in specific implementation, not only any one of the real-time obtaining manner or the pre-obtaining manner described above may be adopted, but also the two manners may be implemented in combination, for example, the transceiver QKS device may usually prestore the quantum key with the consistency verification, and output the quantum key according to the requirement of the corresponding data device, and when the quantum key requirement of the data device is relatively large and the transceiver QKS device determines that no prestored key can be output, the transceiver may switch to the pre-obtaining manner to continue to operate.

In summary, in the quantum key output method provided by the present application, since the key management devices of the transmitter and the receiver perform consistency verification on the quantum keys stored in the same address interval, the synchronism and the usefulness of the quantum key output system for outputting the quantum keys are ensured, that is: the quantum keys output to the data device are identical and symmetrical, so that the correct execution of the data encryption and decryption process is guaranteed. In particular, even if the quantum keys acquired by the data transmitting and receiving parties are asymmetric due to network transmission and other reasons, the quantum keys stored by the quantum key management devices of the transmitting and receiving parties do not need to be emptied in a restarting mode and other modes, and therefore waste of quantum key resources is avoided.

In the foregoing embodiments, a method for outputting a quantum key is provided, and correspondingly, an apparatus for outputting a quantum key is also provided. Please refer to fig. 7, which is a schematic diagram of an embodiment of a quantum key output device according to the present application. Since the apparatus embodiments are substantially similar to the method embodiments, they are described in a relatively simple manner, and reference may be made to some of the descriptions of the method embodiments for relevant points. The device embodiments described below are merely illustrative.

A quantum key output device of the present embodiment includes: a data device key requesting unit 701, configured to send a key obtaining request to each key management device by the data devices of the two transceivers; and the management device key output unit 702 is configured to, after receiving the key acquisition request, send the quantum key acquired from the corresponding quantum key distribution device and verified by the consistency of the key management devices of the transmitting and receiving parties to the corresponding data device, so that the corresponding data device performs data encryption and decryption operations.

Optionally, the apparatus includes: a distribution device key agreement verification unit;

and the key negotiation verification unit of the distribution equipment is used for storing the quantum keys acquired through the quantum key distribution protocol negotiation in the same address interval with the quantum key distribution equipment corresponding to the key management equipment of the both sides of the transmitter and the receiver, verifying the consistency of the quantum keys stored in the same address interval by the both sides of the receiver and the transmitter, and taking the quantum keys which pass the consistency verification as the quantum keys which can be acquired by the corresponding key management equipment.

Optionally, the apparatus includes a distribution device key negotiation unit, a management device key request unit, a distribution device key sending unit, and a management device key verification unit, and the units are started before the data device key request unit operates:

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the management device key request unit is used for sending and receiving key acquisition requests to the respective quantum key distribution devices by the key management devices of the two parties;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select quantum keys stored in the same address interval from quantum keys passing consistency verification after the key acquisition requests are received by the key management devices of the transmitting and receiving parties, and send the quantum keys to corresponding data devices.

Optionally, the apparatus includes:

the management equipment key request forwarding unit is used for sending the key acquisition requests to the respective quantum key distribution equipment by the key management equipment of the receiving and sending parties after the data equipment key request unit receives the key acquisition requests;

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select, from the quantum keys passing the consistency verification, the quantum keys stored in the same address interval by the key management devices of the transmitting and receiving parties, and send the quantum keys to the corresponding data device.

Optionally, the apparatus includes:

a management device key clearing unit, configured to, when the verification result of the management device key verification unit is: and when the quantum key does not pass the verification, the key management devices of the transmitting and receiving parties remove the quantum key stored in the verified same address interval, and trigger units for respectively sending key acquisition requests to the respective quantum key distribution devices by the key management devices of the transmitting and receiving parties to work.

Optionally, the apparatus includes:

and the distribution equipment key verification unit is used for verifying the consistency of the quantum keys stored in the same address interval by the receiving and sending party quantum key distribution equipment after the distribution equipment key negotiation unit finishes the quantum key negotiation process and adopts the same address interval to store the quantum keys, and taking the quantum keys passing the consistency verification as the quantum keys capable of being sent to the key management equipment.

Optionally, the apparatus includes:

a distribution device key clearing unit configured to, when the verification result of the distribution device key verification unit is: and when the quantum key does not pass the verification, the quantum key distribution equipment of the transmitting and receiving parties clears the quantum key stored in the verified same address interval and triggers the key negotiation unit of the distribution equipment to work.

Optionally, the distribution device key verification unit and the management device key verification unit each include a verification request subunit and a verification execution subunit;

the verification request subunit is configured to calculate, by using a preset hash algorithm, a hash value of the quantum key stored in the address interval by one device participating in verification, encrypt the hash value and the address interval information by using a quantum key which is obtained by the two devices participating in verification and passes consistency verification in the previous time, and send the encrypted information to the other device participating in verification;

the verification execution subunit is configured to, after decrypting the received information by using the corresponding key, obtain address interval information, calculate, by using the preset hash algorithm, a hash value of the quantum key stored in the local corresponding address interval, determine whether the calculated hash value is the same as the received hash value, if so, return a verification-passing response to the other party device participating in the verification, and otherwise, return a non-passing response.

Optionally, the apparatus includes:

and the data equipment key verification unit is used for verifying the consistency of the received quantum keys by the data equipment of the receiving and sending parties after the management equipment key output unit sends the quantum keys to the corresponding data equipment, and taking the quantum keys passing the consistency verification as keys adopted for executing data encryption and decryption operations.

Optionally, the distribution device key negotiation unit negotiates the obtained quantum key through a quantum key distribution protocol, and has a key tag sequence corresponding to the quantum key; accordingly, the method can be used for solving the problems that,

the key negotiation unit of the distribution equipment comprises a mapping relation establishing subunit besides an ontology subunit for realizing the functions of the key negotiation unit, wherein the mapping relation establishing subunit is used for establishing the one-to-one corresponding relation between the storage address of each quantum bit and the key label;

the information sent to the management device key verification unit by the distribution device key sending unit not only comprises a quantum key, but also comprises a key tag sequence corresponding to the quantum key;

the management equipment key verification unit comprises a storage subunit, a management equipment key verification subunit and a mapping relation establishment subunit; the storage subunit is used for storing the received quantum key in the same address interval by the key management devices of the transmitting party and the receiving party; the mapping relation establishing subunit is used for establishing a one-to-one correspondence relation between the storage address of each quantum bit and the key label and triggering the key verification subunit of the management equipment to work; the management device key verification subunit is used for verifying the consistency of quantum keys stored in the same address interval by the two parties;

the distribution equipment key verification unit and the management equipment key verification subunit respectively comprise a label verification request subunit and a label verification execution subunit;

the label verification request subunit is used for one party of equipment participating in verification to calculate a hash value of a character string formed by splicing a key label sequence of the quantum key and an address sequence formed by a storage address of each quantum bit in the quantum key by adopting a preset hash algorithm, and to encrypt the hash value and the address sequence or encrypt the hash value and the key label sequence by adopting a quantum key which is acquired by two parties of equipment participating in verification and passes consistency verification in the previous time, and to send the encrypted information to the other party of equipment participating in verification;

and the tag verification execution subunit is used for decrypting the encrypted information by adopting a corresponding key after the other party equipment receives the encrypted information, locally acquiring a corresponding key tag sequence according to the extracted address sequence, or locally acquiring a corresponding address sequence according to the extracted key tag sequence, calculating a hash value of a character string formed by splicing the key tag sequence and the address sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the other party equipment participating in verification, and otherwise, returning a non-passing response.

In addition, the application also provides a quantum key obtaining method, which is implemented on data equipment for encrypting and decrypting data by using the quantum key. Please refer to fig. 8, which is a flowchart illustrating an embodiment of a quantum key obtaining method according to the present application, wherein the same contents as those in the first embodiment are not repeated, and the following description focuses on differences. The quantum key obtaining method provided by the application comprises the following steps:

step 801 sends a key acquisition request to a key management device.

And step 802, receiving the quantum key which passes consistency verification and is sent by the key management device, and using the quantum key as a key for encrypting and decrypting data.

After receiving the quantum key which passes the consistency verification and is sent by the key management device, the consistency between the obtained quantum key and the quantum key obtained by the opposite-end data device can be further verified, and the quantum key which passes the consistency verification is used as a key for encrypting and decrypting data.

If the obtained quantum key is found to be inconsistent with the quantum key obtained by the opposite-end data device through the verification process, the operation may go to step 801 to execute, and the quantum key obtaining request is sent to the key management device again.

In the foregoing embodiment, a method for obtaining a quantum key is provided, and correspondingly, an apparatus for obtaining a quantum key is also provided. Please refer to fig. 9, which is a schematic diagram of an embodiment of a quantum key obtaining apparatus according to the present application. The device embodiments described below are merely illustrative.

A quantum key obtaining apparatus of this embodiment, where the apparatus is disposed on a data device that encrypts and decrypts data by using a quantum key, includes: a key acquisition request sending unit 901, configured to send a quantum key acquisition request to a key management device; a symmetric key receiving unit 902, configured to receive the quantum key that passes the consistency verification and is sent by the key management device, as a key used for encrypting and decrypting data.

In addition, the application also provides a quantum key storage and output method, which is implemented on the key management device for providing the quantum key for the data device. Please refer to fig. 10, which is a flowchart illustrating an embodiment of a method for storing and outputting a quantum key according to the present application, wherein the same parts in the present embodiment as those in the first embodiment are not repeated, and the following description focuses on differences. The quantum key storage and output method provided by the application comprises the following steps:

step 1001, receiving a key acquisition request sent by a data device.

If the method of acquiring the quantum key in real time is adopted, the following operations are executed before the step:

1) sending a key acquisition request to quantum key distribution equipment;

2) receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

3) and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device, and taking the quantum key passing the consistency verification as the quantum key capable of being sent to the data device.

Step 1002, according to the same address interval negotiated with the opposite-end key management device, sending the quantum key passing consistency verification to the data device.

If pre-fetching of quantum keys is used, the following operations are performed after step 1001 and before this step:

1) sending the key acquisition request to quantum key distribution equipment;

2) receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

3) and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device.

Regardless of the real-time acquisition mode or the pre-acquisition mode, if the quantum key stored in the address interval is found to be inconsistent with the quantum key stored in the same address interval by the opposite-end management device after consistency verification is performed, the quantum key stored in the address interval can be cleared, and the key acquisition request is sent to the quantum key distribution device again.

In the foregoing embodiments, a method for storing and outputting a quantum key is provided, and correspondingly, an apparatus for storing and outputting a quantum key is also provided. Please refer to fig. 11, which is a schematic diagram of an embodiment of a quantum key storage output device according to the present application. The device embodiments described below are merely illustrative.

A quantum key storage output apparatus of the present embodiment, which is disposed on a key management device that provides a quantum key to a data device, includes: a key acquisition request receiving unit 1101 configured to receive a key acquisition request sent by a data device; and a symmetric key output unit 1102, configured to send the quantum key passing the consistency verification to the data device according to the same address interval negotiated with the peer key management device.

In addition, the application also provides a quantum key distribution and storage method, and the method is implemented on quantum key distribution equipment. Please refer to fig. 12, which is a flowchart illustrating an embodiment of a quantum key distribution and storage method provided in the present application, wherein the same parts in the present embodiment as those in the first embodiment are not repeated, and the following description focuses on differences. The quantum key distribution and storage method provided by the application comprises the following steps:

step 1201, negotiating a quantum key with an opposite terminal quantum key distribution device through a quantum key distribution protocol, and storing the obtained quantum key in the same address interval as the opposite terminal quantum key distribution device.

Step 1202, verifying consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end quantum key distribution device.

Step 1203, according to the received quantum key obtaining request from the key management device, sending the quantum key passing consistency verification to the key management device according to the same address interval negotiated with the opposite-end quantum key distribution device.

If the quantum key stored in the address interval is found to be inconsistent with the quantum key stored in the same address interval by the peer quantum key distribution device after the consistency verification is performed in step 1202, the quantum key stored in the address interval may be cleared, and the process goes to step 1201 to execute.

It should be noted that, if a manner of acquiring the quantum key in real time is adopted, the key acquisition request from the key management device may be received after step 1202; if pre-fetch is used, the request may be received prior to step 1201.

In the foregoing embodiments, a method for distributing and storing quantum keys is provided, and correspondingly, the present application also provides a device for distributing and storing quantum keys. Please refer to fig. 13, which is a schematic diagram of an embodiment of a quantum key distribution storage apparatus according to the present application. The device embodiments described below are merely illustrative.

A quantum key distribution storage apparatus of this embodiment, the apparatus implemented on a quantum key distribution device, includes: a key distribution storage unit 1301, configured to negotiate a quantum key with an opposite-end quantum key distribution device through a quantum key distribution protocol, and store the obtained quantum key in the same address interval as the opposite-end quantum key distribution device; a key verification unit 1302, configured to verify consistency between the quantum key stored in the address interval and the quantum key stored in the same address interval by the peer quantum key distribution device; and a symmetric key sending unit 1303, configured to send, according to a key obtaining request received from a key management device, a quantum key that passes consistency verification to the key management device according to the same address interval negotiated with the peer quantum key distribution device.

In addition, the application also provides a quantum key output system. Please refer to fig. 14, which is a diagram illustrating a quantum key output system according to an embodiment of the present disclosure. The application provides a quantum key output system includes: two subsystems respectively deployed at a transmitting side and a receiving side, wherein one subsystem comprises: quantum key acquisition device 1401-1, quantum key storage output device 1402-1, and quantum key distribution storage device 1403-1, and another subsystem includes: quantum key acquisition device 1401-2, quantum key storage output device 1402-2, and quantum key distribution storage device 1403-2.

The quantum key output system can adopt a working mode of acquiring the quantum key in real time and can also adopt a working mode of pre-acquiring the quantum key. When the two working modes are adopted, the interaction flow among the devices has already been described in detail in the embodiment of the quantum key output method, and is not described again here.

In addition, the application also provides a method for verifying the storage consistency of the quantum key, wherein the method is implemented on the first device and the second device which participate in the verification. Please refer to fig. 15, which is a flowchart illustrating an embodiment of a method for verifying storage consistency of a quantum key according to the present application, wherein parts of the embodiment that are the same as those of the first embodiment are not repeated, and a difference therebetween is described in detail below. The application provides a method for verifying quantum key storage consistency, which comprises the following steps:

step 1501: the first device sends information representing the quantum key to be verified, which is acquired through a quantum key negotiation process, and address interval information storing the quantum key to be verified to the second device.

The information for representing the quantum key to be verified is composed of sub-information units corresponding to the bit number of the quantum key, and each sub-information unit is a unique identifier of different quantum bits in the quantum key to be verified and corresponds to the storage address of the identified quantum bit one by one.

The information characterizing the quantum key to be verified may include: and each quantum bit in the quantum key is the sub-information unit. In this way, the first device may calculate the hash value of the quantum key to be verified by using a preset hash algorithm, and send the hash value and the address interval information to the second device.

The information characterizing the quantum key to be verified may further include: a key label sequence of the quantum key to be verified, wherein each key label in the key label sequence is the sub-information unit; the address interval information for storing the quantum key to be verified comprises: and the address sequence is composed of the memory addresses of each quantum bit in the quantum key to be verified. In this way, the first device may calculate a hash value of a character string formed by splicing the key tag sequence and the address sequence by using a preset hash algorithm, and send the hash value and the address sequence, or the hash value and the key tag sequence to the second device participating in authentication.

In a specific implementation, time stamp information of a quantum bit may be used as the key tag.

Step 1502: and the second equipment judges whether the information corresponding to the address interval and representing the quantum key to be verified of the two pieces of equipment is the same or not by comparing the received information with the corresponding local information, and returns a verification passing response to the first equipment if the information is the same, or returns a non-passing response if the information is not the same.

When the information representing the quantum key to be verified is the quantum key to be verified, the second device may extract address interval information storing the quantum key to be verified from the received information, calculate a hash value of the quantum key stored in the same local address interval by using the preset hash algorithm, compare the calculated hash value with the received hash value, if the hash value is the same, determine that the information representing the quantum key to be verified, corresponding to the address interval, of the two devices is the same, return a verification passing response to the first device, and otherwise return a non-passing response.

When the information representing the quantum key to be verified is the key tag sequence of the quantum key to be verified, the second device may locally obtain the corresponding key tag sequence according to the address sequence extracted from the received information, or locally obtain the corresponding address sequence according to the extracted key tag sequence, and calculate, by using the preset hash algorithm, a hash value of a character string formed by splicing the key tag sequence and the address sequence; and judging whether the calculated hash value is the same as the received hash value, if so, judging that the information corresponding to the address interval and representing the quantum key to be verified of the two devices is the same, and returning a verification passing response to the first device, otherwise, returning a non-passing response.

The method for verifying the storage consistency of the quantum key provided by the present application may be implemented on two devices that need to perform the storage consistency verification of the quantum key, where the two devices may be a quantum key distribution device of both the transmitter and the receiver, or a key management device of both the transmitter and the receiver.

In addition, when the step 1501 is executed, the first device may encrypt information to be transmitted by using a key agreed with the second device in advance; correspondingly, in step 1502, after receiving the information sent by the first device, the second device performs subsequent comparison and determination operations after decrypting with the corresponding key.

As can be seen from the above description, in the method for verifying the storage consistency of the quantum key, the two devices participating in the verification compare the information representing the quantum key to be verified, which corresponds to the same address interval, and the two devices, and determine whether the quantum keys stored in the same address interval are the same, so that a basis is provided for the two devices to output symmetric quantum keys outwards, and a guarantee is provided for the safe and efficient transmission of user data. Particularly, by adopting the verification method based on the key label, the characteristic that the quantum bit can be uniquely identified by the key label and the corresponding relation between the key label and the storage address of the quantum bit are utilized, so that the consistency verification can be realized without transmitting the quantum key, and the safety of the quantum key is further ensured.

In the above embodiments, a method for verifying quantum key storage consistency is provided, and correspondingly, the present application also provides an apparatus for verifying quantum key storage consistency. Please refer to fig. 16, which is a schematic diagram of an embodiment of a device for verifying quantum key storage consistency according to the present application. The device embodiments described below are merely illustrative.

An apparatus for verifying quantum key storage consistency of the present embodiment includes: a key verification request sending unit 1601, configured to send, by a first device, information representing a quantum key to be verified, which is obtained through a quantum key negotiation process, and address interval information in which the quantum key to be verified is stored, to a second device; and a key verification execution unit 1602, configured to compare the received information with local corresponding information, and determine whether information corresponding to the address interval and representing the quantum key to be verified is the same or not by the second device, and if so, return a verification passing response to the first device, otherwise, return a non-passing response.

Although the present application has been described with reference to the preferred embodiments, it is not intended to limit the present application, and those skilled in the art can make variations and modifications without departing from the spirit and scope of the present application, therefore, the scope of the present application should be determined by the claims that follow.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, Random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

1. Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-transitory computer readable media (transient media), such as modulated data signals and carrier waves.

2. As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

Claims (47)

1. A quantum key output method, comprising:

the data equipment of the transmitting and receiving parties respectively sends a key obtaining request to the respective key management equipment;

after receiving the key acquisition request, the key management devices of the transmitting and receiving parties send the quantum keys passing the consistency verification to the corresponding data devices for the corresponding data devices to execute data encryption and decryption operations;

the consistency verification means that after the key management devices of the two transmitting and receiving parties store the quantum keys acquired from the quantum key distribution devices corresponding to the key management devices in the same address interval, the key management devices verify whether the quantum keys stored in the same address interval are the same; if the two are the same, the consistency verification is considered to be passed.

2. A quantum key output method according to claim 1, comprising:

the quantum key distribution device corresponding to the key management devices of the two parties of the transceiver stores the quantum key obtained through negotiation of the quantum key distribution protocol in the same address interval, verifies the consistency of the quantum keys stored in the same address interval by the two parties, and takes the quantum key passing the consistency verification as the quantum key which can be obtained by the corresponding key management device.

3. The quantum key output method according to claim 1, wherein the quantum key that passes the consistency verification is stored in advance in the key management devices of both the transmitter and the receiver before the data devices of both the transmitter and the receiver send the key acquisition request;

correspondingly, before the data devices of the transmitter and the receiver respectively send the key acquisition requests to the key management devices, the following operations are executed:

the quantum key distribution equipment of the two parties of the transceiver negotiates a quantum key through a quantum key distribution protocol, and stores the quantum key by adopting the same address interval;

the key management equipment of the transmitting and receiving parties sends a key acquisition request to the respective quantum key distribution equipment;

the quantum key distribution equipment of the transmitting and receiving parties sends the quantum key stored in the same address interval to the corresponding key management equipment;

the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval and verifies the consistency of the quantum keys stored in the same address interval by the transmitting and receiving parties;

correspondingly, the sending the quantum key passing the consistency verification to the corresponding data device comprises:

and the key management equipment of the transmitting and receiving parties selects the quantum keys stored in the same address interval from the quantum keys passing the consistency verification and sends the quantum keys to the corresponding data equipment.

4. The quantum key output method according to claim 3, wherein, before the sending of the key acquisition request to the respective quantum key distribution device by the key management device of the both transceivers is performed, the following operations are performed:

and the quantum key distribution devices of the transmitting and receiving parties inform the respective key management devices of the quantity of the quantum keys available for acquisition.

5. The quantum key output method according to claim 1, wherein after the key acquisition request is received by the key management device of the transmitter and the receiver, and before the quantum key passing the consistency verification is transmitted to the corresponding data device, the following operations are performed:

the key management devices of the two transmitting and receiving parties respectively send the key acquisition requests to the respective quantum key distribution devices;

the quantum key distribution equipment of the two parties of the transceiver negotiates a quantum key through a quantum key distribution protocol, and stores the quantum key by adopting the same address interval;

the quantum key distribution equipment of the transmitting and receiving parties sends the quantum key stored in the same address interval to the corresponding key management equipment;

the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval and verifies the consistency of the quantum keys stored in the same address interval by the transmitting and receiving parties;

correspondingly, the sending the quantum key passing the consistency verification to the corresponding data device comprises:

and the key management equipment of the transmitting and receiving parties selects the quantum keys stored in the same address interval from the quantum keys passing the consistency verification and sends the quantum keys to the corresponding data equipment.

6. The quantum key output method according to claim 3 or 5, wherein when the key management devices of the transmitting and receiving parties verify that the quantum keys stored in the same address interval by both parties are inconsistent, the following operations are performed:

and clearing the quantum keys stored in the same address interval, and transmitting a key acquisition request to respective quantum key distribution equipment to execute the steps.

7. The quantum key output method according to claim 3 or 5, wherein the quantum key distribution devices of the both transceivers negotiate a quantum key through a quantum key distribution protocol, and perform the following operations after storing the quantum key using the same address interval:

and the quantum key distribution equipment of the transmitting and receiving parties verifies the consistency of the quantum keys stored in the same address interval and takes the quantum keys passing the consistency verification as the quantum keys capable of being sent to the key management equipment.

8. The quantum key output method according to claim 7, wherein when the quantum key distribution device of the transmitting and receiving parties verifies that the quantum keys stored in the same address interval are inconsistent, the following operations are performed:

and clearing the quantum key stored in the same address interval, and executing the steps that the quantum key distribution devices of the receiving and forwarding parties negotiate the quantum key through a quantum key distribution protocol.

9. The quantum key output method of claim 7, comprising: and the quantum key distribution equipment of the both transmitting and receiving parties regularly executes the operation of verifying the consistency of the quantum keys stored in the same address interval by the both transmitting and receiving parties.

10. The quantum key output method according to claim 7, wherein the sender-receiver quantum key distribution device verifies the consistency of the quantum keys stored in the same address interval by both the sender and the receiver, and the sender-receiver key management device verifies the consistency of the quantum keys stored in the same address interval by both the sender and the receiver, respectively, by:

one of the two pieces of equipment adopts a preset hash algorithm to calculate the hash value of the quantum key stored in the address interval, adopts the quantum key which is obtained by the two pieces of equipment in the previous time and passes consistency verification to encrypt the hash value and the address interval information, and sends the encrypted information to the other piece of equipment;

and the other party equipment decrypts the received information by adopting the corresponding secret key to obtain address interval information, calculates the hash value of the quantum secret key stored in the local corresponding address interval by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value or not, returns a verification passing response to the other party equipment if the calculated hash value is the same as the received hash value, and returns a non-passing response if the calculated hash value is not the same as the received hash value.

11. The quantum key output method of claim 1, wherein after the key management devices of the transmitter and the receiver transmit the quantum key to the corresponding data device, the following operations are performed:

and the data equipment of the transmitting side and the receiving side verifies the consistency of the received quantum key, and takes the quantum key passing the consistency verification as a key used for executing data encryption and decryption operation.

12. The quantum key output method according to claim 11, wherein when the data devices of the both transceivers verify that the quantum keys obtained by the both transceivers are not consistent, the method proceeds to the step in which the data devices of the both transceivers each send a key obtaining request to the respective key management device.

13. The quantum key output method of claim 11, wherein the verifying the consistency of the obtained quantum keys by the data devices of the both transceivers comprises:

one of the two pieces of equipment adopts a preset hash algorithm to calculate the hash value of the obtained quantum key, adopts the quantum key which is obtained by the two pieces of equipment at the previous time and passes consistency verification to encrypt the hash value, and sends the encrypted information to the other piece of equipment;

and after the other party equipment decrypts the received information by adopting the corresponding key, the hash value of the locally acquired quantum key is calculated by adopting the preset hash algorithm, whether the calculated hash value is the same as the received hash value or not is judged, if so, a verification passing response is returned to the other party equipment, and otherwise, a non-passing response is returned.

14. The quantum key output method according to claim 7, wherein the quantum key obtained by the quantum key distribution device of the both transceivers through quantum key distribution protocol negotiation has a key tag sequence corresponding thereto, and each key tag in the key tag sequence is a unique identifier of a different quantum bit in the quantum key;

correspondingly, after the quantum key distribution equipment of the transmitting and receiving parties stores the quantum key by adopting the same address interval, the following operations are executed: establishing a one-to-one correspondence relationship between the storage address of each quantum bit and the key label;

the information sent to the corresponding key management equipment by the quantum key distribution equipment of the both sides of the transceiver not only comprises the quantum key, but also comprises a key label sequence corresponding to the quantum key; after the key management equipment of the transmitting and receiving parties stores the received quantum keys in the same address interval, the following operations are executed: establishing a one-to-one correspondence relationship between the storage address of each quantum bit and the key label;

the quantum key distribution equipment of the two parties of the transceiver verifies the consistency of the quantum keys stored in the same address interval by the two parties, and the key management equipment of the two parties of the transceiver verifies the consistency of the quantum keys stored in the same address interval by the two parties of the transceiver, which are respectively realized by adopting the following modes:

one device calculates a hash value of a character string formed by splicing a key label sequence of the quantum key and an address sequence formed by a storage address of each quantum bit in the quantum key by adopting a preset hash algorithm, encrypts the hash value and the address sequence or encrypts the hash value and the key label sequence by adopting the quantum key which is acquired by the two devices at the previous time and passes consistency verification, and sends the encrypted information to the other device;

and after the other party equipment decrypts by adopting the corresponding key, acquiring a corresponding key label sequence from the local according to the extracted address sequence, or acquiring a corresponding address sequence from the local according to the extracted key label sequence, calculating a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the other party equipment, and otherwise, returning a non-passing response.

15. The quantum key output method of claim 14, wherein the information sent by the key management device of the transmitting and receiving parties to the corresponding data device includes not only the quantum key but also a key tag sequence of the quantum key;

correspondingly, after receiving the information sent by the respective key management devices, the data devices of the two transceivers execute the following operations to verify the consistency of the quantum keys acquired by the data devices of the two transceivers, and if the quantum keys do not agree, the data devices of the two transceivers switch to the steps of sending key acquisition requests to the respective key management devices to execute:

one of the two devices adopts a preset hash algorithm to calculate a hash value of a character string formed by splicing the acquired quantum key and the key label sequence, adopts a quantum key which is acquired by the two devices at the previous time and passes consistency verification to encrypt the hash value and the key label sequence, and sends encrypted information to the other device;

and after the other party equipment decrypts by adopting the corresponding key, acquiring the corresponding quantum key from the local according to the extracted key label sequence, calculating the hash value of the character string formed by splicing the quantum key and the key label sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value or not, if so, returning a verification passing response to the other party equipment, and otherwise, returning a non-passing response.

16. A quantum key output method as claimed in claim 14, wherein the key tag comprises: and timestamp information of the quantum bit, wherein the timestamp information is acquired by quantum key distribution equipment of the transmitting party and the receiving party in the process of negotiating the quantum key.

17. A quantum key output method according to claim 1, wherein the interaction process between the devices via the classical channel is based on HTTPS connection.

18. The quantum key output method of claim 1, wherein each device performs bidirectional identity authentication before interaction and performs subsequent interaction operation after authentication is passed.

19. A quantum key output apparatus, comprising:

the data equipment key request unit is used for sending and receiving the key acquisition requests to the respective key management equipment by the data equipment of both sides;

and the management device key output unit is used for sending the quantum key which is acquired from the corresponding quantum key distribution device and passes the consistency verification of the key management devices of the transmitting and receiving parties to the corresponding data device after the key management devices of the transmitting and receiving parties receive the key acquisition request, so that the corresponding data device can execute data encryption and decryption operation.

20. A quantum key output device as claimed in claim 19, wherein the device comprises: a distribution device key agreement verification unit;

and the key negotiation verification unit of the distribution equipment is used for storing the quantum keys acquired through the quantum key distribution protocol negotiation in the same address interval with the quantum key distribution equipment corresponding to the key management equipment of the both sides of the transmitter and the receiver, verifying the consistency of the quantum keys stored in the same address interval by the both sides of the receiver and the transmitter, and taking the quantum keys which pass the consistency verification as the quantum keys which can be acquired by the corresponding key management equipment.

21. The quantum key output device according to claim 19, wherein the device includes a distributed device key agreement unit, a management device key request unit, a distributed device key transmission unit, and a management device key verification unit, and the units are activated before the data device key request unit operates:

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the management device key request unit is used for sending and receiving key acquisition requests to the respective quantum key distribution devices by the key management devices of the two parties;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select quantum keys stored in the same address interval from quantum keys passing consistency verification after the key acquisition requests are received by the key management devices of the transmitting and receiving parties, and send the quantum keys to corresponding data devices.

22. A quantum key output device as claimed in claim 19, wherein the device comprises:

the management equipment key request forwarding unit is used for sending the key acquisition requests to the respective quantum key distribution equipment by the key management equipment of the receiving and sending parties after the data equipment key request unit receives the key acquisition requests;

the device comprises a key negotiation unit of the distribution device, a key negotiation unit of the distribution device and a key negotiation unit of the receiving and sending party quantum key distribution device, wherein the key negotiation unit of the receiving and sending party quantum key distribution device negotiates a quantum key through a quantum key distribution protocol and stores the quantum key by adopting the same address interval;

the distribution equipment key sending unit is used for sending the quantum key stored in the same address interval to the corresponding key management equipment by the quantum key distribution equipment of the receiving and sending parties;

the management device key verification unit is used for storing the received quantum keys in the same address interval by the key management devices of the receiving and sending parties and verifying the consistency of the quantum keys stored in the same address interval by the two parties;

correspondingly, the management device key output unit is specifically configured to select, from the quantum keys passing the consistency verification, the quantum keys stored in the same address interval by the key management devices of the transmitting and receiving parties, and send the quantum keys to the corresponding data device.

23. A quantum key output method according to claim 21 or 22, wherein the apparatus comprises:

a management device key clearing unit, configured to, when the verification result of the management device key verification unit is: and when the quantum key does not pass the verification, the key management devices of the transmitting and receiving parties remove the quantum key stored in the verified same address interval, and trigger units for respectively sending key acquisition requests to the respective quantum key distribution devices by the key management devices of the transmitting and receiving parties to work.

24. A quantum key output method according to claim 21 or 22, wherein the apparatus comprises:

and the distribution equipment key verification unit is used for verifying the consistency of the quantum keys stored in the same address interval by the receiving and sending party quantum key distribution equipment after the distribution equipment key negotiation unit finishes the quantum key negotiation process and adopts the same address interval to store the quantum keys, and taking the quantum keys passing the consistency verification as the quantum keys capable of being sent to the key management equipment.

25. A quantum key output device as claimed in claim 24, wherein the device comprises:

a distribution device key clearing unit configured to, when the verification result of the distribution device key verification unit is: and when the quantum key does not pass the verification, the quantum key distribution equipment of the transmitting and receiving parties clears the quantum key stored in the verified same address interval and triggers the key negotiation unit of the distribution equipment to work.

26. The quantum key output apparatus according to claim 24, wherein the distribution device key verification unit and the management device key verification unit each include a verification request subunit and a verification execution subunit;

the verification request subunit is configured to calculate, by using a preset hash algorithm, a hash value of the quantum key stored in the address interval by one device participating in verification, encrypt the hash value and the address interval information by using a quantum key which is obtained by the two devices participating in verification and passes consistency verification in the previous time, and send the encrypted information to the other device participating in verification;

the verification execution subunit is configured to, after decrypting the received information by using the corresponding key, obtain address interval information, calculate, by using the preset hash algorithm, a hash value of the quantum key stored in the local corresponding address interval, determine whether the calculated hash value is the same as the received hash value, if so, return a verification-passing response to the other party device participating in the verification, and otherwise, return a non-passing response.

27. A quantum key output device as claimed in claim 19, comprising:

and the data equipment key verification unit is used for verifying the consistency of the received quantum keys by the data equipment of the receiving and sending parties after the management equipment key output unit sends the quantum keys to the corresponding data equipment, and taking the quantum keys passing the consistency verification as keys adopted for executing data encryption and decryption operations.

28. The quantum key output device of claim 24, wherein the distribution device key agreement unit negotiates the obtained quantum key by a quantum key distribution protocol, having a key tag sequence corresponding thereto; accordingly, the method can be used for solving the problems that,

the key negotiation unit of the distribution equipment comprises a mapping relation establishing subunit besides an ontology subunit for realizing the functions of the key negotiation unit, wherein the mapping relation establishing subunit is used for establishing the one-to-one corresponding relation between the storage address of each quantum bit and the key label;

the information sent to the management device key verification unit by the distribution device key sending unit not only comprises a quantum key, but also comprises a key tag sequence corresponding to the quantum key;

the management equipment key verification unit comprises a storage subunit, a management equipment key verification subunit and a mapping relation establishment subunit; the storage subunit is used for storing the received quantum key in the same address interval by the key management devices of the transmitting party and the receiving party; the mapping relation establishing subunit is used for establishing a one-to-one correspondence relation between the storage address of each quantum bit and the key label and triggering the key verification subunit of the management equipment to work; the management device key verification subunit is used for verifying the consistency of quantum keys stored in the same address interval by the two parties;

the distribution equipment key verification unit and the management equipment key verification subunit respectively comprise a label verification request subunit and a label verification execution subunit;

the label verification request subunit is used for one party of equipment participating in verification to calculate a hash value of a character string formed by splicing a key label sequence of the quantum key and an address sequence formed by a storage address of each quantum bit in the quantum key by adopting a preset hash algorithm, and to encrypt the hash value and the address sequence or encrypt the hash value and the key label sequence by adopting a quantum key which is acquired by two parties of equipment participating in verification and passes consistency verification in the previous time, and to send the encrypted information to the other party of equipment participating in verification;

and the tag verification execution subunit is used for decrypting the encrypted information by adopting a corresponding key after the other party equipment receives the encrypted information, locally acquiring a corresponding key tag sequence according to the extracted address sequence, or locally acquiring a corresponding address sequence according to the extracted key tag sequence, calculating a hash value of a character string formed by splicing the key tag sequence and the address sequence by adopting the preset hash algorithm, judging whether the calculated hash value is the same as the received hash value, if so, returning a verification passing response to the other party equipment participating in verification, and otherwise, returning a non-passing response.

29. A quantum key acquisition method implemented on a data device that encrypts and decrypts data using a quantum key, comprising:

sending a key acquisition request to the key management device;

and receiving the quantum key which passes the consistency verification and is sent by the key management equipment as a key for encrypting and decrypting data.

30. The quantum key obtaining method of claim 29, wherein after receiving the quantum key which passes the consistency verification and is sent by the key management device, the following operations are performed:

and verifying the consistency of the obtained quantum key and the quantum key obtained by the opposite-end data equipment, and using the quantum key passing through the consistency verification as a key for encrypting and decrypting data.

31. The method according to claim 30, wherein if the obtained quantum key and the quantum key obtained by the peer data device do not pass consistency verification, the step of sending a quantum key obtaining request to the key management device is performed.

32. A quantum key acquisition apparatus, disposed on a data device that encrypts and decrypts data using a quantum key, comprising:

a key acquisition request sending unit configured to send a key acquisition request to the key management device;

and the symmetric key receiving unit is used for receiving the quantum key which passes the consistency verification and is sent by the key management equipment, and the quantum key is used as a key for encrypting and decrypting data.

33. A quantum key storage output method implemented on a key management device that provides quantum keys to a data device, comprising:

receiving a key acquisition request sent by data equipment;

and sending the quantum key passing the consistency verification to the data equipment according to the same address interval negotiated with the opposite-end key management equipment.

34. The quantum key storage output method of claim 33, wherein the quantum key passing consistency verification is pre-stored before receiving a key acquisition request sent by a data device;

correspondingly, before receiving the key acquisition request sent by the data device, the following operations are performed:

sending a key acquisition request to quantum key distribution equipment;

receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device, and taking the quantum key passing the consistency verification as the quantum key capable of being sent to the data device.

35. The quantum key storage output method of claim 33, wherein after the receiving of the key acquisition request sent by the data device, before the sending of the quantum key passing the consistency verification to the data device according to the same address interval negotiated with the peer key management device, the following operations are performed:

sending the key acquisition request to quantum key distribution equipment;

receiving a quantum key sent by quantum key distribution equipment, and storing the quantum key by adopting the same address interval as that of the opposite-end key management equipment;

and verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end key management device.

36. The quantum key storage output method of claim 34 or 35, wherein if the quantum key stored in the address interval and the quantum key stored in the same address interval by the peer management device fail consistency verification, the following operations are performed:

and clearing the quantum key stored in the address interval, and transmitting a key acquisition request to the quantum key distribution equipment to execute the step.

37. A quantum key storage output apparatus, disposed on a key management device that provides quantum keys to data devices, comprising:

a key acquisition request receiving unit, configured to receive a key acquisition request sent by a data device;

and the symmetric key output unit is used for sending the quantum key passing the consistency verification to the data equipment according to the same address interval negotiated with the opposite-end key management equipment.

38. A quantum key distribution storage method, implemented on a quantum key distribution device, comprising:

negotiating a quantum key with an opposite-end quantum key distribution device through a quantum key distribution protocol, and storing the obtained quantum key in the same address interval as the opposite-end quantum key distribution device;

verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end quantum key distribution equipment;

and according to a received key acquisition request from the key management device, sending the quantum key passing the consistency verification to the key management device according to the same address interval negotiated with the opposite-end quantum key distribution device.

39. The quantum key distribution storage method of claim 38, wherein if the quantum key stored in the address interval and the quantum key stored in the same address interval by the peer quantum key distribution device fail consistency verification, performing the following operations:

and clearing the quantum key stored in the address interval, and transferring to the step of negotiating the quantum key with the opposite-end quantum key distribution equipment through a quantum key distribution protocol.

40. A quantum key distribution storage apparatus, the apparatus disposed on a quantum key distribution device, comprising:

the key distribution storage unit is used for negotiating a quantum key with opposite-end quantum key distribution equipment through a quantum key distribution protocol and storing the obtained quantum key in the same address interval as the opposite-end quantum key distribution equipment;

the key verification unit is used for verifying the consistency of the quantum key stored in the address interval and the quantum key stored in the same address interval by the opposite-end quantum key distribution equipment;

and the symmetric key sending unit is used for sending the quantum key passing the consistency verification to the key management equipment according to the key acquisition request received from the key management equipment and the same address interval negotiated with the opposite-end quantum key distribution equipment.

41. A quantum key output system, comprising: two subsystems respectively deployed at a transmitting side and a receiving side; the two subsystems respectively comprise: a quantum key acquisition apparatus according to claim 32, a quantum key storage output apparatus according to claim 37, and a quantum key distribution storage apparatus according to claim 40.

42. A method for verifying quantum key storage consistency, the method implemented on a first device and a second device participating in verification, comprising:

the first equipment sends information which is acquired through a quantum key negotiation process and represents a quantum key to be verified and address interval information which stores the quantum key to be verified to the second equipment;

the second device compares the received information with corresponding local information to judge whether the information corresponding to the address interval and representing the quantum key to be verified of the two devices is the same, if so, a verification passing response is returned to the first device, otherwise, a non-passing response is returned;

the information for representing the quantum key to be verified is composed of sub-information units corresponding to the bit number of the quantum key, and each sub-information unit is a unique identifier of different quantum bits in the quantum key to be verified and corresponds to the storage address of the identified quantum bit one by one.

43. A method for verifying quantum key storage consistency as defined in claim 42, wherein the information characterizing the quantum key to be verified comprises: the quantum key itself to be verified;

correspondingly, the sending, by the first device, information representing the quantum key to be verified, which is obtained through the quantum key agreement process, and address interval information storing the quantum key to be verified to the second device includes:

the first device calculates a hash value of the quantum key to be verified by adopting a preset hash algorithm, and sends the hash value and the address interval information to the second device;

the second device compares the received information with corresponding local information to determine whether the information representing the quantum key to be verified, corresponding to the address interval, of the two devices is the same as the information representing the quantum key to be verified, and the method includes:

the second device extracts address interval information for storing the quantum key to be verified from the received information, calculates the hash value of the quantum key stored in the local same address interval by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, and judges that the information corresponding to the address interval and representing the quantum key to be verified of the two devices is the same if the calculated hash value is the same as the received hash value.

44. A method for verifying quantum key storage consistency as defined in claim 42, wherein the information characterizing the quantum key to be verified comprises: a key label sequence of the quantum key to be verified, wherein each key label in the key label sequence is the sub-information unit; the address interval information for storing the quantum key to be verified comprises: an address sequence formed by the storage address of each quantum bit in the quantum key to be verified;

correspondingly, the sending, by the first device, information representing the quantum key to be verified, which is obtained through the quantum key agreement process, and address interval information storing the quantum key to be verified to the second device includes:

the first device calculates a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting a preset hash algorithm, and sends the hash value and the address sequence or the hash value and the key label sequence to the second device;

the second device compares the received information with corresponding local information to determine whether the information representing the quantum key to be verified, corresponding to the address interval, of the two devices is the same as the information representing the quantum key to be verified, and the method includes:

and the second equipment acquires a corresponding key label sequence from the local according to the address sequence extracted from the received information, or acquires a corresponding address sequence from the local according to the extracted key label sequence, calculates a hash value of a character string formed by splicing the key label sequence and the address sequence by adopting the preset hash algorithm, judges whether the calculated hash value is the same as the received hash value, and judges that the information which corresponds to the address interval and represents the quantum key to be verified of the two equipment is the same if the calculated hash value is the same as the received hash value.

45. A method for verifying quantum key storage consistency as defined in claim 44, wherein the key tag comprises: time stamp information of the qubit.

46. A method for verifying quantum key storage consistency according to any of claims 42 to 45, further comprising:

the first equipment encrypts information to be sent by adopting a key agreed with the second equipment in advance;

correspondingly, after receiving the information sent by the first device, the second device performs subsequent comparison and judgment operations after decrypting the information by using the corresponding key.

47. An apparatus for verifying quantum key storage consistency, comprising:

a key verification request sending unit, configured to send, by a first device, information representing a quantum key to be verified, which is obtained through a quantum key agreement process, and address interval information in which the quantum key to be verified is stored, to a second device;

the key verification execution unit is used for comparing the received information with local corresponding information by the second equipment, judging whether the information corresponding to the address interval and representing the quantum key to be verified of the two pieces of equipment is the same, if so, returning a verification passing response to the first equipment, and otherwise, returning a non-passing response;

the information for representing the quantum key to be verified is composed of sub-information units corresponding to the bit number of the quantum key, and each sub-information unit is a unique identifier of different quantum bits in the quantum key to be verified and corresponds to the storage address of the identified quantum bit one by one.