Method, apparatus, and system for quantum key distribution

1. A quantum key distribution system, comprising:

a quantum security key management device;

a plurality of quantum security key distribution devices connected with the quantum security key management device; and

a quantum security key service device connected with the quantum security key management device and the plurality of quantum security key distribution devices, wherein:

the quantum security key management device is configured to split an identity-based system private key into a plurality of system sub-private keys, and distributes the plurality of system sub-private keys to a corresponding number of the quantum security key distribution devices;

the quantum security key service device is configured to forward a request for acquiring an authorized private key from a first quantum security key distribution device of the plurality of quantum security key distribution devices to a predetermined number of second quantum security key distribution devices of the plurality of quantum security key distribution devices;

the predetermined number of second quantum security key distribution devices are configured to each generate, based on the identity of the first quantum security key distribution device, an identity-based authorized sub-private key from the system sub-private key; and

the first quantum security key distribution device is configured to acquire, from the predetermined number of second quantum security key distribution devices, the identity-based authorized sub-private keys, and reconstructs an identity-based authorized private key based on the identity-based authorized sub-private keys.

2. The quantum key distribution system of claim 1 , wherein at least one of the plurality of quantum security key distribution devices includes the quantum security key service device.

3. The quantum key distribution system of claim 1 , wherein the quantum security key management device is further configured to split the identity-based system private key by using a threshold secret sharing mechanism and the first quantum security key distribution device is further configured to reconstruct an identity-based authorized private key by using the threshold secret sharing mechanism.

4. The quantum key distribution system of claim 1 , wherein the first quantum security key distribution device is further configured to generate an identity-based signature certificate in accordance with the reconstructed identity-based authorized private key.

5. The quantum key distribution system of claim 1 , wherein the quantum security key management device is further configured to generate the identity-based system private key based on identifier information of the quantum key distribution system, a random number generated by a quantum noise source, and timestamp information.

6. The quantum key distribution system of claim 5 , wherein the quantum security key management device is further configured to generate the identity-based system private key based on a formula:

S=S r ⊕( BN ID /expire_time)

wherein S r is the random number generated by the quantum noise source, BN ID is the identifier information of the system, expire_time is the timestamp information, and S is the identity-based system private key.

7. The quantum key distribution system of claim 1 , wherein the quantum security key management device is further configured to generate the identity-based system private key based on a random number generated by a quantum noise source, identifier information of the quantum security key management device, and timestamp information.

8. The quantum key distribution system of claim 1 , wherein each of the second quantum security key distribution device is further configured to generate the identity-based authorized sub-private key based on identifier information of the first quantum security key distribution device, timestamp information, and the system sub-private key.

9. The quantum key distribution system of claim 8 , wherein each of the second quantum security key distribution device is further configured to generate the identity-based authorized sub-private key by a formula:

S ur =s i r ( u ID /expire_time)

wherein S i r is the system sub-private key, U ID is the identifier information of the first quantum security key distribution device, expire_time is the timestamp information, and S ur is an identity-based authorized sub-private key.

10. The quantum key distribution system of claim 1 , wherein:

the quantum security key management device is further configured to generate identifier information of a quantum security distribution device or a quantum security key service device in accordance with a registration request received from the quantum security key distribution device or the quantum security key service device; and

the quantum security key distribution device and the quantum security key service device are further configured to:

acquire a random number generated by a quantum noise source and timestamp information from the quantum security key management device, and

generate an identity-based private key or a shared key in accordance with the identifier information, the random number, and the timestamp information.

11. The quantum key distribution system of claim 1 , wherein:

the quantum security key management device is further configured to split the identity-based system private key into a plurality of system sub-private using a threshold secret sharing mechanism based on Lagrange interpolation; and

the first quantum security key distribution device is configured to reconstruct an identity-based authorized private key based on the identity-based authorized sub-private keys using the threshold secret sharing mechanism based on Lagrange interpolation.

12. The quantum key distribution system of claim 1 , wherein:

the quantum security key management device is further configured to distribute the plurality of system sub-private keys to a corresponding number of the quantum security key distribution devices in accordance with a quantum key agreement; and

the first quantum security key distribution device is configured to acquire, from the predetermined number of second quantum security key distribution devices, the identity-based authorized sub-private keys in accordance with the quantum key agreement,

the quantum key agreement being a redundancy transmission quantum key agreement or an on-demand retransmission quantum key agreement.

13. A quantum key distribution method, comprising:

receiving, by a quantum security key service device, a request for acquiring an authorized private key from a first quantum security key distribution device of a requester, the request at least carrying identifier information of the requester; and

forwarding, by the quantum security key service device, the request to a predetermined number of second quantum security key distribution devices, which generate a plurality of authorized sub-private keys based on the identifier information of the requester and a plurality of system sub-private keys that have been split from an identity-based system private key using a threshold secret sharing mechanism and that have been shared with a corresponding number of quantum key distribution devices,

wherein the plurality of authorized sub-private keys received by the first quantum security key distribution device of the requester enable the first quantum security key distribution device of the requester to reconstruct an identity-based authorized private key based on the authorized sub-private keys.

14. The quantum key distribution method of claim 13 , wherein the identity-based authorized private key is reconstructed by using a threshold secret sharing mechanism.

15. The quantum key distribution method of claim 13 , wherein:

the plurality of system sub-private keys have been shared with the corresponding number of second quantum security key distribution devices in accordance with the quantum key agreement,

the quantum key agreement being a redundancy transmission quantum key agreement or an on-demand retransmission quantum key agreement.

16. The quantum key distribution method of claim 15 , wherein the identity-based system private key is generated based on a random number generated by a quantum noise source, identifier information of a quantum key distribution system, and timestamp information.

17. The quantum key distribution method of claim 16 , wherein the quantum security key management device generates the identity-based system private key by a formula:

S=S r ⊕( BN ID /expire_time)

wherein Sr is the random number generated by the quantum noise source, BN ID is the identifier information of the quantum key distribution system, expire_time is the timestamp information, and S is the identity-based system private key.

18. The quantum key distribution method of claim 13 , before receiving, by the quantum security key service device, the request, further comprising:

generating, by a quantum security key management device, the identity-based system private key by using a random number generated by a quantum noise source, identifier information of a quantum key distribution system, and timestamp information.

19. The quantum key distribution method of claim 13 , further comprising:

receiving, by a quantum security key management device, a registration request from a quantum security key distribution device or the quantum security key service device;

generating and distributing, by the quantum security key management device, identifier information for the device that initiates the registration request;

sharing, by the quantum security key management device, a random number generated by a quantum noise source and timestamp information with the device that initiates the registration request; and

generating, by the device that initiates the registration request, an identity-based private key in accordance with the identifier information, the random number, and the timestamp information.

20. The quantum key distribution method of claim 13 , further comprising:

verifying validity of the identifier information of the requester by a quantum security key management device.

21. The quantum key distribution method of claim 13 , wherein the plurality of authorized sub-private keys are generated further based on timestamp information.

22. The quantum key distribution method of claim 21 , wherein the authorized sub-private keys are generated through a formula:

S ur =s i r ( u ID /expire_time)

wherein S i r is a system sub-private key, U ID is the identifier information of the requester, expire_time is the timestamp information, and S ur is an authorized sub-private key.

23. The quantum key distribution method of claim 13 , wherein:

the plurality of system sub-private keys have been split from the system private key using the threshold secret sharing mechanism based on Lagrange interpolation; and

the identity-based authorized private key is reconstructed based on the authorized sub-private keys by using the threshold secret sharing mechanism based on Lagrange interpolation.

24. The quantum key distribution method of claim 13 , further comprising generating an identity-based signature certificate in accordance with the reconstructed identity-based authorized private key.

25. The quantum key distribution method of claim 13 , wherein the request for acquiring an authorized private key is initiated by a quantum security key distribution device connected with a data center server.

26. The quantum key distribution method of claim 13 , wherein the request for acquiring an authorized private key is initiated by a quantum security key distribution device of a cloud user, the request carrying identifier information of the quantum security key distribution device or identifier information of the cloud user.

27. A quantum key distribution method, comprising:

splitting, by a quantum security key management device, a system private key into a plurality of system sub-private keys;

distributing, by the quantum security key management device, the plurality of system sub-private keys to a corresponding number of quantum security key distribution devices;

receiving, by a quantum security key service device, a request for acquiring an authorized private key from a first quantum security key distribution device of a requester, the request at least carrying identifier information of the requester;

forwarding, by the quantum security key service device, the request to a predetermined number of second quantum security key distribution devices of the corresponding number of quantum security key distribution devices;

receiving, by the first quantum security key distribution device, a plurality of authorized sub-private keys generated, by the predetermined number of second quantum security key distribution devices, based on the identifier information of the requester and a plurality of system sub-private keys; and

reconstructing, by the first quantum security key distribution device of the requester, an identity-based authorized private key based on the authorized sub-private keys.

28. The quantum key distribution method of claim 27 , further comprising generating, by the quantum security key management device, the system private key by using a random number generated by a quantum noise source, identifier information of a quantum key distribution system, and timestamp information.

29. The quantum key distribution method of claim 27 , wherein splitting, by the quantum security key management device, the system private key into the plurality of system sub-private keys includes:

splitting, by a quantum security key management device, a system private key into a plurality of system sub-private keys by using a threshold secret sharing mechanism based on Lagrange interpolation.

30. A quantum key distribution method of claim 27 , wherein reconstructing, by the first quantum security key distribution device of the requester, the identity-based authorized private key based on the authorized sub-private keys includes:

reconstructing, by the first quantum security key distribution device of the requester, an identity-based authorized private key based on the authorized sub-private keys by using a threshold secret sharing mechanism based on Lagrange interpolation.

31. A quantum key distribution apparatus; comprising:

a memory storing a set of instructions;

a processor configured to execute the set of instructions to cause the apparatus to:

receive a request for acquiring an authorized private key from a first quantum security key distribution device of a requester, the request at least carrying identifier information of the requester; and

forward the request to a predetermined number of second quantum security key distribution devices, which

generate a plurality of authorized sub-private keys based on the identity of the requester and a plurality of system sub-private keys and share the authorized sub-private keys with the first quantum security key distribution device of the requester, the plurality of system sub-private keys have been split from an identity-based system private key using a threshold secrete sharing mechanism and have been shared with a corresponding number of second sub-quantum security key distribution devices,

wherein the authorized sub-private keys enable the first quantum security key distribution device of the requester to reconstruct an identity-based authorized private key based on the authorized sub-private keys.

32. The quantum key distribution apparatus of claim 31 , wherein the processor is further configured to execute the set of instructions to cause the apparatus to share the authorized sub-private keys with the first quantum security key distribution device of the requester, in accordance with a redundancy transmission quantum key agreement or an on-demand retransmission quantum key agreement.

33. The quantum key distribution apparatus of claim 31 , wherein the processor is further configured to execute the set of instructions to cause the apparatus to generate the system private key based on a random number generated by a quantum noise source, identifier information of the system, and timestamp information.

34. The quantum key distribution apparatus of claim 33 , wherein the processor is further configured to execute the set of instructions to cause the apparatus to generate the system private key through the following formula:

S=S r ⊕( BN ID /expire_time)

wherein Sr is the random number generated by the quantum noise source, BN ID is the identifier information of the quantum key distribution system, expire_time is the timestamp information, and S is the identity-based system private key.

35. The quantum key distribution apparatus of claim 31 , wherein the plurality of system sub-private keys have been split from the system private key using a secret sharing algorithm of the threshold secret sharing mechanism based on Lagrange interpolation; and

the identity-based authorized private key is reconstructed by using a reconstruction algorithm of the threshold secret sharing mechanism based on Lagrange interpolation.

36. The quantum key distribution apparatus of claim 31 , wherein the processor is further configured to execute the set of instructions to cause the apparatus to generate the authorized sub-private keys based on the identity of the requester in accordance with identifier information of the requester, the plurality of system sub-private keys, and timestamp information.

37. The quantum key distribution apparatus of claim 36 , wherein the processor is further configured to execute the set of instructions to cause the apparatus to unit generate the authorized sub-private keys based on the identity of the requester through the following formula:

S ur =s i r ( u ID /expire_time)

wherein S i r is the system sub-private key, U ID is the identifier information of the requester, expire_time is the timestamp information, and S ur is the authorized sub-private key based on the identity of the requester.

38. A non-transitory computer readable medium storing one or more programs, the one or more programs comprising instructions which, when executed by a computer system including a quantum security key service device and a first quantum security key distribution device, cause the computer system to perform a method comprising:

receiving, by the quantum security key service device, a request for acquiring an authorized private key from the first quantum security key distribution device of a requester, the request at least carrying identifier information of the requester; and

forwarding, by the quantum security key service device, the request to a predetermined number of second quantum security key distribution devices, which generate a plurality of authorized sub-private keys based on the identifier information of the requester and a plurality of system sub-private keys that have been split from an identity-based system private key using a threshold secret sharing mechanism and that have been shared with a corresponding number of quantum key distribution devices,

wherein the plurality of authorized sub-private keys received by the first quantum security key distribution device of the requester enable the first quantum security key distribution device of the requester to reconstruct an identity-based authorized private key based on the authorized sub-private keys.

39. A non-transitory computer readable medium storing one or more programs, the one or more programs comprising instructions which, when executed by a computer system including a quantum security key management device, a quantum security key service device, and a first quantum security key distribution device, cause the computer system to perform a method comprising:

splitting, by the quantum security key management device, a system private key into a plurality of system sub-private keys;

distributing, by the quantum security key management device, the plurality of system sub-private keys to a corresponding number of quantum security key distribution devices;

receiving, by the quantum security key service device, a request for acquiring an authorized private key from the first quantum security key distribution device of a requester, the request at least carrying identifier information of the requester;

forwarding, by the quantum security key service device, the request to a predetermined number of second quantum security key distribution devices of the corresponding number of quantum security key distribution devices;

receiving, by the first quantum security key distribution device, a plurality of authorized sub-private keys generated, by the predetermined number of second quantum security key distribution devices, based on the identifier information of the requester and a plurality of system sub-private keys; and

reconstructing, by the first quantum security key distribution device of the requester, an identity-based authorized private key based on the authorized sub-private keys.