System, method, and apparatus for quantum key output, storage, and consistency verification

1. A method, comprising:

acquiring, by a first quantum key management device, a first quantum key from a first quantum key distribution device; and

storing, by the first quantum key management device, the acquired first quantum key in a first management device address range in a first storage media, the first management device address range having the same address range indicator as a second management device address range in a second storage media for storing a corresponding second quantum key acquired by a second quantum key management device, wherein the address range indicator is one of a pair of head address and a tail address, a head address and a range length, or a head address and a length of one of the first quantum key or the second quantum key.

2. The method according to claim 1 , further comprising:

performing a first consistency verification including determining, by the first quantum key management device, whether the first quantum key from the first quantum key distribution device is the same as the second quantum key; and

outputting, by the first quantum key management device, the first quantum key, if the first quantum key is determined to be the same as the second quantum key.

3. The method according to claim 2 , further comprising:

obtaining, by the first quantum key management device, a first key acquisition request from a first data device, before acquiring the first quantum key;

acquiring, by the first quantum key management device, the first quantum key from the first quantum key distribution device, according to the obtained first key acquisition request; and

sending, by the first quantum key management device, the first quantum key, to the first data device, if the first quantum key is determined to be the same as the second quantum key.

4. The method according to claim 3 , before obtaining, by the first quantum key management device, the first key acquisition request from the first data device, further comprising:

negotiating, by the first quantum key distribution device and with the second quantum key distribution device, to generate the first and second quantum keys through a quantum key distribution protocol;

storing, by the first quantum key distribution device, the first quantum key in a distribution device address range; and

performing a second consistency verification including verifying, by the first quantum key distribution device, consistency of the first and second quantum key, wherein the first key management device acquires the first quantum key, which is verified consistent with the second quantum key, from the first quantum key distribution device.

5. The method according to claim 4 ,

wherein the first quantum key that passes the first consistency verification is pre-stored in the first quantum key management device before the first quantum key management device receives the first key acquisition request; and

the method further comprising:

sending, by the first quantum key management device, a second key acquisition request to the first quantum key distribution device, and

sending, by the first quantum key distribution device, the first quantum key stored in the distribution device address range to the first key management device.

6. The method according to claim 5 , before sending the second key acquisition request to the first quantum key distribution device, further comprising:

notifying, by the first quantum key distribution device, the first key management device of a number of available quantum keys for acquisition.

7. The method according to claim 3 , after the first quantum key management device receives the first key acquisition request and before first quantum key management device sends the first quantum key that passes the first consistency verification to the first data device, further comprising:

sending, by the first quantum key management device, a second key acquisition request to the first quantum key distribution device;

negotiating, by the first quantum key distribution device and with the second quantum key distribution device, to generate the first and second quantum keys through a quantum key distribution protocol;

storing, by the first quantum key distribution device, the first quantum key in a distribution device address range; and

sending, by the first quantum key distribution device, the stored first quantum key to the first key management device.

8. The method according to claim 5 , further comprising:

if the first quantum key management device determines that the first quantum key is not the same as the second quantum key, clearing, by the first quantum key management device, the first quantum key stored in the first management device address range; and

sending, by the first quantum key management device, the second key acquisition request to the first quantum key distribution device.

9. The method according to claim 7 , wherein sending, by the first quantum key distribution device, the stored first quantum key to the first key management device, comprises:

performing a second consistency verification including verifying, by the first quantum key distribution device, consistency of the first and second quantum key; and sending, by the first quantum key distribution device, the first quantum key, that is verified consistent with the second quantum key, to the first key management device.

10. The method according to claim 9 , further comprising:

if the first quantum key management device determines that the first quantum key is not the same as the second quantum key, clearing, by the first quantum key distribution device, the first quantum key stored in the first management device address range; and

negotiating, by the first quantum key distribution device and with the second quantum key distribution device, a new quantum key through the quantum key distribution protocol.

11. The method according to claim 9 , further comprising regularly verifying, by the first quantum key distribution device and with the second quantum key distribution device, consistency of the first and second quantum keys.

12. The method according to claim 9 , wherein performing the first consistency verification includes:

determining, by a first quantum key management device, a first hash value of a first quantum key by using a preset hash algorithm;

encrypting, by a first quantum key management device, the first hash value and information of the first management device address range by using the first quantum key that passes the first consistency verification;

sending, by the first quantum key management device, the encrypted information including the first hash value to the second quantum key management device;

decrypting, by the second quantum key management device, the received information by using the first quantum key;

acquiring, by the second quantum key management device, the information of the address range;

determining, by the second quantum key management device, a second hash value of the first quantum key stored in a corresponding management device address range by using the preset hash algorithm;

determining, by the second quantum key management device, whether the first hash value is the same as the second hash value; and

if first hash value is determined to be the same as the second hash value, sending, by the second quantum key management device to the first quantum key management device, an acknowledgment indicating that the first consistency verification is passed.

13. The method according to claim 3 , further comprising:

after the first quantum key management device sends the first quantum key to the first data device, performing a third consistency verification including verifying, by the first data device and with a second data device, consistency of the received first quantum key and the second quantum key; and

determining, by the first data device, that the first quantum key can be used for data encryption and decryption, if the first quantum key is determined to be consistent with the second quantum key.

14. The method according to claim 13 , further comprising:

if the first data device determines that the first quantum key is not consistent with the second quantum key, sending, by the first data device, the first key acquisition request to the first key management device.

15. The method according to claim 13 , wherein verifying, by the first data device, consistency of the acquired first quantum key comprises:

determining, by the first data device, a first hash value of the acquired first quantum key by using a preset hash algorithm;

encrypting, by the first data device, the first hash value by using the first quantum key that passes the first consistency verification;

sending, by the first data device, encrypted information including the first hash value to the second data device;

after the second data device decrypts the received information by using a corresponding key, determining, by the second data device, a second hash value of the second quantum key by using the preset hash algorithm;

determining whether the first hash value is the same as the second hash value; and

if the first hash value is determined to be the same as the second hash value, returning, by the second data device, an acknowledgment indicating that the verification is passed to the first data device.

16. The method according to claim 9 ,

wherein the first and second quantum keys negotiated and acquired by the first and second quantum key distribution devices through the quantum key distribution protocol have corresponding key label sequences, and each key label in the key label sequence is a unique identification of a different quantum bit in the quantum keys; and

the method further comprising:

correspondingly, after the first quantum key distribution device stores the first quantum key, establishing, by the first quantum key distribution device, a one-to-one corresponding relationship between a storage address of each quantum bit and a key label, wherein the information sent to the first quantum key management device by the first quantum key distribution device includes the first quantum key and a key label sequence corresponding to the first quantum key; and

after the first quantum key management device stores the received first quantum key, establishing a one-to-one corresponding relationship between a storage address of each quantum bit and each key label.

17. The method according to claim 16 , wherein the information sent to the first data device by the first quantum key management device includes the first quantum key and a key label sequence of the first quantum key.

18. The method according to claim 16 , wherein:

the key label comprises timestamp information of the quantum bit; and

the timestamp information is acquired by the first quantum key distribution device when the first quantum key distribution device negotiates the first quantum key.

19. The method according to claim 13 , wherein the first and second data devices, the first and second quantum key management devices, and first and second quantum key distribution devices communicate with one another via a classical channel based on HTTPS connection.

20. The method according to claim 13 , wherein every two devices of the first and second data devices, the first and second quantum key management devices, and the first and second quantum key distribution devices, perform a two-way identity authentication before communicating.

21. A system, comprising a first quantum key management device, which comprises:

a memory storing instructions; and

one or more processors configured to execute the instructions to:

acquire a first quantum key from a first quantum key distribution device, and

store the acquired first quantum key in a first management device address range in a first storage media, the first management device address range having the same address range indicator as a second management device address range in a second storage media for storing a corresponding second quantum key acquired by a second quantum key management device, wherein the address range indicator is one of a pair of head address and a tail address, a head address and a range length, or a head address and a length of one of the first quantum key or the second quantum key.

22. The system according to claim 21 , wherein the one or more processors are configured to execute the instructions to cause the system to further perform:

perform a first consistency verification including determining whether the first quantum key from the first quantum key distribution device is the same as the second quantum key; and

output the first quantum key, if the first quantum key is determined to be the same as the second quantum key.

23. A non-transitory computer-readable storage medium that stores a set of instructions that is executable by at least one processor of a first quantum key management device to cause the first quantum key management device to perform a method comprising:

acquiring a first quantum key from a first quantum key distribution device; and

storing the acquired first quantum key in a first management device address range in a first storage media, the first management device address range having the same address range indicator as a second management device address range in a second storage media for storing a corresponding second quantum key acquired by a second quantum key management device, wherein the address range indicator is one of a pair of head address and a tail address, a head address and a range length, or a head address and a length of one of the first quantum key or the second quantum key.

24. The computer-readable storage medium according to claim 23 , wherein the set of instructions that are executable by the at least one processor of a computer to cause the computer to further perform:

performing a first consistency verification including determining whether the first quantum key from the first quantum key distribution device is the same as the second quantum key; and

providing for output the first quantum key, if the first quantum key is determined to be the same as the second quantum key.