Abstract: A method for quantum key output is disclosed. The method can be implemented by a first quantum key management device. The method can comprise acquiring a first quantum key from a first quantum key distribution device, according to the obtained first key acquisition request, and storing the acquired first quantum key in a first management device address range in a first storage media, the first management device address range having the same address range indicator as a second management device address range in a second storage media for storing a corresponding second quantum key acquired by a second quantum key management device, wherein the address range indicator is one of a pair of head address and a tail address, a head address and a range length, or a head address and a length of one of the first quantum key or the second quantum key.

Abstract: A quantum key distribution system includes a quantum security key management (QSKM) device, a plurality of quantum security key distribution (QSKD) devices, and a quantum security key service (QSKS) device. The QSKD device splits an identity-based system private key into a plurality of system sub-private keys, and distributes the plurality of system sub-private keys to a corresponding number of the QSKD devices. The QSKS device forwards a request for acquiring an authorized private key from a first QSKD device to a predetermined number of second QSKD devices. The predetermined number of second QSKD devices each generate an identity-based authorized sub-private key from the system sub-private key. The first QSKD device acquires, from the predetermined number of second QSKD devices, the identity-based authorized sub-private keys, and reconstructs an identity-based authorized private key based on the identity-based authorized sub-private keys.

Abstract: A method for quantum key output is disclosed. The method can be implemented by a first quantum key management device. The method can comprise acquiring a first quantum key from a first quantum key distribution device, according to the obtained first key acquisition request, and storing the acquired first quantum key in a first management device address range in a first storage media, the first management device address range having the same address range indicator as a second management device address range in a second storage media for storing a corresponding second quantum key acquired by a second quantum key management device, wherein the address range indicator is one of a pair of head address and a tail address, a head address and a range length, or a head address and a length of one of the first quantum key or the second quantum key.

Abstract: A method for quantum key output is disclosed. The method may be implemented by a first quantum key management device. The method may comprise obtaining a first key acquisition request from a first data device, acquiring a first quantum key from a first quantum key distribution device, according to the obtained first key acquisition request, storing the acquired first quantum key in a same management device address range as a corresponding second quantum key acquired by a second quantum key management device, performing a first consistency verification including determining whether the first quantum key is the same as the second quantum key, and sending the first quantum key to the first data device, if the first quantum key is determined to be the same as the second quantum key.

Abstract: One embodiment provide a system and method for detecting eavesdropping while establishing secure communication between a local node and a remote node. During operation, the local node generates a random key and a regular optical signal based on the random key. The local node also generates a quantum optical signal based on a control sequence and a set of quantum state bases, and multiplexes the regular optical signal and the quantum optical signal to produce a hybrid optical signal. The local node transmits the hybrid optical signal to the remote node, sends information associated with the control sequence and information associated with the set of quantum state bases to the remote node, and receives an eavesdropping-detection result from the remote node based on measurement of the quantum optical signal, the information associated with the control sequence, and the information associated with the set of quantum state bases.

Abstract: One embodiment described herein provides a system and method for establishing a secure communication channel between a client and a server. During operation, the client generates a service request comprising a first dynamic message, transmits the first service request to the server, which authenticates the client based on the first dynamic message, and receives a second dynamic message from the server in response to the first dynamic message. The client authenticates the server based on the second dynamic message, and negotiates, via a quantum-key-distribution process, a secret key shared between the client and the server. The client and server then establish a secure communication channel based on at least a first portion of the secret key.

Abstract: An identity authentication method for a quantum key distribution process includes selecting, by a sender, preparation bases of an identity authentication bit string in accordance with a preset basis vector selection rule; sending, by a sender, quantum states of the identity authentication bit string and quantum states of a randomly generated key bit string by using different wavelengths. The identity authentication bit string is interleaved in the key bit string at a random position and with a random length.

Abstract: A quantum key distribution system includes a quantum security key management (QSKM) device, a plurality of quantum security key distribution (QSKD) devices, and a quantum security key service (QSKS) device. The QSKD device splits an identity-based system private key into a plurality of system sub-private keys, and distributes the plurality of system sub-private keys to a corresponding number of the QSKD devices. The QSKS device forwards a request for acquiring an authorized private key from a first QSKD device to a predetermined number of second QSKD devices. The predetermined number of second QSKD devices each generate an identity-based authorized sub-private key from the system sub-private key. The first QSKD device acquires, from the predetermined number of second QSKD devices, the identity-based authorized sub-private keys, and reconstructs an identity-based authorized private key based on the identity-based authorized sub-private keys.

Abstract: A method and apparatus for quantum key distribution comprised of a privacy amplification method and device for the quantum key distribution process as well as a data transmission method and system based on quantum keys is provided, wherein the quantum key distribution method includes the following process: obtaining a bit stream of the same basis vector by sending or receiving coding quantum states of random bit streams and comparing those measurements obtained with the measurement basis vector; in accordance with a preset manner, extracting parameter information associated with privacy amplification and initial key information from the bit stream of the same basis vector after error correction; and using the initial key as an input to implement the privacy amplification algorithm based on the parameter information and thereby obtain shared quantum keys.

Abstract: A quantum key distribution system is provided. The quantum key distribution system includes a plurality of routing devices configured to relay keys and a quantum key distribution device connected with the routing devices and configured to use two or more different paths to perform corresponding quantum key negotiations with another quantum key distribution device to obtain shared keys. The two or more different paths each include one or more of the routing devices.

Abstract: One embodiment of the present application provides a system for key management. During operation, the system determines a key block from a key sequence obtained based on Quantum Key Distribution (QKD) and a time sequence identifier for the key block. The system synchronizes the key block with a corresponding key block of a partner key management system based on a hash of the key block and the time sequence identifier. If the synchronization is successful, the system stores the key block and the time sequence identifier in a key pool. If the system receives a request for a key from an application, the system acquires the key block from the key pool and validates the key block with the partner key management system based on a hash of the key block and the time sequence identifier. If the validation is successful, the system provides the key block to the application.

Abstract: One embodiment provides a system for facilitating distribution of quantum keys. During operation, the system receives, from a requester, a first request for a key, wherein the first request indicates a requested length for the key and identifying information of the requester. The system determines whether a subset pool of a general pool of keys is allocated to the requester based on the identifying information of the requester, wherein the keys in the general pool are generated by a quantum engine. In response to determining that a subset pool is not allocated to the requester, the system allocates a subset pool to the requester. The system obtains from the allocated subset pool a key with a length matching the requested length, and the system returns the obtained key to the requester.

Abstract: A cloud-based encryption machine key injection system includes at least one key injection sub-system including a key generation device and a quantum key distribution device connected with the key generation device, and a cloud-based encryption machine hosting sub-system including an encryption machine carrying a virtual encryption device and a quantum key distribution device connected with the encryption machine. The key injection sub-system and the encryption machine hosting sub-system are connected with each other through their respective quantum key distribution devices. The key generation device may generate a root key component of the virtual encryption device and transmit the root key component to the encryption machine. The encryption machine may receive root key components from one or more key generation devices and synthesize a root key of the virtual encryption device in accordance with the received root key components.

Abstract: A quantum key distribution system includes a quantum security key management (QSKM) device, a plurality of quantum security key distribution (QSKD) devices, and a quantum security key service (QSKS) device. The QSKD device splits an identity-based system private key into a plurality of system sub-private keys, and distributes the plurality of system sub-private keys to a corresponding number of the QSKD devices. The QSKS device forwards a request for acquiring an authorized private key from a first QSKD device to a predetermined number of second QSKD devices. The predetermined number of second QSKD devices each generate an identity-based authorized sub-private key from the system sub-private key. The first QSKD device acquires, from the predetermined number of second QSKD devices, the identity-based authorized sub-private keys, and reconstructs an identity-based authorized private key based on the identity-based authorized sub-private keys.

Abstract: An identity authentication method for a quantum key distribution process includes selecting, by a sender, preparation bases of an identity authentication bit string in accordance with a preset basis vector selection rule; sending, by a sender, quantum states of the identity authentication bit string and quantum states of a randomly generated key bit string by using different wavelengths. The identity authentication bit string is interleaved in the key bit string at a random position and with a random length.

Abstract: An identity authentication method for a quantum key distribution process includes selecting, by a sender, preparation bases of an identity authentication bit string in accordance with a preset basis vector selection rule; sending, by a sender, quantum states of the identity authentication bit string and quantum states of a randomly generated key bit string by using different wavelengths. The identity authentication bit string is interleaved in the key bit string at a random position and with a random length.

Abstract: One embodiment described herein provides a system and method for establishing a secure communication channel between a client and a server. During operation, the client generates a service request comprising a first dynamic message, transmits the first service request to the server, which authenticates the client based on the first dynamic message, and receives a second dynamic message from the server in response to the first dynamic message. The client authenticates the server based on the second dynamic message, and negotiates, via a quantum-key-distribution process, a secret key shared between the client and the server. The client and server then establish a secure communication channel based on at least a first portion of the secret key.

Abstract: One embodiment provide a system and method for detecting eavesdropping while establishing secure communication between a local node and a remote node. During operation, the local node generates a random key and a regular optical signal based on the random key. The local node also generates a quantum optical signal based on a control sequence and a set of quantum state bases, and multiplexes the regular optical signal and the quantum optical signal to produce a hybrid optical signal. The local node transmits the hybrid optical signal to the remote node, sends information associated with the control sequence and information associated with the set of quantum state bases to the remote node, and receives an eavesdropping-detection result from the remote node based on measurement of the quantum optical signal, the information associated with the control sequence, and the information associated with the set of quantum state bases.

Abstract: One embodiment of the present application provides a system for key management. During operation, the system determines a key block from a key sequence obtained based on Quantum Key Distribution (QKD) and a time sequence identifier for the key block. The system synchronizes the key block with a corresponding key block of a partner key management system based on a hash of the key block and the time sequence identifier. If the synchronization is successful, the system stores the key block and the time sequence identifier in a key pool. If the system receives a request for a key from an application, the system acquires the key block from the key pool and validates the key block with the partner key management system based on a hash of the key block and the time sequence identifier. If the validation is successful, the system provides the key block to the application.

Abstract: One embodiment provides a system for facilitating distribution of quantum keys. During operation, the system receives, from a requester, a first request for a key, wherein the first request indicates a requested length for the key and identifying information of the requester. The system determines whether a subset pool of a general pool of keys is allocated to the requester based on the identifying information of the requester, wherein the keys in the general pool are generated by a quantum engine. In response to determining that a subset pool is not allocated to the requester, the system allocates a subset pool to the requester. The system obtains from the allocated subset pool a key with a length matching the requested length, and the system returns the obtained key to the requester.