Quantum Communication System Architecture

2.1 Overall Architecture

2.2 Signaling and Service Separated Encryption Architecture

This system adopts the technical approach of separate encryption for signaling and service, which differs from traditional VPN encryption solutions:

Comparison Dimension	Traditional VPN Solution	This Solution (Signaling/Service Separated Encryption)
Encryption Layer	Network Layer (IPSec/SSL VPN)	Application Layer (SIP Signaling + Media Stream)
Public Network Traversal	Easily blocked by firewall/NAT	Standard SIP port, not easily identified or blocked
Key Management	Pre-shared key or certificate	Quantum true random number dynamic key
Quantum Resistance	Relies on traditional algorithms	ML-KEM/ML-DSA natively quantum-resistant
Performance Overhead	High VPN encapsulation overhead	Lightweight encryption, single tunnel <1ms latency

Compliance

Requires additional security audit

SM (National Cryptographic) + Quantum dual certification

Encryption Process:

1. SIP signaling channel: Uses ML-KEM encapsulation + SM2 signature to ensure signaling integrity and non-repudiation

2. Media service channel: Uses ML-DSA authentication + SM4 symmetric encryption to guarantee real-time audio/video transmission

3. Key update: Based on QRANG quantum true random number entropy source, session keys are periodically refreshed