Method, device and equipment based on key communication, medium and product

Abstract

The invention relates to the technical field of information security, and particularly provides a method, a device, equipment, a medium and a product based on key communication, and the method comprises the steps: responding to a key obtaining request of a service application, and determining at least one key corresponding to the service application; determining a first key to be used currently based on the number of times of use of each key in a key resource pool by the service application; generating a target key based on the application identifier of the service application and the first key; and performing encryption and / or integrity protection on the service data of the service application according to the second key, and sending the encrypted and / or integrity-protected service data to a service platform for processing.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a method, device, equipment, medium and product based on key communication. Background Art

[0002] With the rapid development of Internet technology, the cybersecurity risks of information systems continue to increase. Usually, it is necessary to use a key to encrypt the data to be transmitted before transmission. For example, quantum keys can be used to encrypt the data to be transmitted, so that the business system can achieve unconditional secure communication.

[0003] In the prior art, each key needs to be discarded after use. For example, when using quantum keys for encryption, the key usage frequency is high when the business volume is large and the business applications are many, which leads to the need to frequently inject the key into the USIM (Universal Subscriber Identity Module). However, the cost of injecting the key is high, and repeated injection of the key will also lead to the problem of shortening the life of the USIM card. Summary of the invention

[0004] In view of the above problems, the present disclosure is proposed. The present disclosure provides a method, apparatus, device, medium and product based on key communication.

[0005] According to one aspect of the present disclosure, a key-based communication method is provided, which is applied to a security terminal and includes:

[0006] In response to a key acquisition request of a business application, determining at least one key corresponding to the business application;

[0007] Determining a first key to be currently used based on the number of times each key in the key resource pool is used by the business application;

[0008] Generate a second key based on the application identifier of the business application and the first key;

[0009] The service data of the service application is encrypted and / or integrity protected according to the second key, and the encrypted and / or integrity protected service data is sent to the service platform for processing.

[0010] In addition, according to another embodiment of one aspect of the present disclosure, the generating the second key based on the application identifier of the business application and the first key includes:

[0011] The first key and the key generation parameters are processed according to a preset generation algorithm to obtain the second key; wherein the key generation parameters include at least one of the following: a target random number, a first identifier, and the application identifier, wherein the first identifier is used to indicate a global user identity card identifier set in the security terminal.

[0012] In addition, according to another embodiment of one aspect of the present disclosure, determining the first key to be used currently based on the number of times each key in the key resource pool is used by the business application includes:

[0013] Based on the key acquisition request, obtain security context information of the business application; wherein the security context information is used to indicate the use of the key by the business application, and the use includes at least one of the following: the number of times the key is used;

[0014] The first key to be currently used is determined according to the search result of the security context information and the number of times each key is used by the business application.

[0015] In addition, according to another embodiment of one aspect of the present disclosure, determining the first key to be currently used according to the search result of the security context information and the number of times each key is used by the business application includes:

[0016] In the case that the security context information is not found, any key among the at least one key corresponding to the business application is determined to be the first key, and a first usage count and a first maximum usage count of the first key are set to obtain the security context information.

[0017] In addition, according to another embodiment of one aspect of the present disclosure, determining the first key to be currently used according to the acquisition result of the security context information and the number of times each key is used by the business application includes:

[0018] In the case where the security context information is found, determining, based on the security context information, a third key used for the last communication with the service platform;

[0019] Determine a second number of times the service application uses the third key, and determine a second maximum number of times the service application uses the third key;

[0020] Incrementally process the second usage count to obtain a third usage count;

[0021] When the third usage count is less than the second maximum usage count, the third key is determined as the first key.

[0022] In addition, in another embodiment according to one aspect of the present disclosure, the method further includes:

[0023] When it is determined that the third usage count is greater than or equal to the second maximum usage count, a key among the at least one key that has not been used by the business application is determined to be the first key.

[0024] In addition, in another embodiment according to one aspect of the present disclosure, the method further includes:

[0025] When the security terminal meets the key injection conditions, a key injection request is initiated to the service platform; wherein the key injection conditions include at least one of the following: the number of times all keys of at least one service application are used exceeds the corresponding maximum number of times, and the number of times all keys of each service application are used exceeds the corresponding maximum number of times.

[0026] In addition, in another embodiment according to one aspect of the present disclosure, the method further includes:

[0027] In the process of sending the encrypted business data to the business platform for processing, a business access request is sent; wherein the business access request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, the first identifier, the real-time usage count of the first key, the maximum usage count of the first key, and a preset generation algorithm for the second key; the target random number is a parameter for generating the second key.

[0028] According to another aspect of the present disclosure, a key-based communication method is provided, which is applied to a service platform and includes:

[0029] Obtaining encrypted business data sent by the security terminal;

[0030] Determining a decryption key for the encrypted business data;

[0031] The encrypted business data is decrypted using the decryption key to obtain the business data.

[0032] In addition, according to another embodiment of one aspect of the present disclosure, the determining the decryption key of the encrypted business data includes:

[0033] Sending a key acquisition request to a target business platform; wherein the key acquisition request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, the first identifier, the number of real-time uses of the first key, the maximum number of uses of the first key, and a preset generation algorithm of the second key; the target random number is a parameter for generating the second key;

[0034] Obtain the decryption key fed back by the target service platform based on the key acquisition request.

[0035] In addition, according to another embodiment of one aspect of the present disclosure, the determining the decryption key of the encrypted business data includes:

[0036] When it is determined based on the key acquisition request that the first key meets the policy requirements, the first key is processed according to a preset generation algorithm to obtain the decryption key; wherein the policy requirements are associated with the number of real-time uses of the first key by the business application.

[0037] In addition, according to another embodiment of one aspect of the present disclosure, the determining the decryption key of the encrypted business data includes:

[0038] When it is determined based on the key acquisition request that the first key does not meet the policy requirement, an error message is sent to the second key service platform; wherein the error message is used to indicate that the decryption key cannot be determined.

[0039] According to another aspect of the present disclosure, there is provided a key-based communication device, comprising:

[0040] A response module, configured to determine at least one key corresponding to the business application in response to a key acquisition request of the business application;

[0041] A first determination module, configured to determine a first key to be used currently based on the number of times each key in the key resource pool is used by the business application;

[0042] A generating module, configured to generate a second key based on an application identifier of the business application and the first key;

[0043] An encryption module is used to encrypt and / or integrity protect the business data of the business application according to the second key, and send the encrypted and / or integrity protected business data to the business platform for processing.

[0044] According to another aspect of the present disclosure, there is provided a key-based communication device, comprising:

[0045] An acquisition module, used to acquire encrypted business data sent by a security terminal;

[0046] A second determination module, used to determine a decryption key for the encrypted business data;

[0047] The decryption module is used to decrypt the encrypted business data using the decryption key to obtain the business data.

[0048] According to another aspect of the present disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement steps of a method for determining a log template.

[0049] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of a method for determining a log template are implemented.

[0050] According to another aspect of the present disclosure, a computer program product is provided, including a computer program / instruction, which implements the steps of a method for determining a log template when the computer program / instruction is executed by a processor.

[0051] As will be described in detail below, a method, apparatus, device, medium and product based on quantum key communication according to an embodiment of the present disclosure. By determining the first key according to the number of times the key is used by the business application, the key that meets the usage requirements can be quickly screened for the business application. By generating the second key for encrypted communication through the first key and the application identifier, it is possible to achieve multiple uses of each key in the key resource pool, thereby increasing the number of times each key in the key resource pool is used, and reducing the key filling frequency of the key. Especially in the communication process based on quantum keys, since the second key is generated differently, the security of the business data can be further guaranteed.

[0052] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0054] Figure 1 A flowchart of a quantum key-based communication method provided in an embodiment of the present disclosure.

[0055] Figure 2 A flowchart of another quantum key-based communication method provided in an embodiment of the present disclosure.

[0056] Figure 3 An interactive flow chart of a key-based communication system provided for an embodiment of the present disclosure.

[0057] Figure 4 A schematic diagram of a quantum key-based communication device provided in an embodiment of the present disclosure.

[0058] Figure 5 A schematic diagram of another quantum key-based communication device provided in an embodiment of the present disclosure.

[0059] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0061] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0062] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0063] Research has found that with the rapid development of Internet technology, the cybersecurity risks of information systems continue to increase. Quantum security keys are based on the principles of quantum mechanics and use the non-cloning and non-measurable characteristics of quantum states to achieve a new way of encrypted communication. By adopting quantum security keys, business systems can achieve unconditional secure communication. At the same time, the fast distribution speed of quantum security keys can achieve real-time encrypted communication and improve communication efficiency.

[0064] In the prior art, each quantum key needs to be discarded after use. When the business volume is large and the business applications are many, the quantum key is used frequently, which leads to the need to frequently inject quantum keys into the USIM (Universal Subscriber Identity Module). However, the cost of quantum key injection is high, and repeated injection will also reduce the life of the USIM card.

[0065] Based on the above research, the present disclosure provides a method based on quantum key communication. By determining the first key according to the number of times the business application uses the quantum key, the quantum key that meets the use requirements can be quickly screened for the business application. By generating the second key for encrypted communication through the first key and the application identifier, the multiple use of each quantum key in the quantum key pool can be achieved, and the number of times each quantum key in the quantum key pool is used can be increased, reducing the key filling frequency of the quantum key. For each quantum communication process, since the second key is generated differently, the security of the business data can be further guaranteed.

[0066] To facilitate understanding of this embodiment, a communication method based on quantum keys disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the communication method based on quantum keys provided in the embodiment of the present disclosure is generally an electronic device with certain computing capabilities. In some possible implementations, the communication method based on quantum keys can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0067] Figure 1 As shown, it is a flowchart of a key-based communication method provided by an embodiment of the present disclosure, the method includes steps S101 to S104, applied to a security terminal, wherein:

[0068] S101. In response to a key acquisition request from a business application, determine at least one key corresponding to the business application.

[0069] In an embodiment of the present disclosure, when a business application installed on a security terminal (i.e., a quantum secure terminal, Quantum Secure Equipment, QSE) needs to communicate with a business platform (i.e., a quantum cryptography service platform) based on quantum key security, a key acquisition request may be generated. The key acquisition request carries an application identifier of the business application.

[0070] Afterwards, the business application can send a key acquisition request to the quantum key management application on the global user identity card set in the security terminal.

[0071] Here, after the quantum key management application receives the key acquisition request, it can determine at least one key (ie, quantum key) corresponding to the business application in the key resource pool stored locally based on the application identifier carried in the key acquisition request.

[0072] Here, the key resource pool includes at least one key sub-resource pool. In the case where the key resource pool includes one key sub-resource pool (that is, there is one key resource pool), at least one key corresponding to the business application can be determined in the key resource pool in the following manner:

[0073] Method 1: Some or all of the keys in the key resource pool may be determined as at least one key.

[0074] In this way, all business applications installed on the security terminal can share the quantum keys in the key resource pool.

[0075] Method 2: A key in the key resource pool that matches the business application may be determined as at least one key.

[0076] In this way, different keys in the key resource pool can be allocated to different business applications.

[0077] In the case where the key resource pool includes multiple key sub-resource pools, one or more keys can be allocated to each key sub-resource pool; then, the key sub-resource pools are matched with all business applications installed on the security terminal, so as to determine the key sub-resource pool dedicated to each business application. At this time, the quantum key in the key sub-resource pool dedicated to each business application can be determined as at least one key.

[0078] S102: Determine a first key to be used currently based on the number of times each key in the key resource pool is used by a business application.

[0079] In an embodiment of the present disclosure, first, the quantum key management application can determine the key sub-resource pool corresponding to the business application. Secondly, determine the number of times the business application uses each key in the key sub-resource pool that the business application can use. Finally, based on the number of times the business application uses each key that can be used, determine that the key whose number of uses at the current moment meets the preset number of times condition is the first key. The first key is a quantum key.

[0080] The preset number of times condition is used to indicate that the real-time usage number of the key is less than the maximum usage number of the key. The maximum usage number of the key can be determined based on the security requirements of the business application. The maximum usage number of the same key is different for different business applications.

[0081] S103: Generate a second key based on the application identifier of the business application and the first key.

[0082] In an embodiment of the present disclosure, a quantum key management application on a security terminal can determine a key generation parameter of a first key, and generate a second key based on the service application first key and the key generation parameter, wherein the second key is a quantum key.

[0083] The key generation parameters include at least one of the following: a first identifier and an application identifier of a business application.

[0084] S104: Encrypt and / or integrity protect the service data of the service application according to the second key, and send the encrypted and / or integrity protected service data to the service platform for processing.

[0085] In an embodiment of the present disclosure, the security terminal may use the second key to protect (ie, encrypt) the business data to obtain encrypted business data (ie, business data ciphertext).

[0086] Here, the security terminal may send a service access request to the service platform, wherein the service access request carries encrypted service data.

[0087] In an embodiment of the present disclosure, first, in response to a key acquisition request of a business application, at least one key corresponding to the business application is determined; secondly, based on the number of times each key in a key resource pool is used by the business application, a first key to be currently used is determined; thirdly, based on the application identifier of the business application and the first key, a second key is generated; finally, business data of the business application is encrypted and / or integrity protected according to the second key, and the encrypted and / or integrity protected business data is sent to the business platform for processing.

[0088] In the above embodiment, by determining the first key according to the number of times the business application uses the key, the key that meets the use requirements can be quickly screened for the business application. By generating the second key for encrypted communication through the first key and the application identifier, multiple uses of each key in the key resource pool can be achieved, thereby increasing the number of times each key in the key resource pool is used and reducing the key filling frequency. In particular, in the communication process based on quantum keys, since the second key is generated differently, the security of business data can be further guaranteed.

[0089] In an optional implementation, the above steps generate the second key based on the application identifier of the business application and the first key, and specifically include the following steps:

[0090] The first key and the key generation parameters are processed according to a preset generation algorithm to obtain a second key; wherein the key generation parameters include at least one of the following: a target random number, a first identifier, and an application identifier, and the first identifier is used to indicate a global user identity card identifier set in the security terminal.

[0091] In an embodiment of the present disclosure, a quantum key management application in a global user identity card provided in a security terminal can generate a target random number, wherein the target random number can be a timestamp.

[0092] Here, the preset generation algorithms include: KDF (Key derivation function) algorithm and hash algorithm. Among them, KDF algorithm includes: HMAC_SHA256 encryption algorithm and HMAC_SHA512 encryption algorithm.

[0093] Here, any preset generation algorithm can be determined based on the calculation method corresponding to the first key, the core algorithm and the length of the first key. Then, the target random number, the first identifier, the application identifier and the first key are processed by the preset generation algorithm to obtain the second key.

[0094] For example, when the preset generation algorithm is the KDF algorithm, the second key QKey meets the following conditions:

[0095] QKey=KDF(QK_i, R_UE, CS);

[0096] Where QK_i is the first key, R_UE is the target random number, and CS is the key generation parameter. When the preset generation algorithm is the hash algorithm, the second key QKey meets the following conditions:

[0097] QKey=hash(QK_i, R_UE, CS).

[0098] In an optional implementation, the above step determines the first key to be used currently based on the number of times each key in the key resource pool is used by the business application, including:

[0099] First, based on the key acquisition request, the security context information of the business application is acquired; wherein the security context information is used to indicate the usage of the key by the business application, and the usage includes at least one of the following: the number of times the key is used;

[0100] Then, according to the search result of the security context information and the number of times each key is used by the business application, the first key to be used currently is determined.

[0101] In an embodiment of the present disclosure, the quantum key management application can determine whether the service application requests to use the key for the first time based on the service identifier carried in the key acquisition request.

[0102] Here, if the business application is requesting to use a key for the first time, the security context information of the business application cannot be found (that is, the security context information of the business application is not stored in the quantum key management application). If the business application is not requesting to use a key for the first time, the security context information of the business application can be found.

[0103] With respect to the search result of the security context information (for example, found or not found), the first key to be currently used may be determined in different ways according to the number of times the key is used.

[0104] In the embodiment of the present disclosure, in the case where the security context information of the business application is not stored in the quantum key management application, after determining the first key for the business application, the security context information of the business application needs to be created. For example, the security context information of the business application can be obtained by initializing the key generation parameters of the first key.

[0105] In an optional implementation, the above step determines the first key to be used currently according to the search result of the security context information and the number of times each key is used by the business application, including:

[0106] In the case where the security context information is not found, any key among the at least one key corresponding to the business application is determined to be the first key, and a first usage count and a first maximum usage count of the first key are set to obtain the security context information.

[0107] In an embodiment of the present disclosure, when the quantum key management application fails to find security context information of the business application, one key can be arbitrarily selected from at least one key as the first key.

[0108] In addition, the first usage count of the first key (ie, the number of times the service application uses the first key) may be initialized to 1, and the maximum usage count of the key may be determined according to the security requirements of the service application.

[0109] For example, when the security requirements of business applications are low, the maximum number of times the business applications can use the first key is set to 10,000; when the security requirements of business applications are general, the maximum number of times the business applications can use the first key is set to 1,000; when the security requirements of business applications are high, the maximum number of times the business applications can use the first key is set to 100.

[0110] Here, after determining the first usage count and the first maximum usage count of the first key, the first usage count, the first maximum usage count, the first key identifier and the service application identifier of the first key may be determined as security context information.

[0111] In an optional implementation, the above steps determine the first key to be used currently according to the acquisition result of the security context information and the number of times each key is used by the business application, including:

[0112] First, when the security context information is found, the third key used for the last communication with the service platform is determined based on the security context information;

[0113] Secondly, determining a second number of times the service application uses the third key, and determining a second maximum number of times the service application uses the third key;

[0114] Secondly, the second usage count is incremented to obtain a third usage count;

[0115] Finally, when the third number of times of use is less than the second maximum number of times of use, the third key is determined as the first key.

[0116] In an embodiment of the present disclosure, when the quantum key management application finds the security context information, that is, when the business application requests the quantum key management application to use the key, the second number of uses in the security context information can be processed.

[0117] Here, the second usage count may be incremented, for example, by 1, to obtain a third usage count of a third key (i.e., the quantum key used by the service application to communicate with the service platform last time). The third key is a quantum key.

[0118] When the third usage count is less than the second maximum usage count, it can be determined that the usage count corresponding to the completion of the current communication of the third key is less than or equal to the second maximum usage count. At this time, the third key can be used at the current moment to complete the communication between the service application and the service platform. Therefore, the third key can be determined as the first key used at the current moment.

[0119] The third key can be determined by the key identifier of the key in the key sub-resource pool corresponding to the business application. For example, the quantum keys in the key sub-resource pool are sorted, the quantum key identifier of the first key is QKID_1, the quantum key identifier of the second key is QKID_2, and the quantum key identifier of the i-th key is QKID_i. Afterwards, the first key in the key sub-resource pool can be used as the third key (i.e., the key with the quantum key identifier QKID_1).

[0120] In an optional implementation, based on the above embodiment, the method further includes the following steps:

[0121] When it is determined that the third usage count is greater than or equal to the second maximum usage count, a key that has not been used by the service application among the at least one key is determined as the first key.

[0122] In the embodiment of the present disclosure, when the third usage count is greater than or equal to the second maximum usage count, it can be determined that the usage count corresponding to the third key after the current communication is completed will exceed the second maximum usage count. Therefore, the service application can no longer use the third key to communicate with the service platform.

[0123] Here, a key next to the third key in the key sub-resource pool corresponding to the business application may be used as the first key.

[0124] For example, when the quantum key identifier of the third key is QKID_i, the key with the quantum key identifier QKID_(i+1) is used as the first key.

[0125] When the third key is the last key in the key sub-resource pool (that is, the real-time usage times of each key in the key sub-resource pool are greater than or equal to the maximum usage times), QKID_1 can be determined as the first key; and a key charging request can also be initiated to the business platform through the quantum key management application.

[0126] In an optional embodiment, in the above Figure 1 Based on the described embodiment, the method further comprises the following steps:

[0127] When the security terminal meets the key injection conditions, a key injection request is initiated to the business platform; wherein the key injection conditions include at least one of the following: the number of times all keys of at least one business application are used exceeds the corresponding maximum number of times, and the number of times all keys of each business application are used exceeds the corresponding maximum number of times.

[0128] In an embodiment of the present disclosure, the quantum key management application initiates a key injection request to the service platform when determining that the key sub-resource pool meets the key injection condition (that is, the security terminal meets the key injection condition).

[0129] Here, the usage times of all keys of at least one business application exceed the corresponding maximum usage times, that is, the usage times of keys in the key sub-resource pool corresponding to at least one business application exceed the corresponding maximum usage times.

[0130] Here, the usage times of all keys of each business application exceeds the corresponding maximum usage times, that is, the usage times of the keys in the key sub-resource pool corresponding to each business application exceeds the corresponding maximum usage times.

[0131] In an optional embodiment, in the above Figure 1 Based on the described embodiment, the method further comprises the following steps:

[0132] In the process of sending the encrypted business data to the business platform for processing, a business access request is sent; wherein the business access request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, a first identifier, the number of real-time uses of the first key, the maximum number of uses of the first key, and a preset generation algorithm for the second key; the target random number is a parameter for generating the second key.

[0133] In an embodiment of the present disclosure, after determining the encrypted service data, the security terminal may generate a service access request carrying the encrypted service data, and then send the service access request carrying the encrypted service data to the service platform.

[0134] Figure 2 As shown, it is a flow chart of another communication method based on quantum key provided by an embodiment of the present disclosure, the method includes steps S201 to S203, which is applied to a business platform, wherein:

[0135] S201. Obtain encrypted business data sent by a security terminal.

[0136] In the embodiment of the present disclosure, the encrypted business data is encrypted by the security terminal using the method described in S101 to S104 above.

[0137] Here, the service platform may obtain the service access request sent by the security terminal, and determine the encrypted service data carried in the service access request.

[0138] S202: Determine the decryption key for the encrypted business data.

[0139] In an embodiment of the present disclosure, the service platform may determine the identifier of the first key, the application identifier of the service application, the target random number, the first identifier, and the preset generation algorithm of the second key carried in the service access request.

[0140] Afterwards, the first key may be determined based on the identifier of the first key, and the application identifier of the business application, the target random number, the first identifier and the first key may be processed based on a preset generation algorithm to obtain a decryption key.

[0141] S203: Decrypt the encrypted business data using a decryption key to obtain the business data.

[0142] In the embodiments of the present disclosure, the service platform may process the encrypted service data using a decryption key to restore the service data sent by the security terminal.

[0143] Here, the business platform can respond to the business data and obtain business response information of the business data. Afterwards, the business response information can be protected (ie, encrypted) by a decryption key to obtain encrypted business response information.

[0144] After obtaining the encrypted service response information, the encrypted service response information may be sent to the security terminal.

[0145] After the security terminal receives the encrypted service response information sent by the service platform, it can decrypt the encrypted service response information using the second key to restore the service response information sent by the service platform.

[0146] In an optional implementation, the above steps of determining the decryption key of the encrypted business data specifically include the following steps:

[0147] First, a key acquisition request is sent to the target business platform; wherein the key acquisition request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, a first identifier, a real-time usage count of the first key, a maximum usage count of the first key, and a preset generation algorithm of the second key; the target random number is a parameter used to generate the second key;

[0148] Then, the decryption key fed back by the second key service platform based on the key acquisition request is obtained.

[0149] In an embodiment of the present disclosure, the service platform may include a secondary service platform and a target service platform (ie, a primary service platform).

[0150] Here, after the secondary service platform receives the service access request sent by the security terminal, it may send a key acquisition request to the target service platform (ie, the primary service platform).

[0151] Among them, the business platform can determine the key acquisition request based on the business access request.

[0152] Here, the target business platform may determine the decryption key based on the key acquisition request; thereafter, the decryption key may be fed back to the secondary business platform through the secure channel between the primary business platform and the target business platform.

[0153] In an optional implementation, the above steps of determining the decryption key of the encrypted business data specifically include the following steps:

[0154] When it is determined based on the key acquisition request that the first key meets the policy requirement, the first key is processed according to a preset generation algorithm to obtain a decryption key; wherein the policy requirement is associated with the number of real-time uses of the first key by the business application.

[0155] In an embodiment of the present disclosure, the policy requirement is that the real-time usage count of the first key (ie, the third usage count in the above description) is less than or equal to the maximum usage count of the first key (ie, the second maximum usage count in the above description).

[0156] Here, first, the real-time usage times and the maximum usage times of the first key in the key acquisition request may be determined. Then, based on the real-time usage times and the maximum usage times of the first key, it may be determined whether the first key meets the policy requirement.

[0157] When the real-time usage count of the first key is less than or equal to the maximum usage count, it is determined that the first key meets the policy requirement. Afterwards, the application identifier of the business application in the key acquisition request, the target random number, the first identifier and the first key can be processed based on a preset generation algorithm to obtain a decryption key.

[0158] In an optional implementation, the above steps of determining the decryption key of the encrypted business data specifically include the following steps:

[0159] When it is determined based on the key acquisition request that the first key does not meet the policy requirement, an error message is sent to the second key service platform; wherein the error message is used to indicate that the decryption key cannot be determined.

[0160] In an embodiment of the present disclosure, when the real-time usage count of the first key is greater than the maximum usage count, it is determined that the first key does not meet the policy requirement. Afterwards, an error message may be sent to the target service platform through the primary service platform.

[0161] After receiving the error information, the target service platform may send the error information to the security terminal. After receiving the error information, the security terminal may reselect a key from the key sub-resource pool corresponding to the service application to establish a communication connection with the service platform.

[0162] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0163] Based on the same inventive concept, a key-based communication system corresponding to the key-based communication method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the system in the embodiment of the present disclosure is similar to the above-mentioned key-based communication method in the embodiment of the present disclosure, the implementation of the system can refer to the implementation of the method, and the repeated parts will not be repeated.

[0164] In a specific embodiment provided in the present disclosure, see Figure 3As shown, it is an interactive flow chart of a key-based communication system provided by an embodiment of the present disclosure, wherein:

[0165] The key-based communication system includes: security terminal, primary business platform and secondary business platform.

[0166] S10. The security terminal determines at least one quantum key corresponding to the business application in response to a key acquisition request of the business application.

[0167] S20. The security terminal determines the first key to be used currently based on the number of times each quantum key is used by the business application and the maximum number of times each quantum key is used.

[0168] Here, based on the key acquisition request, the security context information of the business application is searched; wherein the security context information is used to indicate the number of times the business application requests the quantum key; and according to the search result of the security context information and the number of times the business application uses each of the quantum keys, the first key to be used is determined.

[0169] Here, if the security context information is not found, any quantum key is determined as the first key in the at least one quantum key corresponding to the business application, and a first usage count and a first maximum usage count of the first key are set to obtain the security context information.

[0170] Here, in the case where the security context information is found, a third key used for the last communication with the service platform is determined based on the security context information;

[0171] Determine a second number of times the service application uses the third key, and determine a second maximum number of times the service application uses the third key;

[0172] Incrementally process the second usage count to obtain a third usage count;

[0173] When the third usage count is less than the second maximum usage count, the third key is determined as the first key.

[0174] In which, when it is determined that the third number of times of use is greater than or equal to the second maximum number of times of use, a quantum key among the at least one quantum key that has not been used by the business application is determined as the first key.

[0175] S30. The security terminal generates a target random number, and processes the first key, the application identifier of the business application, the first identifier, and the target random number based on a preset generation algorithm to obtain a second key.

[0176] S40. The security terminal encrypts the business data of the business application using the second key to obtain encrypted business data (ie, business information ciphertext).

[0177] S50. The security terminal generates a service access request based on the service information ciphertext, and sends the service access request to the secondary service platform.

[0178] S60: The secondary service platform generates a key acquisition request based on the service access request, and sends the key acquisition request to the primary service platform.

[0179] S70. The primary service platform determines a first key based on the service access request, and generates a decryption key based on the first key and the service access request.

[0180] S80. The primary service platform sends the decryption key to the secondary service platform.

[0181] S90. The secondary business platform processes the decrypted business data using the decryption key and determines response information.

[0182] S100. The secondary business platform uses a decryption key to encrypt the response information to obtain encrypted response information.

[0183] S110. The secondary business platform sends the encrypted response information to the security terminal.

[0184] S120. The security terminal processes the encrypted response information using the second key to obtain response information.

[0185] Based on the same inventive concept, the embodiments of the present disclosure also provide a quantum key-based communication device corresponding to the quantum key-based communication method. Since the principle of the system solving the problem in the embodiments of the present disclosure is similar to the above-mentioned quantum key-based communication method in the embodiments of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0186] Reference Figure 4 As shown, it is a schematic diagram of a key-based communication device provided by an embodiment of the present disclosure, the device includes: a response module 11, a first determination module 12, a generation module 13, and an encryption module 14; wherein:

[0187] A response module, configured to determine at least one key corresponding to the business application in response to a key acquisition request of the business application;

[0188] A first determination module, configured to determine a first key to be used currently based on the number of times each key in the key resource pool is used by the business application;

[0189] A generating module, configured to generate a second key based on an application identifier of the business application and the first key;

[0190] An encryption module is used to encrypt and / or integrity protect the business data of the business application according to the second key, and send the encrypted and / or integrity protected business data to the business platform for processing.

[0191] Reference Figure 5 FIG. 1 is a schematic diagram of another key-based communication device provided in an embodiment of the present disclosure, wherein the device comprises: an acquisition module 21, a second determination module 22, and a decryption module 23; wherein:

[0192] An acquisition module, used to acquire encrypted business data sent by a security terminal;

[0193] A second determination module, used to determine a decryption key for the encrypted business data;

[0194] The decryption module is used to decrypt the encrypted business data using the decryption key to obtain the business data.

[0195] The disclosed embodiment can quickly screen out keys that meet the usage requirements for business applications by determining the first key according to the number of times the key is used by the business application. By generating the second key for encrypted communication through the first key and the application identifier, it is possible to achieve multiple uses of each key in the key resource pool, thereby increasing the number of times each key in the key resource pool is used and reducing the key filling frequency. In particular, in the communication process based on quantum keys, since the second key is generated differently, the security of business data can be further guaranteed.

[0196] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0197] Corresponds to Figure 1 The quantum key-based communication method in the present disclosure also provides an electronic device 600, such as Figure 6 FIG. 6 is a schematic diagram of the structure of an electronic device 600 provided in an embodiment of the present disclosure, including:

[0198] Processor 61, memory 62, and bus 63; memory 62 is used to store execution instructions, including internal memory 621 and external memory 622; the internal memory 621 is also called internal memory, which is used to temporarily store the operation data in the processor 61 and the data exchanged with the external memory 622 such as a hard disk. The processor 61 exchanges data with the external memory 622 through the internal memory 621. When the electronic device 600 is running, the processor 61 communicates with the memory 62 through the bus 63, so that the processor 61 executes the following instructions:

[0199] In response to a key acquisition request of a business application, determining at least one key corresponding to the business application;

[0200] Determining a first key to be used currently based on the number of times each of the quantum keys in the key resource pool is used by the business application;

[0201] Generate a second key based on the application identifier of the business application and the first key;

[0202] The service data of the service application is encrypted and / or integrity protected according to the second key, and the encrypted and / or integrity protected service data is sent to the service platform for processing.

[0203] The processor 61 may also execute the following instructions:

[0204] Obtaining encrypted business data sent by the security terminal;

[0205] Determining a decryption key for the encrypted business data;

[0206] The encrypted business data is decrypted using the decryption key to obtain the business data.

[0207] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0208] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0209] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0210] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0211] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0212] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0213] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A key-based communication method, characterized in that: Applied to security terminals, including: In response to a key acquisition request of a business application, determining at least one key corresponding to the business application; Determining a first key to be currently used based on the number of times each key in the key resource pool is used by the business application; Generate a second key based on the application identifier of the business application and the first key; The service data of the service application is encrypted and / or integrity protected according to the second key, and the encrypted and / or integrity protected service data is sent to the service platform for processing.

2. The method according to claim 1, characterized in that The generating the second key based on the application identifier of the business application and the first key includes: The first key and the key generation parameters are processed according to a preset generation algorithm to obtain the second key; wherein the key generation parameters include at least one of the following: a target random number, a first identifier, and the application identifier, wherein the first identifier is used to indicate a global user identity card identifier set in the security terminal.

3. The method according to claim 1, characterized in that The determining, based on the number of times each key in the key resource pool is used by the business application, the first key to be currently used includes: Based on the key acquisition request, obtain security context information of the business application; wherein the security context information is used to indicate the use of the key by the business application, and the use includes at least one of the following: the number of times the key is used; The first key to be currently used is determined according to the acquisition result of the security context information and the number of times each key is used by the business application.

4. The method according to claim 3, characterized in that The determining, according to the search result of the security context information and the number of times each of the keys is used by the business application, the first key to be currently used includes: In the case that the security context information is not found, any key among the at least one key corresponding to the business application is determined to be the first key, and a first usage count and a first maximum usage count of the first key are set to obtain the security context information.

5. The method according to claim 3, characterized in that The determining, according to the acquisition result of the security context information and the number of times each of the keys is used by the business application, the first key to be currently used includes: In the case where the security context information is found, determining, based on the security context information, a third key used for the last communication with the service platform; Determine a second number of times the service application uses the third key, and determine a second maximum number of times the service application uses the third key; Incrementally process the second usage count to obtain a third usage count; When the third usage count is less than the second maximum usage count, the third key is determined as the first key.

6. The method according to claim 5, characterized in that The method further comprises: When it is determined that the third usage count is greater than or equal to the second maximum usage count, a key among the at least one key that has not been used by the business application is determined to be the first key.

7. The method according to claim 1, characterized in that The method further comprises: When the security terminal meets the key injection conditions, a key injection request is initiated to the service platform; wherein the key injection conditions include at least one of the following: the number of times all keys of at least one service application are used exceeds the corresponding maximum number of times, and the number of times all keys of each service application are used exceeds the corresponding maximum number of times.

8. The method according to claim 1, characterized in that The method further comprises: In the process of sending the encrypted business data to the business platform for processing, a business access request is sent; wherein the business access request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, a first identifier, a real-time usage count of the first key, a maximum usage count of the first key, and a preset generation algorithm for the second key; the target random number is a parameter for generating the second key.

9. A communication method based on quantum key, characterized in that: Applied to business platforms, including: Acquire encrypted business data sent by the security terminal; wherein the encrypted business data is encrypted by the security terminal using the method described in any one of claims 1 to 8 above; Determining a decryption key for the encrypted business data; The encrypted business data is decrypted using the decryption key to obtain the business data.

10. The method according to claim 9, characterized in that The determining of the decryption key of the encrypted business data comprises: Sending a key acquisition request to a target business platform; wherein the key acquisition request includes at least one of the following: an identifier of the first key, an application identifier of the business application, a target random number, a first identifier, a real-time usage count of the first key, a maximum usage count of the first key, and a preset generation algorithm of a second key; the target random number is a parameter for generating the second key; Obtain the decryption key fed back by the target service platform based on the key acquisition request.

11. The method according to claim 9 or 10, characterized in that The determining of the decryption key of the encrypted business data comprises: When it is determined based on the key acquisition request that the first key meets the policy requirements, the first key is processed according to a preset generation algorithm to obtain the decryption key; wherein the policy requirements are associated with the number of real-time uses of the first key by the business application.

12. The method according to claim 11, characterized in that The determining of the decryption key of the encrypted business data comprises: When it is determined based on the key acquisition request that the first key does not meet the policy requirement, an error message is sent to the second key service platform; wherein the error message is used to indicate that the decryption key cannot be determined.

13. A key-based communication device, characterized in that: include: A response module, configured to determine at least one key corresponding to the business application in response to a key acquisition request of the business application; A first determination module, configured to determine a first key to be used currently based on the number of times each key in the key resource pool is used by the business application; A generating module, configured to generate a second key based on an application identifier of the business application and the first key; An encryption module is used to encrypt and / or integrity protect the business data of the business application according to the second key, and send the encrypted and / or integrity protected business data to the business platform for processing.

14. A communication device based on quantum key, characterized in that: include: An acquisition module, used to acquire encrypted business data sent by a security terminal; wherein the encrypted business data is obtained by the security terminal encrypting the data using the method described in any one of claims 1 to 8 above; A second determination module, used to determine a decryption key for the encrypted business data; The decryption module is used to decrypt the encrypted business data using the decryption key to obtain the business data.

15. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 12.

16. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

17. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images