Key charging method and device based on quantum key protection

Abstract

The invention provides a key charging method and device based on quantum key protection. The method comprises the following steps: a charging client sends a key negotiation request to a local key server; the local key server obtains a first quantum key through the quantum key distribution network as a shared key and sends the shared key to the charging client and the target key server; the charging client sends a charging key acquisition request to the target key server; the target key server obtains the charging key and encrypts the charging key by using the shared key to generate a charging key ciphertext; the target key server sends the charging key ciphertext to the charging client; and the charging client writes the charging key ciphertext and the shared key into the key charging security medium to complete key charging, so that secure transmission and storage of the key among different security environments are ensured through the quantum key distribution network, and the charging key is encrypted by using the quantum key in the transmission process, so that the security of the key is ensured. And the security and reliability of key management are improved.

Description

Technical Field

[0001] The present application relates to the field of network security communication technology, and in particular to a key injection method based on quantum key protection, a key injection device based on quantum key protection, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the development of information technology, people need to process and transmit a large amount of information data in their daily lives. These data are interacted and stored through computers and networks. Information assets have become one of the most valuable assets, so it has also attracted some people to use technical means to steal user information, causing losses to individuals and enterprises. Key injection is a key link in information security, which involves injecting encryption keys into systems or applications to ensure the confidentiality and integrity of data.

[0003] In existing key charging scenarios, the communication between the charging software and KMS (Key Management Service) is usually protected by public and private key encryption. In order to ensure the security of the key, the charging software and KMS are usually required to be deployed nearby in the same security environment to reduce the risk of the key being intercepted or stolen during transmission. However, due to reasons such as the limited computer room environment, there is a situation where the charging software and the target KMS are not in the same security environment, which will limit the acquisition of the charging key and increase the risk of leakage of the charging key. Summary of the invention

[0004] The embodiments of the present application provide a key injection method, apparatus, device and storage medium based on quantum key protection to overcome the above problems or at least partially solve the above problems.

[0005] The embodiment of the present application discloses a key injection method based on quantum key protection, involving an injection client, a target key server and a local key server, wherein the target key server and the local key server communicate based on a quantum key distribution network, and the method includes:

[0006] The charging client sends a key negotiation request to the local key server;

[0007] In response to receiving the key agreement request, the local key server obtains a first quantum key corresponding to the key agreement request through the quantum key distribution network, and sends the first quantum key as a shared key to the injection client and the target key server respectively;

[0008] The charging client sends a charging key acquisition request to the target key server;

[0009] In response to receiving the charging key acquisition request, the target key service end acquires the charging key corresponding to the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client;

[0010] The injection client writes the injection key ciphertext and the shared key into a key injection secure medium to complete key injection.

[0011] Optionally, the key agreement request includes an identifier of the target key server and a session identifier, and sending the quantum key as the shared key to the injection client and the target key server, respectively, includes:

[0012] The local key server sends the session identifier and the shared key to the target key server according to the identifier of the target key server;

[0013] The target key server associates and stores the session identifier and the shared key.

[0014] Optionally, the charging key acquisition request includes the session identifier, and before encrypting the charging key according to the shared key, the method further includes:

[0015] The target key client retrieves the shared key for the charging client according to the session identifier in the charging key acquisition request.

[0016] Optionally, the target key server obtains the charging key corresponding to the charging key acquisition request in response to receiving the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client, including:

[0017] In response to receiving the injection key acquisition request, the target key service end generates a key pair, and obtains a second quantum key and the injection key through the quantum key distribution network, wherein the key pair includes an encrypted public key and an encrypted private key;

[0018] The target key server encrypts the encrypted private key according to the shared key to obtain an encrypted private key ciphertext;

[0019] The target key service end encrypts the second quantum key according to the encryption public key to obtain a second quantum key ciphertext;

[0020] The target key service end encrypts the charging key according to the second quantum key to obtain a charging key ciphertext;

[0021] The target key service end sends the encrypted private key ciphertext, the second quantum key ciphertext and the injection key ciphertext to the injection client.

[0022] Optionally, the injection client writes the injection key ciphertext and the shared key into a key injection secure medium to complete the key injection, including:

[0023] The charging client decrypts the encrypted private key ciphertext according to the shared key to obtain the encrypted private key;

[0024] The charging client decrypts the second quantum key ciphertext according to the encrypted private key to obtain the second quantum key;

[0025] The charging client decrypts the charging key ciphertext according to the second quantum key to obtain the charging key, and performs hash verification on the charging key;

[0026] If the verification is successful, the key pair, the second quantum key ciphertext and the injection key ciphertext are written into the key injection secure medium.

[0027] Optionally, the key agreement request includes a signature public key of the key injection secure medium, and sending the first quantum key as a shared key to the injection client and the target key service end respectively includes:

[0028] The local key service end encrypts the shared key according to the signature public key, generates a shared key ciphertext, and sends the shared key ciphertext to the charging client.

[0029] Optionally, before the charging client sends the key negotiation request to the local key server, the method further includes:

[0030] The charging client sends an identity authentication request to the target key service end, wherein the identity authentication request includes identity information of the charging client;

[0031] In response to receiving the identity authentication request, the target key server verifies the identity information, generates credential information and sends the credential information to the charging client, and the credential information is used for communication verification between the charging client and the target key server.

[0032] The embodiment of the present application also provides a key injection device based on quantum key protection, involving an injection client, a target key server and a local key server, the target key server and the local key server communicate based on a quantum key distribution network, and the device includes:

[0033] A key negotiation request sending module, used for the charging client to send a key negotiation request to the local key server, wherein the key negotiation request is used to obtain a shared key between the charging client and the target key server;

[0034] A shared key acquisition module, configured to, in response to receiving the key negotiation request, obtain, by the local key service end, a first quantum key through the quantum key distribution network, and send the first quantum key as the shared key to the injection client end and the target key service end respectively;

[0035] A charging key request sending module, used for the charging client to send a charging key acquisition request to the target key service end;

[0036] A charging key acquisition module, configured for the target key server to obtain a charging key corresponding to the charging key acquisition request in response to receiving the charging key acquisition request, encrypt the charging key according to the shared key, obtain a charging key ciphertext and send it to the charging client;

[0037] The key injection module is used for the injection client to write the injection key ciphertext and the shared key into the key injection secure medium to complete the key injection.

[0038] Optionally, the key negotiation request includes an identifier of the target key server and a session identifier, and the shared key acquisition module includes:

[0039] The first shared key distribution submodule is used for the local key server to send the session identifier and the shared key to the target key server according to the identifier of the target key server; the target key server associates and stores the session identifier and the shared key.

[0040] Optionally, the charging key acquisition request includes the session identifier, the charging key acquisition request includes the session identifier, and the charging key acquisition module includes:

[0041] The shared key search submodule is used for the target key client to retrieve according to the session identifier in the charging key acquisition request to obtain the shared key for the charging client.

[0042] Optionally, the charging key acquisition module includes:

[0043] A key pair and quantum key acquisition submodule, configured for the target key server to generate a key pair in response to receiving the injection key acquisition request, and to obtain a second quantum key and the injection key through the quantum key distribution network, wherein the key pair includes an encrypted public key and an encrypted private key;

[0044] A first encryption submodule, configured for the target key server to encrypt the encrypted private key according to the shared key to obtain an encrypted private key ciphertext;

[0045] A second encryption submodule, configured for the target key service end to encrypt the second quantum key according to the encryption public key to obtain a second quantum key ciphertext;

[0046] A third encryption submodule, configured for the target key service end to encrypt the charging key according to the second quantum key to obtain a charging key ciphertext;

[0047] The ciphertext sending submodule is used for the target key service end to send the encrypted private key ciphertext, the second quantum key ciphertext and the injection key ciphertext to the injection client.

[0048] Optionally, the key injection module includes:

[0049] A first decryption submodule, configured for the charging client to decrypt the encrypted private key ciphertext according to the shared key to obtain the encrypted private key;

[0050] A second decryption submodule, configured for the charging client to decrypt the second quantum key ciphertext according to the encryption private key to obtain the second quantum key;

[0051] A third decryption submodule, configured for the charging client to decrypt the charging key ciphertext according to the second quantum key, obtain the charging key, and perform hash verification on the charging key;

[0052] The injection key writing submodule is used to write the key pair, the second quantum key ciphertext and the injection key ciphertext into the key injection secure medium if the verification is passed.

[0053] Optionally, the key negotiation request includes a signature public key of the key injection secure medium, and the shared key acquisition module includes:

[0054] The second shared key distribution submodule is used for the local key service end to encrypt the shared key according to the signature public key, generate a shared key ciphertext, and send the shared key ciphertext to the charging client.

[0055] Optionally, the device further comprises:

[0056] An identity authentication request sending submodule, used for the charging client to send an identity authentication request to the target key service end, wherein the identity authentication request includes the identity information of the charging client;

[0057] The credential information generation submodule is used for the target key server to verify the identity information in response to receiving the identity authentication request, generate credential information and send the credential information to the charging client, and the credential information is used for communication verification between the charging client and the target key server.

[0058] The embodiment of the present application also discloses an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus;

[0059] The memory is used to store computer programs;

[0060] The processor is used to implement the method described in the embodiment of the present application when executing the program stored in the memory.

[0061] The embodiment of the present application also discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present application.

[0062] Compared with the prior art, the embodiments of the present application have the following advantages:

[0063] In an embodiment of the present application, the charging client sends a key negotiation request to the local key server; the local key server obtains the first quantum key through the quantum key distribution network, and sends it as a shared key to the charging client and the target key server respectively; the charging client sends a charging key acquisition request to the target key server; the target key server obtains the charging key, and encrypts it with the shared key to generate a charging key ciphertext; the target key server sends the charging key ciphertext to the charging client; the charging client writes the charging key ciphertext and the shared key into the key charging secure medium to complete the key charging. The present application implements the use of a quantum key distribution network to ensure the security of the shared key during transmission, and the charging key is encrypted using a quantum key during transmission, which further enhances the security of the charging key and solves the problems of limited charging key acquisition and increased key leakage risks faced when the charging software and the key management server are not in the same security environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0065] Figure 1 It is a flowchart of a key injection method based on quantum key protection provided in an embodiment of the present application;

[0066] Figure 2 It is a schematic diagram of a deployment scenario of a charging client and a key server provided in an embodiment of the present application;

[0067] Figure 3 This is a schematic diagram of the overall process of a key injection method based on quantum key protection provided in an embodiment of the present application;

[0068] Figure 4 It is a schematic diagram of another deployment scenario of a charging client and a key server provided in an embodiment of the present application;

[0069] Figure 5 It is a schematic diagram of the overall process of another key injection method based on quantum key protection provided in an embodiment of the present application;

[0070] Figure 6 It is a structural block diagram of a key injection device based on quantum key protection provided in an embodiment of the present application;

[0071] Figure 7 is a block diagram of an electronic device provided in an embodiment of the present application;

[0072] Figure 8 It is a schematic diagram of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0074] As an example, the existing key charging method is to deploy the charging software and the corresponding key management service in the same security environment, and then encrypt and protect the charging key through the public and private keys generated by the key management server. However, this method is limited to deploying the charging software and the corresponding key management service in the same security environment. If the charging software and the corresponding key management server are not in the same security environment due to reasons such as the limited computer room environment, the acquisition of the charging key will be restricted, increasing the risk of leakage of the charging key.

[0075] In this regard, the advantages of the present application over the prior art are that the security of keys during transmission is ensured through a quantum key distribution network, and the injection key is encrypted using a quantum key to achieve secure transmission and storage of keys between different security environments, thereby ensuring high security and reliability of key management, thereby solving the problem of limited key access and increased risk of key leakage when the injection software and the key management server are not in the same security environment.

[0076] Reference Figure 1 , shows a flowchart of a key injection method based on quantum key protection provided in an embodiment of the present application, involving an injection client, a target key server and a local key server, wherein the target key server and the local key server communicate based on a quantum key distribution network, and specifically may include the following steps:

[0077] Step 101: the charging client sends a key negotiation request to the local key server;

[0078] In the embodiment of the present application, the key charging process mainly involves the charging client, the target key server and the local key server, and the target key server and the local key server communicate through the quantum key distribution network. Specifically, the charging client can be the terminal device where the software that needs to be key charged is located, which is responsible for obtaining the charging key for key charging; the local key server is a KMS node located in the same network as the charging client, which is responsible for key generation, distribution and management; the target key server is a KMS node located in the target network, which provides the charging key required by the charging client; the charging client sends a key negotiation request to the local key server, and the key negotiation request is used to obtain the shared key between the charging client and the target key server, and the charging key transmitted between the charging client and the target key server is encrypted by the shared key, thereby improving the security of the charging key transmitted between the charging client and the corresponding target key server.

[0079] In a preferred embodiment of the present application, before step 101, the charging client sends a key negotiation request to the local key server, the method further includes:

[0080] The charging client sends an identity authentication request to the target key service end, wherein the identity authentication request includes identity information of the charging client;

[0081] In response to receiving the identity authentication request, the target key server verifies the identity information, generates credential information and sends the credential information to the charging client, and the credential information is used for communication verification between the charging client and the target key server.

[0082] In an embodiment of the present application, before obtaining the shared key between the charging client and the target key server, a process of identity authentication between the charging client and the target key server is also involved. The charging client sends an identity authentication request containing identity information to the target key server. The target key server verifies the identity information of the charging client. If the identity authentication is successful, the target key server generates credential information and sends it to the charging client. The credential information is used for identity authentication in subsequent communication processes to ensure the legitimacy of the identities of the communicating parties. A trust relationship is established between the charging client and the target key server through the identity authentication process, which provides a security foundation for subsequent key negotiation operations.

[0083] Optionally, the identity information may include the dongle information of the charging client, and the credential information is the TOKEN token credential. Specifically, the charging client sends an authentication request containing the dongle information to the target client. After receiving the authentication request, the target key server verifies the dongle information. If the verification is successful, the target key server generates the TOKEN credential information and sends it to the charging client. By setting the identity information as the dongle information, the hardware-level security features and uniqueness of the dongle can be utilized to enhance the security and reliability of identity authentication. The TOKEN credential information can be set with a valid time. During the valid time, the charging client and the target key server can communicate securely based on the TOKEN token.

[0084] Step 102: In response to receiving the key agreement request, the local key server obtains a first quantum key corresponding to the key agreement request through the quantum key distribution network, and sends the first quantum key as a shared key to the injection client and the target key server respectively;

[0085] In an embodiment of the present application, the charging client sends a key negotiation request to the local key server to obtain a shared key between the charging client and the target key server. The local key server obtains the quantum key as a shared key through the quantum key distribution network and sends it to the target key server and the charging client respectively. The quantum key is obtained through the quantum key distribution network to ensure the security of the key during transmission, and the quantum key will be used for subsequent charging key protection, thereby improving the security of charging key transmission. The local key server is responsible for the distribution and management of the shared key, thereby enhancing the security, flexibility and reliability of the key management system.

[0086] In a preferred embodiment of the present application, the key agreement request includes an identifier of the target key server and a session identifier, and step 102, sending the first quantum key as a shared key to the charging client and the target key server respectively, includes:

[0087] The local key server sends the session identifier and the shared key to the target key server according to the identifier of the target key server;

[0088] The target key server associates and stores the session identifier and the shared key.

[0089] In an embodiment of the present application, the key negotiation request sent by the charging client to the local key server includes the identifier of the target key server and the session identifier. After receiving the key negotiation request, the local key server can determine the target key server corresponding to the charging client through the identifier of the target key server, and then send the shared key and the session identifier to the target key server. The target key server associates and saves the session identifier and the shared key, and the session identifier is used to identify a specific key negotiation session to ensure the uniqueness and association of the key. By associating and saving the session identifier and the shared key, the target key server can track and manage different key negotiation sessions to ensure that the shared key of each session is used correctly.

[0090] Step 103: the charging client sends a charging key acquisition request to the target key server;

[0091] In an embodiment of the present application, the charging client obtains the required charging key from the target key server by sending a charging key acquisition request. The target key server is responsible for distributing the charging key to the charging client to ensure that the charging client can obtain the key securely.

[0092] Step 104: In response to receiving the charging key acquisition request, the target key server acquires the charging key corresponding to the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client;

[0093] In an embodiment of the present application, after the target key server receives the charging key acquisition request sent by the charging client, the target key server obtains the charging key corresponding to the charging key acquisition request according to the content of the charging key acquisition request, and then encrypts the charging key according to the shared key, generates a ciphertext of the charging key and sends it to the charging client, thereby realizing the encryption protection of the charging key using a quantum key, utilizing the high security of the quantum key distribution network, ensuring that the key cannot be eavesdropped on and cannot be tampered with during transmission, preventing man-in-the-middle attacks and key leakage, and ensuring the security and stability of key charging.

[0094] Optionally, the target key server can obtain a quantum key from a quantum key distribution network as a charging key, or the target key server can generate a key based on traditional cryptography as a charging key, which is not limited in this application.

[0095] In a preferred embodiment of the present application, the charging key acquisition request includes the session identifier. Before step 104, obtaining the charging key corresponding to the charging key acquisition request, the method further includes:

[0096] The target key client retrieves the shared key for the charging client according to the session identifier in the charging key acquisition request.

[0097] In the embodiment of the present application, the charging key acquisition request includes a session identifier. After receiving the charging key acquisition request, the target key server retrieves the shared key through the session identifier. The target key server ensures that the correct shared key is used for encryption to prevent key confusion and replay attacks. Optionally, the charging key acquisition request may also include the identity information of the charging client, the identifier of the key charging secure medium, and the requested charging key type, etc. The charging key server may associate the identifier of the key charging secure medium with the corresponding charging key, and record the usage of the charging key of each secure medium to facilitate subsequent auditing and tracking.

[0098] In a preferred embodiment of the present application, step 104, in response to receiving the charging key acquisition request, the target key server obtains the charging key corresponding to the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client, including:

[0099] In response to receiving the injection key acquisition request, the target key service end generates a key pair, and obtains a second quantum key and the injection key through the quantum key distribution network, wherein the key pair includes an encrypted public key and an encrypted private key;

[0100] The target key server encrypts the encrypted private key according to the shared key to obtain an encrypted private key ciphertext;

[0101] The target key service end encrypts the second quantum key according to the encryption public key to obtain a second quantum key ciphertext;

[0102] The target key service end encrypts the charging key according to the second quantum key to obtain a charging key ciphertext;

[0103] The target key service end sends the encrypted private key ciphertext, the second quantum key ciphertext and the injection key ciphertext to the injection client.

[0104] In the embodiment of the present application, after receiving the charging key acquisition request sent by the charging client, the target key service end will generate a key pair including an encrypted private key and an encrypted public key, and obtain the second quantum key and the charging key from the quantum key distribution network, and then use the shared key to encrypt the private key to obtain the encrypted private key ciphertext; use the encrypted public key to encrypt the second quantum key to obtain the second quantum key ciphertext; use the second quantum key to encrypt the charging key to obtain the charging key ciphertext, and finally send the encrypted private key ciphertext, the second quantum key ciphertext and the charging key ciphertext to the charging client. In the embodiment of the present application, multiple encryption is implemented to ensure the high security of the charging key during transmission, prevent eavesdropping and man-in-the-middle attacks, and the target key service end dynamically generates a key pair and obtains the second quantum key, supports frequent key changes, prevents replay attacks, and ensures the confidentiality and integrity of communications.

[0105] Step 105: The injection client writes the injection key ciphertext and the shared key into a key injection secure medium to complete key injection.

[0106] In the embodiment of the present application, the key injection secure medium refers to a hardware or software device used to store the injection key ciphertext and the shared key. By writing the injection key ciphertext and the shared key into the key injection secure medium, the high security of the injection key during the storage process is ensured, and the injection key is prevented from being leaked or tampered with.

[0107] In a preferred embodiment of the present application, step 105, the charging client writes the charging key ciphertext and the shared key into a key charging secure medium to complete the key charging, including:

[0108] The charging client decrypts the encrypted private key ciphertext according to the shared key to obtain the encrypted private key;

[0109] The charging client decrypts the second quantum key ciphertext according to the encrypted private key to obtain the second quantum key;

[0110] The charging client decrypts the charging key ciphertext according to the second quantum key to obtain the charging key, and performs hash verification on the charging key;

[0111] If the verification is successful, the key pair, the second quantum key ciphertext and the injection key ciphertext are written into the key injection secure medium.

[0112] In the embodiment of the present application, after the charging client receives the encrypted private key ciphertext, the second quantum key ciphertext and the charging key ciphertext sent by the target key server, it first decrypts the encrypted private key ciphertext according to the shared key to obtain the encrypted private key; then decrypts the second quantum key ciphertext according to the encrypted private key to obtain the second quantum key; further decrypts the charging key ciphertext according to the second quantum key to obtain the charging key. After obtaining the charging key, the charging client will also perform hash verification on the charging key. If the verification passes, the key pair, the second quantum key ciphertext and the charging key ciphertext are written into the key charging secure medium to complete the remote key charging process. The embodiment of the present application obtains the charging key through multiple decryptions, and performs hash verification on the decrypted charging key to ensure the integrity and correctness of the key, prevent the key from being tampered with during transmission and decryption, and realize the security and stability of remote key charging through the quantum key distribution network and quantum key protection.

[0113] As an example, see Figure 2 , shows a schematic diagram of a deployment scenario of a filling client and a key server provided in an embodiment of the present application. Specifically, the filling client FillClient, the local key server KMS2 and the secure medium to be filled are all located in the secure environment 2, and the target key server KMS1 corresponding to the filling client to obtain the filling key is located in the secure environment 1, and the local key management server KMS and the target key server perform key negotiation through the QKD (Quantum Key Distribution) network.

[0114] Combination Figure 3 , Figure 3 The overall process diagram of a key injection based on quantum key protection provided by an embodiment of the present application is shown, which specifically includes:

[0115] Step 301, FillClient sends an identity authentication request including dongle information to KMS1;

[0116] Step 302: KMS1 verifies the dongle information, generates a Token certificate and returns it to FillClient;

[0117] Step 303, FillClient sends a key negotiation request including the ID of the target KMS, i.e., the ID of KMS1, a session identifier (SessionID), and a signature public key (Sign-pub) of the security medium to be filled to KMS2;

[0118] Step 304: After receiving the key negotiation request, KMS2 applies to the quantum key distribution network for the quantum key Ka, pushes the quantum key Ka and the session identifier to KMS1 through the quantum key distribution network, and encrypts the quantum key Ka with the signature public key of the secure medium to be filled to generate a Ka ciphertext and sends it to FillClient;

[0119] Step 305: KMS1 cyclically queries whether there is a key push to obtain the key result, and associates and saves the quantum key Ka and the session identifier;

[0120] Step 306: FillClient decrypts the Ka ciphertext to obtain the quantum key Ka plaintext, and sends a filling key acquisition request including a session identifier and an ID (identifier) ​​of the secure medium to be filled to KMS1;

[0121] Step 307: After receiving the filling key acquisition request, KMS1 retrieves the corresponding quantum key Ka according to the session identifier, generates an encrypted public-private key pair, and applies to the quantum key distribution network to obtain the quantum key Kb and the filling key FillKey;

[0122] Step 308: KMS1 uses the quantum key Ka to encrypt the encryption private key to obtain the encryption private key ciphertext E(Ka EN_pri), uses the encryption public key to encrypt the quantum key Kb to obtain the quantum key Kb ciphertext E(EN_pub, Kb), uses the quantum key Kb to encrypt the filling key to obtain the filling key ciphertext E(Kb, FillKey), and sends E(Ka EN_pri), E(EN_pub, Kb) and E(Kb, FillKey) to FillClient;

[0123] Step 309: FillClient decrypts E(Ka EN_pri), E(EN_pub, Kb) and E(Kb, FillKey) in sequence using the quantum key Ka to obtain the filling key;

[0124] Step 310: FillClient generates a filling structure using the ciphertext E(Kb, FillKey) of the filling key and the ciphertext E(EN_pub, Kb) of the quantum key Kb in the agreed format and writes it into the secure medium to be filled, thus completing the remote filling of the key.

[0125] As an example, see Figure 4 , showing another deployment scenario diagram of a charging client and a key server provided in an embodiment of the present application. The embodiment of the present application is provided with a KM (Knowledge Management) node, which is responsible for managing and recording information such as key usage. The KM node corresponds to multiple KMS nodes. Different KM nodes communicate with each other through a quantum key distribution network, and then the KMS node can apply for and obtain the quantum key from the corresponding KM node.

[0126] Combination Figure 5 , Figure 5 The overall process diagram of another key injection based on quantum key protection provided by an embodiment of the present application is shown, which specifically includes:

[0127] Step 501, FillClient sends an identity authentication request including dongle information to KMS1;

[0128] Step 502: KMS1 verifies the dongle information, generates a Token certificate and returns it to FillClient;

[0129] Step 503, FillClient sends a key negotiation request including the ID of the target KMS, i.e., the ID of KMS1, a session identifier (SessionID), and a signature public key (Sign-pub) of the security medium to be filled to KMS2;

[0130] Step 504: After receiving the key negotiation request, KMS2 applies to the KM2 node for the quantum key Ka;

[0131] Step 505, the KM2 node and the KM1 node perform key negotiation through the quantum key distribution network to obtain the quantum key Ka, and return the quantum key Ka to KMS2;

[0132] Step 505: KMS2 encrypts the quantum key Ka using the signature public key of the secure medium to be filled to generate a Ka ciphertext and sends it to FillClient;

[0133] Step 506, KMS1 cyclically queries KM1 node whether there is a key push;

[0134] Step 507: The KM1 node returns the key result including the quantum key Ka and the session identifier to the KMS1 node;

[0135] Step 508: FillClient decrypts the Ka ciphertext to obtain the quantum key Ka plaintext, and sends a filling key acquisition request including a session identifier and an ID (identifier) ​​of the secure medium to be filled to KMS1;

[0136] Step 509: After receiving the filling key acquisition request, KMS1 retrieves the corresponding quantum key Ka according to the session identifier, generates an encrypted public-private key pair, and the KM1 node applies to obtain the quantum key Kb and the filling key FillKey;

[0137] Step 510: KMS1 uses the quantum key Ka to encrypt the encryption private key to obtain the encryption private key ciphertext E(Ka EN_pri), uses the encryption public key to encrypt the quantum key Kb to obtain the quantum key Kb ciphertext E(EN_pub, Kb), uses the quantum key Kb to encrypt the filling key to obtain the filling key ciphertext E(Kb, FillKey), and sends E(Ka EN_pri), E(EN_pub, Kb) and E(Kb, FillKey) to FillClient;

[0138] Step 511, FillClient decrypts E(Ka EN_pri), E(EN_pub, Kb) and E(Kb, FillKey) in sequence using the quantum key Ka to obtain the filling key;

[0139] Step 512: FillClient generates a filling structure using the ciphertext E(Kb, FillKey) of the filling key and the ciphertext E(EN_pub, Kb) of the quantum key Kb in the agreed format and writes it into the secure medium to be filled, thus completing the remote filling of the key.

[0140] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0141] Reference Figure 6, shows a structural block diagram of a key charging device based on quantum key protection provided in an embodiment of the present application, involving a charging client, a target key server and a local key server. The target key server and the local key server communicate based on a quantum key distribution network, and may specifically include the following modules:

[0142] A key negotiation request sending module 601 is used for the charging client to send a key negotiation request to the local key server, wherein the key negotiation request is used to obtain a shared key between the charging client and the target key server;

[0143] A shared key acquisition module 602, configured to, in response to receiving the key negotiation request, obtain, by the local key server, a first quantum key through the quantum key distribution network, and send the first quantum key as the shared key to the injection client and the target key server respectively;

[0144] A key charging request sending module 603 is used for the charging client to send a key charging acquisition request to the target key server;

[0145] The charging key acquisition module 604 is used for the target key server to obtain the charging key corresponding to the charging key acquisition request in response to receiving the charging key acquisition request, encrypt the charging key according to the shared key, obtain the charging key ciphertext and send it to the charging client;

[0146] The key injection module 605 is used for the injection client to write the injection key ciphertext and the shared key into the key injection secure medium to complete the key injection.

[0147] In an embodiment of the present application, the key negotiation request includes an identifier of the target key server and a session identifier, and the shared key acquisition module 602 includes:

[0148] The first shared key distribution submodule is used for the local key server to send the session identifier and the shared key to the target key server according to the identifier of the target key server; the target key server associates and stores the session identifier and the shared key.

[0149] In an embodiment of the present application, the charging key acquisition request includes the session identifier, the charging key acquisition request includes the session identifier, and the charging key acquisition module 604 includes:

[0150] The shared key search submodule is used for the target key client to retrieve according to the session identifier in the charging key acquisition request to obtain the shared key for the charging client.

[0151] In one embodiment of the present application, the charging key acquisition module 604 includes:

[0152] A key pair and quantum key acquisition submodule, configured for the target key server to generate a key pair in response to receiving the injection key acquisition request, and to obtain a second quantum key and the injection key through the quantum key distribution network, wherein the key pair includes an encrypted public key and an encrypted private key;

[0153] A first encryption submodule, configured for the target key server to encrypt the encrypted private key according to the shared key to obtain an encrypted private key ciphertext;

[0154] A second encryption submodule, configured for the target key server to encrypt the second quantum key according to the encryption public key to obtain a second quantum key ciphertext;

[0155] A third encryption submodule, configured for the target key service end to encrypt the charging key according to the second quantum key to obtain a charging key ciphertext;

[0156] The ciphertext sending submodule is used for the target key service end to send the encrypted private key ciphertext, the second quantum key ciphertext and the injection key ciphertext to the injection client.

[0157] In one embodiment of the present application, the key injection module 605 includes:

[0158] A first decryption submodule, configured for the charging client to decrypt the encrypted private key ciphertext according to the shared key to obtain the encrypted private key;

[0159] A second decryption submodule, configured for the charging client to decrypt the second quantum key ciphertext according to the encryption private key to obtain the second quantum key;

[0160] A third decryption submodule, configured for the charging client to decrypt the charging key ciphertext according to the second quantum key, obtain the charging key, and perform hash verification on the charging key;

[0161] The injection key writing submodule is used to write the key pair, the second quantum key ciphertext and the injection key ciphertext into the key injection secure medium if the verification is passed.

[0162] In an embodiment of the present application, the key negotiation request includes the signature public key of the key injection secure medium, and the shared key acquisition module 602 includes:

[0163] The second shared key distribution submodule is used for the local key service end to encrypt the shared key according to the signature public key, generate a shared key ciphertext, and send the shared key ciphertext to the charging client.

[0164] In one embodiment of the present application, the device further includes:

[0165] An identity authentication request sending submodule, used for the charging client to send an identity authentication request to the target key service end, wherein the identity authentication request includes the identity information of the charging client;

[0166] The credential information generation submodule is used for the target key server to verify the identity information in response to receiving the identity authentication request, generate credential information and send the credential information to the charging client, and the credential information is used for communication verification between the charging client and the target key server.

[0167] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0168] In addition, the present application also provides an electronic device, such as Figure 7 As shown, it includes a processor 701, a communication interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.

[0169] Memory 703, used for storing computer programs;

[0170] The processor 701 is used to implement the method described in the above embodiment when executing the program stored in the memory 703.

[0171] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0172] The communication interface is used for communication between the above terminal and other devices.

[0173] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0174] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0175] like Figure 8 As shown, in another embodiment provided in the present application, a computer-readable storage medium 801 is further provided, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the method described in the above embodiment.

[0176] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0177] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0178] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0179] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A key injection method based on quantum key protection, characterized in that: The method involves a charging client, a target key server and a local key server, wherein the target key server and the local key server communicate based on a quantum key distribution network, and the method comprises: The charging client sends a key negotiation request to the local key server; In response to receiving the key agreement request, the local key server obtains a first quantum key corresponding to the key agreement request through the quantum key distribution network, and sends the first quantum key as a shared key to the injection client and the target key server respectively; The charging client sends a charging key acquisition request to the target key server; In response to receiving the charging key acquisition request, the target key service end acquires the charging key corresponding to the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client; The injection client writes the injection key ciphertext and the shared key into a key injection secure medium to complete key injection.

2. The method according to claim 1, characterized in that: The key agreement request includes an identifier of the target key server and a session identifier, and sending the quantum key as the shared key to the injection client and the target key server, respectively, includes: The local key server sends the session identifier and the shared key to the target key server according to the identifier of the target key server; The target key server associates and stores the session identifier and the shared key.

3. The method according to claim 2, characterized in that: The charging key acquisition request includes the session identifier, and before encrypting the charging key according to the shared key, the method further includes: The target key client retrieves the shared key for the charging client according to the session identifier in the charging key acquisition request.

4. The method according to claim 1, characterized in that: The target key server obtains the charging key corresponding to the charging key acquisition request in response to receiving the charging key acquisition request, encrypts the charging key according to the shared key, obtains the charging key ciphertext and sends it to the charging client, including: In response to receiving the injection key acquisition request, the target key service end generates a key pair, and obtains a second quantum key and the injection key through the quantum key distribution network, wherein the key pair includes an encrypted public key and an encrypted private key; The target key server encrypts the encrypted private key according to the shared key to obtain an encrypted private key ciphertext; The target key service end encrypts the second quantum key according to the encryption public key to obtain a second quantum key ciphertext; The target key service end encrypts the charging key according to the second quantum key to obtain a charging key ciphertext; The target key service end sends the encrypted private key ciphertext, the second quantum key ciphertext and the injection key ciphertext to the injection client.

5. The method according to claim 4, characterized in that: The injection client writes the injection key ciphertext and the shared key into a key injection secure medium to complete the key injection, including: The charging client decrypts the encrypted private key ciphertext according to the shared key to obtain the encrypted private key; The charging client decrypts the second quantum key ciphertext according to the encrypted private key to obtain the second quantum key; The charging client decrypts the charging key ciphertext according to the second quantum key to obtain the charging key, and performs hash verification on the charging key; If the verification is successful, the key pair, the second quantum key ciphertext and the injection key ciphertext are written into the key injection secure medium.

6. The method according to claim 1, characterized in that: The key agreement request includes the signature public key of the key injection secure medium, and sending the first quantum key as a shared key to the injection client and the target key service end respectively includes: The local key service end encrypts the shared key according to the signature public key, generates a shared key ciphertext, and sends the shared key ciphertext to the charging client.

7. The method according to claim 1, characterized in that: Before the charging client sends the key negotiation request to the local key server, the method further includes: The charging client sends an identity authentication request to the target key service end, wherein the identity authentication request includes identity information of the charging client; In response to receiving the identity authentication request, the target key server verifies the identity information, generates credential information and sends the credential information to the charging client, and the credential information is used for communication verification between the charging client and the target key server.

8. A key filling device based on quantum key protection, characterized in that: The invention relates to a charging client, a target key server and a local key server, wherein the target key server and the local key server communicate based on a quantum key distribution network, and the device comprises: A key negotiation request sending module, used for the charging client to send a key negotiation request to the local key server, wherein the key negotiation request is used to obtain a shared key between the charging client and the target key server; A shared key acquisition module, configured to, in response to receiving the key negotiation request, obtain, by the local key service end, a first quantum key through the quantum key distribution network, and send the first quantum key as the shared key to the injection client end and the target key service end respectively; A charging key request sending module, used for the charging client to send a charging key acquisition request to the target key service end; A charging key acquisition module, configured for the target key server to obtain a charging key corresponding to the charging key acquisition request in response to receiving the charging key acquisition request, encrypt the charging key according to the shared key, obtain a charging key ciphertext and send it to the charging client; The key injection module is used for the injection client to write the injection key ciphertext and the shared key into the key injection secure medium to complete the key injection.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 7.

Images