Quantum-fused protocol communication method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a quantum-fused protocol communication method and device, equipment and a storage medium, and the method comprises the steps: calling a communication interface, and transmitting a verification message to a quantum key service platform, so as to carry out the identity safety verification and apply for a session key; receiving and decrypting a first encrypted session key sent by the quantum key service platform to obtain a session key; sending the encrypted session identifier to a server, so that the server applies for a session key from a quantum key service platform; and performing encrypted communication with the server according to the session key. According to the embodiment of the invention, the whole quantum key communication process is packaged in the communication interface, so that software developed based on a traditional network interface can be simply and safely migrated to quantum. Moreover, identity security verification is carried out through the verification message, man-in-the-middle attack is prevented, and the communication security is enhanced. In addition, the client and the server encrypt and decrypt the communication data by using the same session key, thereby realizing secure encrypted communication.

Description

Technical Field

[0001] The present application relates to the field of network security communication technology, and in particular to a quantum-integrated protocol communication method and device, an electronic device, and a storage medium. Background Art

[0002] With the development of information technology, people need to use a lot of information data in their daily lives, transmit, interact and store through computers and networks. Information assets have become one of the most valuable assets, so it has also attracted some people to use technical means to steal user information, causing losses to individuals and enterprises.

[0003] The classic HTTPS (Hypertext Transfer Protocol Secure) communication uses public and private keys to negotiate symmetric keys for encrypted communication. When the era of quantum computing arrives, the symmetric keys negotiated in this way may be cracked, resulting in insufficient security.

[0004] In existing quantum communications, the platform side only provides the function of negotiating keys. Through the QKD (Quantum Key Distribution) network, both communicating parties can obtain the same symmetric key. In actual use, the ciphertext encrypted by the user using the shared key is still transmitted using the communication protocol in the classical network. For example, at the application layer, the HTTPS protocol is still used to transmit the message encrypted by the quantum key, which involves two encryption processes. The first encrypted ciphertext is unconditionally secure. However, the second encrypted ciphertext may be unsafe, and the second encryption consumes about the same time as the first encryption. The time consumed by the second encryption is unnecessary and avoidable. Therefore, in order to further improve the security of communication and reduce the number of data encryption times, how to integrate quantum keys and the classical HTTPS communication process has become an urgent problem to be solved in this field. Summary of the invention

[0005] The embodiment of the present application provides a quantum-integrated protocol communication method to solve the problem of how to integrate quantum keys and the classical HTTPS communication process.

[0006] Correspondingly, an embodiment of the present application also provides a quantum-integrated protocol communication device, an electronic device, and a storage medium to ensure the implementation and application of the above method.

[0007] In order to solve the above problems, the embodiment of the present application discloses a quantum-integrated protocol communication method, which is applied to a client, the client communicates with a server, and the client and the server are respectively connected to a quantum key service platform. The method includes:

[0008] Calling the communication interface and sending a verification message to the quantum key service platform to perform identity security verification and apply for a session key;

[0009] Receiving and decrypting a first encrypted session key sent by the quantum key service platform to obtain the session key;

[0010] Sending an encrypted session identifier to the server, so that the server applies for the session key from the quantum key service platform;

[0011] Perform encrypted communication with the server according to the session key.

[0012] Optionally, calling the communication interface and sending a verification message to the quantum key service platform to perform identity security verification and apply for a session key includes:

[0013] Calling the communication interface;

[0014] Sending a connection request to a server to establish a communication connection with the server;

[0015] Receive a server security medium identifier and a server domain name sent by the server;

[0016] Generate a first random number and a session identifier;

[0017] Sending the server secure medium identifier, the first random number, the session identifier, and the server domain name as the verification message to the quantum key service platform;

[0018] After the quantum key service platform receives the verification message, the quantum key service platform is called to perform identity security verification according to the server security medium identifier and the server domain name;

[0019] According to the first random number and the session identifier, the quantum key service platform is called to generate the first encrypted session key and the encrypted session identifier.

[0020] Optionally, a target binding relationship is pre-stored in the quantum key service platform, and the target binding relationship is used to indicate that the server-side secure medium identifier and the server-side domain name have been bound. After the quantum key service platform receives the verification message, calling the quantum key service platform to perform identity security verification according to the server-side secure medium identifier and the server-side domain name includes:

[0021] After the quantum key service platform receives the verification message, the quantum key service platform is called to determine the binding relationship between the server-side secure medium identifier and the server-side domain name;

[0022] When the binding relationship is the target binding relationship, calling the quantum key service platform to generate a first verification result; the first verification result is used to indicate that the identity security verification of the server has passed;

[0023] When the binding relationship is not the target binding relationship, calling the quantum key service platform to generate a second verification result; the second verification result is used to indicate that the identity security verification of the server has failed;

[0024] The first verification result and the second verification result are used as verification results.

[0025] Optionally, calling the quantum key service platform to generate the first encrypted session key according to the first random number and the session identifier includes:

[0026] Calling the quantum key service platform to generate a second random number and the session key;

[0027] Controlling the quantum key service platform to encrypt the session key using the first random number to obtain the first encrypted session key;

[0028] Control the quantum key service platform to encrypt the session identifier using the second random number to obtain the encrypted session identifier.

[0029] Optionally, the receiving and decrypting the first encrypted session key sent by the quantum key service platform to obtain the session key includes:

[0030] Receiving the first encrypted session key and the verification result sent by the quantum key service platform;

[0031] When the verification result is the first verification result, decrypting the first encrypted session key using the first random number to obtain the session key;

[0032] When the verification result is the second verification result, there is no need to use the first random number to decrypt the first encrypted session key.

[0033] Optionally, sending the encrypted session identifier to the server so that the server applies for the session key from the quantum key service platform includes:

[0034] Sending the second random number and the encrypted session identifier to the server, so that the server uses the second random number to decrypt the encrypted session identifier to obtain the session identifier;

[0035] After the server obtains the session identifier, the server is called to generate a third random number, and the third random number is sent to the quantum key service platform;

[0036] Controlling the quantum key service platform to encrypt the session key using the third random number to obtain a second encrypted session key;

[0037] The server is controlled to use the third random number to decrypt the second encrypted session key, so that the server obtains the session key.

[0038] Optionally, the quantum key service platform includes a first quantum key service platform and a second quantum key service platform, the client is connected to the first quantum key service platform, the server is connected to the second quantum key service platform, and the first quantum key service platform and the second quantum key service platform share session keys through a quantum key distribution network.

[0039] The embodiment of the present application also discloses a quantum-integrated protocol communication device, which is applied to a client, the client communicates with a server, and the client and the server are respectively connected to a quantum key service platform, and the device includes:

[0040] A calling module, used to call the communication interface and send a verification message to the quantum key service platform to perform identity security verification and apply for a session key;

[0041] A first encrypted session key module, used to receive and decrypt a first encrypted session key sent by the quantum key service platform to obtain the session key;

[0042] A session key application module, used to send an encrypted session identifier to the server, so that the server applies for the session key from the quantum key service platform;

[0043] A communication module is used to perform encrypted communication with the server according to the session key.

[0044] An embodiment of the present application also discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the quantum fusion protocol communication method as described in any one of the embodiments of the present application.

[0045] The embodiments of the present application also disclose one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes the quantum fusion protocol communication method as described in any one of the embodiments of the present application.

[0046] Compared with the prior art, the embodiments of the present application have the following advantages:

[0047] In an embodiment of the present application, a communication interface is called to send a verification message to the quantum key service platform to perform identity security verification and apply for a session key; a first encrypted session key sent by the quantum key service platform is received and decrypted to obtain the session key; an encrypted session identifier is sent to the server so that the server applies for the session key from the quantum key service platform; and encrypted communication is performed with the server based on the session key.

[0048] The embodiment of the present application encapsulates the entire quantum key communication process inside the communication interface, so the user can directly call the communication interface to send a message. In this process, the user does not need to understand the specific process of quantum encryption, which can make the software developed based on the traditional network interface easily migrate to quantum security. In addition, identity security verification is performed by verifying the message to prevent middleman attacks and enhance the security of communication. The client encrypts the session identifier (such as session ID) with the session key and sends it to the server, so that the server can apply for the same session key from the quantum key service platform, ensuring that the server can obtain the same session key as the client, and prepare for subsequent encrypted communications. In addition, the client and the server use the same session key to encrypt and decrypt the communication data, ensure the confidentiality and integrity of the communication data, prevent the data from being stolen or tampered with during transmission, and achieve secure encrypted communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flowchart of a quantum-integrated protocol communication method embodiment of the present application;

[0050] Figure 2 It is a schematic diagram of the connection relationship between a quantum key service platform and a QKD network of the present application;

[0051] Figure 3 This is a schematic diagram of the system architecture of an embodiment of a quantum-integrated protocol communication method of the present application;

[0052] Figure 4 It is a structural block diagram of an embodiment of a quantum-integrated protocol communication device of the present application;

[0053] Figure 5 It is a schematic diagram of the structure of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0055] In order to integrate quantum keys and the classic HTTPS communication process, the embodiment of the present application adopts a QKD network to negotiate the symmetric key in the HTTPS communication process. Compared with the public and private key methods used to negotiate the symmetric key in the classic HTTPS communication process, the quantum key has higher security. Compared with the existing quantum key usage method, the number of data encryption times in the process is reduced, and all quantum key communication processes can be encapsulated in the communication interface (HTTPSSDK). Users do not need to understand the specific process of quantum encryption when using quantum encryption, which can make it easy to migrate software developed based on traditional network interfaces to quantum security.

[0056] In the embodiment of the present application, both the client and the server hold a secure medium to ensure the security and reliability of communication. There is a shared charging key block between the secure medium and the quantum key service platform. The secure medium includes Ukey (USB Key, user key), SIM card (Subscriber Identity Module, user identification card), soft files, etc. The embodiment of the present application does not limit the form of the secure medium. The charging key block is a predefined key set for encryption and decryption processes. In the embodiment of the present application, if the middleman does not have the secure medium of the client and the server, the session key and session identifier cannot be decrypted, and the session key and session identifier cannot be obtained, thereby avoiding eavesdropping by the middleman on the client and the server.

[0057] Reference Figure 1 , is a flowchart of an embodiment of a quantum fusion protocol communication method of the present application, comprising the following steps:

[0058] Step 101: calling the communication interface and sending a verification message to the quantum key service platform to perform identity security verification and apply for a session key;

[0059] In the embodiment of the present application, since all quantum key communication processes are encapsulated inside the communication interface, when the client needs to communicate with the server, the client needs to call a predefined communication interface (such as HTTPSSDK) to interact with the server. The communication interface encapsulates all quantum key communication processes, including identity authentication and session key application processes.

[0060] After the client calls the communication interface, the client first sends a connection request to the server, and the server returns its own secure media ID (Identity Document) and server domain name, called the server secure media ID. At the same time, the client itself generates a first random number and a session ID.

[0061] A session ID is a unique identifier used to identify a specific communication session between a client and a server. It is usually a randomly generated string or number to ensure that both parties in each session can correctly process and respond to requests and responses in the session.

[0062] When the client receives the server-side secure medium identifier returned by the server, it will send the first random number, session identifier, server-side secure medium identifier and server-side domain name as a verification message to the first quantum key service platform to prove the identity of the server. At this time, the client will also apply for a session key from the first quantum key service platform so that it can subsequently communicate with the server based on the session key for encryption.

[0063] The first quantum key service platform in the embodiment of the present application uses quantum key distribution technology (such as BB84 protocol) to generate session keys, and QKD uses the principles of quantum mechanics to ensure the security of key distribution, which can be detected even if it is eavesdropped. Even in the era of quantum computing, when traditional encryption methods may be cracked, quantum keys can still provide the highest level of security.

[0064] Step 102: Receive and decrypt the first encrypted session key sent by the quantum key service platform to obtain the session key;

[0065] After the client applies for a session key from the first quantum key service platform, the first quantum key service platform first applies for a session key, and then uses the first random number to determine the position of the first injection key in the injection key block, so as to encrypt the session key with the first injection key to obtain a first encrypted session key.

[0066] In the embodiment of the present application, the first quantum key service platform needs to verify whether the server domain name and the server security medium match based on the binding of the server security medium identifier and the server domain name to prevent man-in-the-middle attacks. At this time, the first quantum key service platform will send the verification result to the client.

[0067] There are two specific verification results: 1. When the server domain name and the server security medium match, the server's identity authentication is considered to have passed; 2. When the server domain name and the server security medium do not match, the server's identity authentication is considered to have failed.

[0068] When the first quantum key service platform returns the first encrypted session key to the client, it also returns the second random number, the encrypted session identifier and the verification result to the client.

[0069] Therefore, in the embodiment of the present application, only when the identity authentication of the server is passed, the client will decrypt the first encrypted session key to obtain the session key.

[0070] Specifically, after the first quantum key service platform obtains the first encrypted session key, it will return the first encrypted session key to the client. Since the first random number is generated by the client, the client and the first quantum key service platform also obtain the first injection key in the injection key block based on the first random number, and decrypt the first encrypted session key through the first injection key to obtain the session key.

[0071] In the embodiment of the present application, the generation and use of the first random number is the key to ensuring the security of the encryption and decryption process. The client needs to ensure that the random number generation process is random and that the random number is securely stored and used.

[0072] Step 103: Send the encrypted session identifier to the server, so that the server applies for the session key from the quantum key service platform;

[0073] At this point, the client has successfully obtained the session key used for encrypted communication. Next, the server also needs to apply for the session key from the quantum key service platform.

[0074] When the first quantum key service platform uses the first random number to encrypt the session key, it also generates a second random number to encrypt the session identifier in the verification message to obtain an encrypted session identifier. Specifically, the first quantum key service platform uses the second random number to determine the position of the second injection key in the injection key block, so as to encrypt the session identifier by the second injection key to obtain an encrypted session identifier.

[0075] In actual applications, although the client itself already has an unencrypted session identifier, if the client directly sends the unencrypted session identifier to the server, a man-in-the-middle attacker may intercept the session identifier and communicate with the server impersonating the client, resulting in data leakage or tampering.

[0076] Therefore, in an embodiment of the present application, when the server's identity authentication is passed, the client will send the second random number and the encrypted session identifier to the server after decrypting the first encrypted session key, so that the server can obtain the second injection key in the injection key block based on the second random number, and decrypt the encrypted session identifier through the second injection key to obtain the session identifier.

[0077] The embodiment of the present application ensures that the session identifier will not be stolen or tampered with during transmission by encrypting the session identifier. Only the server holding the decryption key (the second injection key corresponding to the second random number) can decrypt and obtain the session identifier.

[0078] When the server successfully obtains the session identifier, it will apply to the quantum key service platform for the same session key as the client based on the session identifier. Specifically, the server will generate a third random number, and then send the third random number and the session identifier to the second quantum key service platform, so that the second quantum key service platform can determine the position of the third injection key in the injection key block based on the third random number, and encrypt the session key with the third injection key to obtain the second encrypted session key.

[0079] After the second quantum key service platform obtains the second encrypted session key, it returns the second encrypted session key to the server. Since the third random number is generated by the server, the server and the second quantum key service platform also obtain the third injection key in the injection key block based on the third random number, and decrypt the second encrypted session key through the third injection key to obtain the session key.

[0080] Step 104: Perform encrypted communication with the server according to the session key.

[0081] In the embodiment of the present application, when both the client and the server hold the same session key, encrypted communication will be performed based on the session key, which has unconditional security to ensure the confidentiality and integrity of the communication data. In addition, the encrypted data is transmitted through the classic network, and only the client and server holding the same session key can decrypt and read the data.

[0082] The embodiment of the present application encapsulates the entire quantum key communication process inside the communication interface, so the user can directly call the communication interface to send a message. In this process, the user does not need to understand the specific process of quantum encryption, which can make the software developed based on the traditional network interface easily migrate to quantum security. In addition, identity security verification is performed by verifying the message to prevent middleman attacks and enhance the security of communication. The client encrypts the session identifier (such as session ID) with the session key and sends it to the server, so that the server can apply for the same session key from the quantum key service platform, ensuring that the server can obtain the same session key as the client, and prepare for subsequent encrypted communications. In addition, the client and the server use the same session key to encrypt and decrypt the communication data, ensure the confidentiality and integrity of the communication data, prevent the data from being stolen or tampered with during transmission, and achieve secure encrypted communication.

[0083] In one embodiment of the present application, the step 101, calling the communication interface and sending a verification message to the quantum key service platform to perform identity security verification and apply for a session key, includes:

[0084] Calling the communication interface;

[0085] Sending a connection request to a server to establish a communication connection with the server;

[0086] Receive a server security medium identifier and a server domain name sent by the server;

[0087] Generate a first random number and a session identifier;

[0088] Sending the server secure medium identifier, the first random number, the session identifier, and the server domain name as the verification message to the quantum key service platform;

[0089] After the quantum key service platform receives the verification message, the quantum key service platform is called to perform identity security verification according to the server security medium identifier and the server domain name;

[0090] According to the first random number and the session identifier, the quantum key service platform is called to generate the first encrypted session key and the encrypted session identifier.

[0091] In an embodiment of the present application, the client first calls a predefined communication interface to interact with the server. When the communication interface is called, the client can send a connection request to the server to establish a communication connection between the client and the server. Subsequently, the server will return the server security medium identifier and the server domain name to the client to verify the identity of the server and avoid middleman eavesdropping. At the same time, the client itself will generate a first random number and a session identifier. The first random number marks the position of the first injection key in the injection key block, and the session identifier ensures normal communication between the client and the server.

[0092] When the client receives the server security medium identifier returned by the server, it will send the first random number, session identifier, server security medium identifier and server domain name as a verification message to the first quantum key service platform to prove the identity of the server. At this time, the client will also apply for a session key from the first quantum key service platform, determine the first charging key based on the first random number, and use the first charging key to encrypt the session key to obtain the first encrypted session key.

[0093] While the first quantum key service platform uses the first random number to encrypt the session key, the first quantum key service platform also generates a second random number to encrypt the session identifier to obtain an encrypted session identifier, wherein the second random number marks the position of the second injection key in the injection key block, and the second injection key is used to encrypt and decrypt the session identifier.

[0094] In another embodiment of the present application, when the client sends the first random number, session identifier, server secure medium identifier and server domain name to the first quantum key service platform, it can also send its own secure medium ID (client secure medium identifier) ​​to the first quantum key service platform to verify the identity of the client and avoid the occurrence of man-in-the-middle eavesdropping when communicating between the client and the server.

[0095] In one embodiment of the present application, a target binding relationship is pre-stored in the quantum key service platform, and the target binding relationship is used to indicate that the server-side secure medium identifier and the server-side domain name have been bound. After the quantum key service platform receives the verification message, calling the quantum key service platform to perform identity security verification according to the server-side secure medium identifier and the server-side domain name includes:

[0096] After the quantum key service platform receives the verification message, the quantum key service platform is called to determine the binding relationship between the server-side secure medium identifier and the server-side domain name;

[0097] When the binding relationship is the target binding relationship, calling the quantum key service platform to generate a first verification result; the first verification result is used to indicate that the identity security verification of the server has passed;

[0098] When the binding relationship is not the target binding relationship, calling the quantum key service platform to generate a second verification result; the second verification result is used to indicate that the identity security verification of the server has failed;

[0099] The first verification result and the second verification result are used as verification results.

[0100] In an embodiment of the present application, before the client and the server communicate, the server's secure medium identifier and the server's domain name will be bound. This binding relationship is the target binding relationship in the embodiment of the present application, and the target binding relationship will be pre-stored in the database of the first quantum key service platform.

[0101] After receiving the verification message, the first quantum key service platform will extract the server domain name and server security media identifier in the verification message. Subsequently, the first quantum key service platform will query the database to obtain the security media identifier bound to the server domain name, match the server security media identifier in the verification message with the binding information in the database, and verify whether the server domain name and the server security media identifier match to obtain the verification result (first verification result and second verification result).

[0102] If the server-side secure medium identifier in the verification message matches the binding information in the database, the first quantum key service platform considers the current binding relationship to be the target binding relationship, that is, the server-side identity authentication is successful (the first verification result), and continues to process the application request for the session key.

[0103] If the server-side secure medium identifier in the verification message does not match the binding information in the database, the first quantum key service platform considers that the current binding relationship is not the target binding relationship, that is, the server-side identity authentication fails (the second verification result), and rejects the application request for the session key.

[0104] The embodiment of the present application verifies the binding relationship between the server's secure medium identifier and the domain name to ensure that only legitimate servers can pass identity authentication and prevent malicious servers from impersonating legitimate servers to communicate with clients.

[0105] In one embodiment of the present application, calling the quantum key service platform to generate the first encrypted session key according to the first random number and the session identifier includes:

[0106] Calling the quantum key service platform to generate a second random number and the session key;

[0107] Controlling the quantum key service platform to encrypt the session key using the first random number to obtain the first encrypted session key;

[0108] Control the quantum key service platform to encrypt the session identifier using the second random number to obtain the encrypted session identifier.

[0109] In practical applications, session identifiers and session keys are two different entities, used to identify sessions and encrypt communication data, respectively. If session identifiers and session keys are encrypted using the same random number, attackers may be able to obtain session keys by replaying the session identifier, leading to security risks. In addition, a single random number may not provide sufficient security, especially in the era of quantum computing, where traditional encryption methods may be cracked and cannot provide unconditional security.

[0110] Therefore, the use of different random numbers for encryption in the embodiments of the present application can ensure their independent security and prevent the security issues of one entity from affecting another entity. Specifically, the process of the first quantum key service platform generating the first encrypted session key and the encrypted session identifier involves two random numbers: a first random number (generated by the client) and a second random number (generated by the first quantum key service platform).

[0111] Using the first random number generated by the client to encrypt the session key can not only prevent the first quantum key service platform from leaking the session key, but also prevent middleman attackers from tampering with or stealing the session key, thereby ensuring the security of the session key.

[0112] Specifically, when the client applies for a session key from the first quantum key service platform, the first quantum key service platform first applies for a session key, and then uses the first random number to determine the position of the first injection key in the injection key block, so as to encrypt the session key with the first injection key to obtain a first encrypted session key.

[0113] When the first quantum key service platform uses the first random number to encrypt the session key, it also generates a second random number to encrypt the session identifier in the verification message to obtain an encrypted session identifier. Specifically, the first quantum key service platform uses the second random number to determine the position of the second injection key in the injection key block, so as to encrypt the session identifier by the second injection key to obtain an encrypted session identifier.

[0114] In one embodiment of the present application, the receiving and decrypting the first encrypted session key sent by the quantum key service platform to obtain the session key includes:

[0115] Receiving the first encrypted session key and the verification result sent by the quantum key service platform;

[0116] When the verification result is the first verification result, decrypting the first encrypted session key using the first random number to obtain the session key;

[0117] When the verification result is the second verification result, there is no need to use the first random number to decrypt the first encrypted session key.

[0118] In an embodiment of the present application, when the server's identity authentication is passed (first verification result), the client will use the first random number to determine the position of the first injection key in the injection key block, and decrypt the first encrypted session key using the first injection key to obtain the original session key.

[0119] If the identity authentication of the server fails (second authentication result), it is considered that the client cannot trust the identity of the server, so the client does not need to use the first random number to decrypt the first encrypted session key.

[0120] In one embodiment of the present application, the sending of the encrypted session identifier to the server so that the server applies for the session key from the quantum key service platform includes:

[0121] Sending the second random number and the encrypted session identifier to the server, so that the server uses the second random number to decrypt the encrypted session identifier to obtain the session identifier;

[0122] After the server obtains the session identifier, the server is called to generate a third random number, and the third random number is sent to the quantum key service platform;

[0123] Controlling the quantum key service platform to encrypt the session key using the third random number to obtain a second encrypted session key;

[0124] The server is controlled to use the third random number to decrypt the second encrypted session key, so that the server obtains the session key.

[0125] In an embodiment of the present application, when the client decrypts the first encrypted session key and obtains the session key, it sends the second random number and the encrypted session identifier to the server, so that the server obtains the second injection key in the injection key block based on the second random number, and decrypts the encrypted session identifier using the second injection key to obtain the session identifier.

[0126] The embodiment of the present application ensures that the session identifier will not be stolen or tampered with during transmission by encrypting the session identifier. Only the server holding the decryption key (the second injection key corresponding to the second random number) can decrypt and obtain the session identifier.

[0127] When the server successfully obtains the session identifier, it will apply to the quantum key service platform for the same session key as the client based on the session identifier. Specifically, the server will generate a third random number, and then send the third random number and the session identifier to the second quantum key service platform, so that the second quantum key service platform can determine the position of the third injection key in the injection key block based on the third random number, and encrypt the session key with the third injection key to obtain the second encrypted session key.

[0128] After the second quantum key service platform obtains the second encrypted session key, it returns the second encrypted session key to the server. Since the third random number is generated by the server, the server and the second quantum key service platform also obtain the third injection key in the injection key block based on the third random number, and decrypt the second encrypted session key through the third injection key to obtain the session key.

[0129] In one embodiment of the present application, the quantum key service platform includes a first quantum key service platform and a second quantum key service platform, the client is connected to the first quantum key service platform, the server is connected to the second quantum key service platform, and the first quantum key service platform and the second quantum key service platform share session keys through a quantum key distribution network.

[0130] Reference Figure 2 , is a schematic diagram of the connection relationship between a quantum key service platform and a QKD network of the present application. Specifically, multiple quantum key service platforms (including a first quantum key service platform and a second quantum key service platform) are connected through a QKD network (quantum key distribution network) to achieve session key sharing, the client is connected to the first quantum key service platform, the server is connected to the second quantum key service platform, and the client and the server are connected through a classical network.

[0131] Reference Figure 3 , shows a schematic diagram of the system architecture of an embodiment of a quantum-integrated protocol communication method of the present application. Specifically, the communication between the client, the server, the first quantum key service platform and the second quantum key service platform is described as follows:

[0132] The client first sends a connection request to the server, and the server returns its own secure media identifier (server secure media identifier);

[0133] The client generates a first random number and a session identifier, and sends the first random number, the session identifier, the client secure medium identifier, the server secure medium identifier, and the server domain name to the first quantum key service platform;

[0134] The first quantum key service platform returns a second random number, a first encrypted session key, an encrypted session identifier, and a verification result; wherein the first encrypted session key is encrypted using the first charging key, and the encrypted session identifier is encrypted using the second charging key;

[0135] After receiving it, the client can decrypt it by itself using the first injection key determined by the first random number to obtain the session key;

[0136] The client sends the second random number and the encrypted session identifier to the server. After receiving the second random number, the server can decrypt the second injection key determined by the second random number to obtain the session identifier.

[0137] The server generates a third random number, and sends the third random number and the session identifier to the second quantum key service platform;

[0138] The second quantum key service platform returns the second encrypted session key, and after receiving it, the server end decrypts it by itself using the third charging key determined by the third random number to obtain the session key; wherein the second encrypted session key returned by the second quantum key service platform is encrypted using the third charging key;

[0139] The client and server communicate with each other using encrypted session keys.

[0140] The embodiment of the present application encapsulates the entire quantum key communication process inside the communication interface, so the user can directly call the communication interface to send a message. In this process, the user does not need to understand the specific process of quantum encryption, which can make the software developed based on the traditional network interface easily migrate to quantum security. In addition, identity security verification is performed by verifying the message to prevent middleman attacks and enhance the security of communication. The client encrypts the session identifier (such as session ID) with the session key and sends it to the server, so that the server can apply for the same session key from the quantum key service platform, ensuring that the server can obtain the same session key as the client, and prepare for subsequent encrypted communications. In addition, the client and the server use the same session key to encrypt and decrypt the communication data, ensure the confidentiality and integrity of the communication data, prevent the data from being stolen or tampered with during transmission, and achieve secure encrypted communication.

[0141] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0142] On the basis of the above embodiments, this embodiment also provides a quantum-integrated protocol communication device, which is applied to electronic devices such as terminal devices and servers.

[0143] Reference Figure 4 , shows a block diagram of a quantum-integrated protocol communication device embodiment of the present application, which may specifically include the following modules:

[0144] A calling module 401 is used to call a communication interface and send a verification message to the quantum key service platform to perform identity security verification and apply for a session key;

[0145] A first encrypted session key module 402, configured to receive and decrypt a first encrypted session key sent by the quantum key service platform to obtain the session key;

[0146] A session key application module 403 is used to send an encrypted session identifier to the server so that the server applies for the session key from the quantum key service platform;

[0147] The communication module 404 is used to perform encrypted communication with the server according to the session key.

[0148] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0149] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0150] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as terminal devices and servers (clusters). Figure 5 An exemplary apparatus 500 that can be used to implement various embodiments described in this application is schematically shown.

[0151] For one embodiment, Figure 5 An exemplary apparatus 500 is shown having one or more processors 502, a control module (chip set) 504 coupled to at least one of the processor(s) 502, a memory 506 coupled to the control module 504, a non-volatile memory (NVM) / storage device 508 coupled to the control module 504, one or more input / output devices 510 coupled to the control module 504, and a network interface 512 coupled to the control module 504.

[0152] The processor 502 may include one or more single-core or multi-core processors, and the processor 502 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 500 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0153] In some embodiments, the apparatus 500 may include one or more computer-readable media (e.g., memory 506 or NVM / storage device 508) having instructions 514 and one or more processors 502 configured in conjunction with the one or more computer-readable media to execute the instructions 514 to implement a module to perform the actions described in the present disclosure.

[0154] For one embodiment, control module 504 may include any suitable interface controller to provide any suitable interface to at least one of processor(s) 502 and / or any suitable device or component in communication with control module 504 .

[0155] The control module 504 may include a memory controller module to provide an interface to the memory 506. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0156] The memory 506 may be used, for example, to load and store data and / or instructions 514 for the device 500. For one embodiment, the memory 506 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 506 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0157] For one embodiment, control module 504 may include one or more input / output controllers to provide an interface to NVM / storage device 508 and input / output device(s) 510 .

[0158] For example, NVM / storage 508 may be used to store data and / or instructions 514. NVM / storage 508 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0159] NVM / storage device 508 may include storage resources that are physically part of the device on which apparatus 500 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 508 may be accessed via input / output device(s) 510 over a network.

[0160] (One or more) input / output devices 510 may provide an interface for the apparatus 500 to communicate with any other appropriate device, and the input / output device 510 may include a communication component, an audio component, a sensor component, etc. The network interface 512 may provide an interface for the apparatus 500 to communicate through one or more networks, and the apparatus 500 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0161] For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 504. For one embodiment, at least one of the processor(s) 502 may be packaged together with the logic of one or more controllers of the control module 504 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504. For one embodiment, at least one of the processor(s) 502 may be integrated on the same die with the logic of one or more controllers of the control module 504 to form a system-on-chip (SoC).

[0162] In various embodiments, the apparatus 500 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the apparatus 500 may have more or fewer components and / or a different architecture. For example, in some embodiments, the apparatus 500 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0163] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0164] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0165] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0166] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable quantum-integrated protocol communication terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable quantum-integrated protocol communication terminal device generate instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable quantum fusion protocol communication terminal device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable quantum fusion protocol communication terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable terminal device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0169] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0170] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0171] The above is a detailed introduction to a quantum-integrated protocol communication method and device, an electronic device and a storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technicians in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A quantum-integrated protocol communication method, characterized in that: Applied to a client, the client communicates with a server, the client and the server are respectively connected to a quantum key service platform, and the method includes: Calling the communication interface and sending a verification message to the quantum key service platform to perform identity security verification and apply for a session key; Receiving and decrypting a first encrypted session key sent by the quantum key service platform to obtain the session key; Sending an encrypted session identifier to the server, so that the server applies for the session key from the quantum key service platform; Perform encrypted communication with the server according to the session key.

2. The method according to claim 1, characterized in that The calling of the communication interface and sending of a verification message to the quantum key service platform for identity security verification and application for a session key include: Calling the communication interface; Sending a connection request to a server to establish a communication connection with the server; Receive a server security medium identifier and a server domain name sent by the server; Generate a first random number and a session identifier; Sending the server secure medium identifier, the first random number, the session identifier, and the server domain name as the verification message to the quantum key service platform; After the quantum key service platform receives the verification message, the quantum key service platform is called to perform identity security verification according to the server security medium identifier and the server domain name; According to the first random number and the session identifier, the quantum key service platform is called to generate the first encrypted session key and the encrypted session identifier.

3. The method according to claim 2, characterized in that The target binding relationship is pre-stored in the quantum key service platform, and the target binding relationship is used to indicate that the server-side secure medium identifier and the server-side domain name have been bound. After the quantum key service platform receives the verification message, the quantum key service platform is called to perform identity security verification according to the server-side secure medium identifier and the server-side domain name, including: After the quantum key service platform receives the verification message, the quantum key service platform is called to determine the binding relationship between the server-side secure medium identifier and the server-side domain name; When the binding relationship is the target binding relationship, calling the quantum key service platform to generate a first verification result; the first verification result is used to indicate that the identity security verification of the server has passed; When the binding relationship is not the target binding relationship, calling the quantum key service platform to generate a second verification result; the second verification result is used to indicate that the identity security verification of the server has failed; The first verification result and the second verification result are used as verification results.

4. The method according to claim 2, characterized in that: The step of calling the quantum key service platform to generate the first encrypted session key according to the first random number and the session identifier includes: Calling the quantum key service platform to generate a second random number and the session key; Controlling the quantum key service platform to encrypt the session key using the first random number to obtain the first encrypted session key; Control the quantum key service platform to encrypt the session identifier using the second random number to obtain the encrypted session identifier.

5. The method according to claim 3, characterized in that: The receiving and decrypting the first encrypted session key sent by the quantum key service platform to obtain the session key includes: Receiving the first encrypted session key and the verification result sent by the quantum key service platform; When the verification result is the first verification result, decrypting the first encrypted session key using the first random number to obtain the session key; When the verification result is the second verification result, there is no need to use the first random number to decrypt the first encrypted session key.

6. The method according to claim 4, characterized in that The sending of the encrypted session identifier to the server so that the server applies for the session key from the quantum key service platform includes: Sending the second random number and the encrypted session identifier to the server, so that the server uses the second random number to decrypt the encrypted session identifier to obtain the session identifier; After the server obtains the session identifier, the server is called to generate a third random number, and the third random number is sent to the quantum key service platform; Controlling the quantum key service platform to encrypt the session key using the third random number to obtain a second encrypted session key; The server is controlled to use the third random number to decrypt the second encrypted session key, so that the server obtains the session key.

7. The method according to claim 1, characterized in that The quantum key service platform includes a first quantum key service platform and a second quantum key service platform. The client is connected to the first quantum key service platform, and the server is connected to the second quantum key service platform. The first quantum key service platform and the second quantum key service platform share session keys through a quantum key distribution network.

8. A quantum-integrated protocol communication device, characterized in that: Applied to a client, the client communicates with a server, the client and the server are respectively connected to a quantum key service platform, and the device includes: A calling module, used to call the communication interface and send a verification message to the quantum key service platform to perform identity security verification and apply for a session key; A first encrypted session key module, used to receive and decrypt a first encrypted session key sent by the quantum key service platform to obtain the session key; A session key application module, used to send an encrypted session identifier to the server, so that the server applies for the session key from the quantum key service platform; A communication module is used to perform encrypted communication with the server according to the session key.

9. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, enables the processor to execute the quantum fusion protocol communication method as described in any one of claims 1 to 7.

10. One or more machine-readable media having executable codes stored thereon, which, when executed, enable a processor to execute the quantum fusion protocol communication method as described in any one of claims 1 to 7.

Images