Key distribution method based on differential instruction, electronic equipment and storage medium
By using a differential instruction key distribution method, the problems of large storage consumption, low transmission efficiency, and resource waste in the key distribution process are solved, realizing efficient storage and flexible utilization of key resources in quantum-safe terminals, and improving system processing efficiency and key resource utilization.
Patent Information
- Application Number
- CN202511439403.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-10
- Publication Date
- 2026-01-13
AI Technical Summary
Existing technologies suffer from problems such as large storage requirements, low transmission efficiency, limited reading speed, and waste of key resources in the key distribution process. Especially when the storage resources of quantum security terminals are limited, the transmission and storage of the overall key file significantly reduces system efficiency, and the key file expires and cannot be redistributed if it is not used, resulting in waste of resources.
The differential instruction key distribution method involves the key center generating differential instructions and sending them to the quantum-secure terminal. The quantum-secure terminal then downloads the required key content according to the instructions, avoiding the direct storage or synchronization of all key files in the key center. Instead, it stores only the differential instructions and downloads the key files as needed.
It effectively saves storage resources in quantum-safe terminals, improves system processing efficiency, increases key resource utilization, reduces management costs, and ensures the accuracy and real-time nature of key acquisition.
Smart Images
Figure CN121333557A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of quantum security technology, and in particular to a key distribution method, electronic device and storage medium based on differential instructions. Background Technology
[0002] When performing data encryption and decryption operations on quantum-safe terminal devices, key acquisition is an essential step. Since quantum-safe terminals typically lack the capability to securely generate high-strength keys themselves, they rely on a key center to allocate corresponding key files. This process involves key generation, allocation, and secure key downloading by the terminal.
[0003] In existing technical solutions, key files are typically distributed as a whole. This means the key center sends the complete key file to the quantum-safe terminal device all at once. This approach has significant drawbacks: firstly, during key distribution, the quantum-safe terminal needs to receive and store the entire key file, consuming considerable local storage space; secondly, when the key file is large or the quantum-safe terminal has limited storage resources, transmitting and storing the entire key file significantly reduces system efficiency and increases the processing burden on the quantum-safe terminal. Furthermore, in some application scenarios, the key file needs to be completely copied to the quantum-safe terminal during the distribution phase, further exacerbating the consumption of local storage resources and affecting the real-time performance of key reading and use. Moreover, due to the uniqueness and one-time use requirements of keys, keys that are downloaded but not ultimately used by the quantum-safe terminal often expire or become invalid due to policy reasons, making them unredeemable for other terminals. This results in a waste of key resources and reduces the overall utilization efficiency of keys in the key center.
[0004] Therefore, existing technologies suffer from problems such as large storage requirements, low transmission efficiency, limited reading speed, and waste of key resources during the key distribution process, and there is an urgent need for a more efficient and flexible key distribution method. Summary of the Invention
[0005] Purpose of the invention: This application provides a key distribution method, electronic device, and storage medium based on differential instructions to solve the problems existing in the prior art.
[0006] Technical Solution: This invention provides a key distribution method based on differential instructions. The participants in the method include a key center connected via communication and a quantum-secure terminal. The method includes the following steps:
[0007] Step 1: The quantum-safe terminal sends a key acquisition request to the key center, and the key center calculates the number of key files that need to be acquired in response to the key acquisition request;
[0008] Step 2: The key center responds to the key acquisition request, performs key allocation, and generates differential instructions to send to the quantum security terminal;
[0009] Step 3: The quantum-safe terminal initiates a key download request to the key center based on the received differential instruction to obtain the target key file.
[0010] As an improvement of the present invention, step 1 further includes: the key center immediately checks whether there is a previous task for the key acquisition request; if there is, it is placed in the cleanup logic and waits for cleanup; otherwise, no processing is performed.
[0011] As an improvement of the present invention, in step 1, the process of calculating the number of key files to be obtained includes:
[0012] For the key acquisition request, the key center calculates the number m of key files that need to be acquired, where the key acquisition request includes the size q of a single key file and the number of files n required by the user.
[0013] m = (q × n) mod M;
[0014] Where M is the size of the key file generated by the key pool of the key center.
[0015] As an improvement to the present invention, the specific process of step 2 is as follows:
[0016] The key center obtains a list of key files from the local key pool based on the number m of key files obtained through calculation. Based on the number n of files in the key acquisition request, it determines the splitting or combination relationship in the list of key files and generates differential instructions to distribute to the quantum security terminal.
[0017] The determination of the splitting or combining relationship in the key file list means that when allocating a single key file, the corresponding splitting or combining relationship is recorded as a differential instruction for the single key file, without splitting or combining the content of the key file itself.
[0018] As an improvement of the present invention, the differential instruction for each key file includes the following fields: task file sequence number seq(), index number idx_no(), key file number src(), key offset src_offset(), and key length src_length().
[0019] The seq field indicates which key file in the instruction the key file is; the idx_no field indicates the sequence number of the subkey file in the key file in the instruction; the src field indicates which key file in the key pool the subkey file originates from; the src_offset field indicates the offset position in the specified key file from which to start reading; and the src_length field indicates the length of the key file being read.
[0020] As an improvement of the present invention, the differential instruction includes splitting or combining key files; the method for determining whether to split or combine key files is to compare the size M of the key file generated by the key center with the size q of the single key file requested by the quantum security terminal.
[0021] If M ≥ q, then the difference instruction is a split instruction; the split instruction includes:
[0022] Based on the calculation in step 1, the number of key files to be obtained is m. Then, the key center takes out m key files from the local key pool, extracts n key single files of size q from them, fills in the fields of each key single file, obtains the corresponding number of commands, and updates the key file table.
[0023] If M < q, then the differential instruction is a combination instruction; the combination instruction includes:
[0024] Based on the calculation in step 1, the number of key files to be obtained is m. Then, the key center takes out m key files from the local key pool, combines them into n key single files of size q, fills in the fields of each key single file, obtains the corresponding number of commands, and updates the key file table.
[0025] As an improvement of the present invention, step 3 specifically includes: the quantum-safe terminal viewing the updated key file list, downloading the key single file from the key center to the local machine according to the fields of the key single file in the key file list, and combining or splitting all the downloaded key single files according to the differential instruction to generate the final target key file.
[0026] As an improvement of the present invention, the specific process of downloading the single key file is as follows: download the corresponding key content from the key center according to the fields src(), src_offset(), and src_length() in the command, and then combine the key content downloaded by the command with the same task file number to form a single key file with the corresponding task file number.
[0027] As an improvement to the present invention, an electronic device is also provided, comprising:
[0028] Memory, used to store a set of instructions; and
[0029] At least one processor is configured to execute the set of instructions to cause the electronic device to perform the method described above.
[0030] As an improvement to the present invention, a non-transitory computer-readable storage medium is also provided, the non-transitory computer-readable storage medium storing a set of instructions for a computer, which, when executed, causes the computer to perform the method described above.
[0031] Beneficial effects:
[0032] 1. The key center manages the keys uniformly and does not distribute the complete key file to the quantum-safe terminal. Instead, it only sends differential instructions to the terminal, which effectively ensures the security of the key file. Based on the instructions, the quantum-safe terminal can accurately download the required key content, which not only ensures the accuracy of key acquisition but also significantly saves local storage resources.
[0033] 2. The effective saving of storage resources in quantum-safe terminals improves the overall processing efficiency of the system, thereby accelerating business response speed;
[0034] 3. The quantum-safe terminal adopts an on-demand download and instant access key usage mechanism, which can maximize the use of key resources in the key center, improve key distribution efficiency, and thus reduce the management cost of the key center. Attached Figure Description
[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0036] Figure 1 This is a flowchart illustrating the method described in this application;
[0037] Figure 2 This is a schematic diagram illustrating an example where the differential instruction in the method of this application is a splitting instruction;
[0038] Figure 3 This is a schematic diagram illustrating an example of a combination instruction used in the method of this application. Detailed Implementation
[0039] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0040] This invention provides a key distribution method based on differential instructions, wherein the participants in the method include a key center and a quantum-safe terminal connected by communication. Figure 1 As shown, the method includes the following steps:
[0041] Step 1: The quantum-safe terminal initiates a key acquisition request to the key center. In response to the key acquisition request, the key center immediately checks whether there is a previous task: if there is, it is placed in the cleanup logic and waits for cleanup; otherwise, no processing is performed; at the same time, the key center calculates the number of key files that need to be acquired.
[0042] Specifically, the key acquisition request includes: the size q of the single key file required by the user and the number of files n; the key center calculates the number m of key files to be acquired in response to the key acquisition request:
[0043] m = (q × n) mod M;
[0044] Where M is the size of the key file generated by the key pool of the key center.
[0045] Specifically, the quantum-safe terminal initiates a key acquisition request to the key center, requesting to obtain key files: the quantum-safe terminal requests to download a single key file of size q, and requests n such single key files of size q at a time.
[0046] Step 2: The key center responds to the key acquisition request, performs key allocation, and generates differential instructions to send to the quantum security terminal;
[0047] Specifically, the key center obtains a list of key files from the local key pool based on the number m of key files obtained through calculation, determines the splitting or combination relationship in the key file list based on the number n of files in the key acquisition request, and generates differential instructions (splitting or combination relationship) to distribute to the quantum security terminal.
[0048] It should be noted that determining the splitting or combining relationship in the key file list means splitting or combining the key file into the required single file size. When allocating the single key file, only the corresponding splitting / combining relationship is recorded. This splitting / combining relationship serves as a differential instruction for the single key file and does not actually split or combine the content of the key file itself. The actual splitting / combining action is performed during download to ensure the responsiveness and concurrency of key allocation.
[0049] In embodiments of the present invention, the quantum-secure terminal does not directly store or synchronize all key files of the key center. Instead, it stores the differential instructions of these individual key files (e.g., field parameters of the individual key files as described below), and then obtains the key content corresponding to these differential instructions based on these differential instructions. During transmission, only the instructions and a small number of individual key files need to be transmitted, rather than the entire large file containing the key content. This storage method is both efficient and secure.
[0050] For example, the key center may retrieve m key files from the local key pool as needed, and then divide the m key files into n key single files according to the differential instruction. The differential instruction for each key single file includes the following fields: task file sequence number seq(), index number idx_no(), key file number src(), key offset src_offset(), and key length src_length().
[0051] The seq field indicates which key file this key file is in the instruction, the idx_no field indicates the sequence number of the subkey file in this key file in the instruction, the src field indicates which key file (key file number / index) in the key pool this subkey file comes from, the src_offset field indicates the offset position in the specified key file from which to start reading, and the src_length field indicates the length of the key file to be read.
[0052] In embodiments of the present invention, the differential instruction includes splitting or combining key files. The method for determining whether to split or combine is to compare the size M of the key file generated by the key center with the size q of the single key file requested by the quantum security terminal. If M ≥ q, the differential instruction is a splitting instruction; otherwise, the differential instruction is a combining instruction.
[0053] If M ≥ q, then the splitting process includes:
[0054] Based on step 1, the number of key files to be obtained is m. The key center then retrieves m key files from the local key pool, extracts n single key files of size q from them, fills in the fields of each single key file, obtains the corresponding number of commands, and updates the key file table.
[0055] For example, the key pool of the key center generates keys of 128MB each time. A quantum-safe terminal requests 8 key files of 8MB each, and requests 8 key files at once. During allocation, the first step is to calculate the number of key files needed from the key pool of the key center: m = 8MB × 8 mod 128MB = 1. Therefore, the key center retrieves a key file A from the key pool and executes a differential instruction on key file A, that is, extracts 8 key files from key file A. The extraction principle can be sequential extraction, and the fields of each key file are filled in, resulting in... Figure 2 The eight commands shown are:
[0056] Command 1: Task file sequence number seq(0), idx_no(0), src(A), src_offset(0), src_length(8MB)...
[0057] Command 2: Task file sequence number seq(1), idx_no(0), src(A), src_offset(8MB), src_length(8MB)...
[0058] Command 3: Task file sequence number seq(2), idx_no(0), src(A), src_offset(16MB), src_length(8MB)... ......
[0060] Command 8: Task file sequence number seq(7), idx_no(0), src(A), src_offset(56MB), src_length(8MB)...
[0061] Taking the first key file (task file sequence number seq(0)) as an example, the field parameters of the key file after differential processing indicate that in order to construct the target key file with task file sequence number seq0, the sub-key file with sequence number 0 (idx_no(0)) is obtained from the existing local key file A (src(A)), with offset position 0 (src_offset(0)) as the initial position and length 8M (src_length(8MB)) as the length of the sub-key file. This sub-key file directly forms the 0th 8MB key file.
[0062] If M < q, then the combination process includes:
[0063] Based on step 1, the number of key files to be obtained is m. The key center then retrieves m key files from the local key pool, combines them into n key single files of size q, fills in the fields of each key single file, obtains the corresponding number of commands, and updates the key file table.
[0064] For example, each key generated by the key pool of the key center is 4MB. A quantum-secure terminal requests 8 key files of 8MB each. During allocation, the number of key files needed (m) generated by the key pool of the key center is first calculated: m = 8MB × 8 mod 4MB = 16. Therefore, the key center retrieves 16 key files 0~F from the key pool, executes a combination instruction on key files 0~F, that is, combines key files 0~F into 8 key files, and fills in the fields of each key file, resulting in... Figure 3 The 16 commands shown:
[0065] Command 1: Task file sequence number seq(0), idx_no(0), src(0), src_offset(0), src_length(4MB)...
[0066] Command 2: Task file sequence number seq(0), idx_no(1), src(A), src_offset(0), src_length(4MB)...
[0067] Command 3: Task file sequence number seq(1), idx_no(0), src(B), src_offset(0), src_length(4MB)...
[0068] Command 4: Task file sequence number seq(1), idx_no(1), src(C), src_offset(0), src_length(4MB)... ......
[0070] Command 15: Task file sequence number seq(7), idx_no(0), src(N), src_offset(0), src_length(4MB)...
[0071] Command 16: Task file sequence number seq(7), idx_no(1), src(0), src_offset(0), src_length(4MB)...
[0072] Taking the fields of the first key file as an example, it can be seen from the parameters of the differential file that two commands are needed to construct the first key file with a length of 8M. The field parameters of command 1 indicate that in order to construct the target key file with the sequence number seq of task file 0, the 0th key file is taken from the existing key files 0~F, the offset position 0 (src_offset(0)) is taken as the initial position, and the length of the key sub-file is 4M (src_length(8MB)) to obtain the sub-key file with the sequence number 0 (idx_no(0)) in the file. The field parameters of command 2 indicate that in order to construct the target key file with the sequence number 0, the 1st key file is taken from the existing key files 0~F, the offset position 0 (src_offset(0)) is taken as the initial position, and the length of the sub-key file is 4M (src_length(8MB)) to obtain the sub-key file with the sequence number 1 (idx_no(0)) in the file. Thus, Command 1 and Command 2 together form the 0th 8MB key file.
[0073] It should be noted that only the relationship is recorded during allocation. When a user's quantum secure terminal downloads the key, the entire key file is not transmitted. Subsequently, the quantum secure terminal reads the specific key content to be downloaded based on the recorded information and obtains the key distribution from the key center. This avoids copying the entire file content during allocation, which would occupy storage space. This improves the storage space utilization of the quantum secure terminal device and greatly saves the bandwidth and time occupied by data transmission.
[0074] In embodiments of the present invention, this step may further include: the key center monitors the remaining key quantity in the local key pool in real time; if the remaining key quantity is insufficient to support distribution, a key replenishment operation needs to be performed. The key replenishment operation includes random number expansion, hardware-isolated downloading, and encrypted channel transmission.
[0075] Step 3: The quantum-safe terminal initiates a key download request to the key center based on the received differential instruction to obtain the target key file.
[0076] Specifically, the quantum-safe terminal views the updated list of key files, downloads key files from the key center to its local machine based on the fields of the key files in the list, and combines or splits all the downloaded key files according to differential instructions to generate the final target key file.
[0077] More specifically, the specific process of downloading the single key file is as follows: download the corresponding key content from the key center according to the fields "src(B), src_offset(0), src_length(4MB)" in the command, and then combine the key content downloaded by the command with the same task file number to form a single key file with the corresponding task file number.
[0078] This application also includes an electronic device. The electronic device may include a memory for storing a set of instructions; and at least one processor configured to execute the set of instructions to cause the electronic device to perform the above-described method for generating irreducible polynomials over finite fields.
[0079] This application embodiment also includes a non-transitory computer-readable storage medium storing a set of computer instructions that, when executed, cause the computer to perform the above-described method for generating irreducible polynomials in finite fields.
[0080] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.
[0081] As can be seen from the method described in this invention, when the key center distributes keys, it only sends differential instructions to the quantum security terminal and does not split or combine the key content of the key file in the local key pool. In this way, if the quantum security terminal fails to download the key, the original source key file of the key center will not be wasted. Moreover, when a message of key download failure is received, the source key file can be reused in the next download, ensuring the utilization rate of key resources.
Claims
1. A key distribution method based on differential instructions, wherein the participants in the method include a key center and a quantum-secure terminal connected by communication, characterized in that, The method includes the following steps: Step 1: The quantum-safe terminal sends a key acquisition request to the key center, and the key center calculates the number of key files that need to be acquired in response to the key acquisition request; Step 2: The key center responds to the key acquisition request, performs key allocation, and generates differential instructions to send to the quantum security terminal; Step 3: The quantum-safe terminal initiates a key download request to the key center based on the received differential instruction to obtain the target key file.
2. The key distribution method based on differential instructions according to claim 1, characterized in that, Step 1 further includes: for the key acquisition request, the key center immediately checks whether there is a previous task: if there is, it is placed in the cleanup logic and waits for cleanup; otherwise, no processing is performed.
3. The key distribution method based on differential instructions according to claim 1, characterized in that, In step 1, the process of calculating the number of key files to be obtained includes: For the key acquisition request, the key center calculates the number m of key files that need to be acquired, where the key acquisition request includes the size q of a single key file and the number of files n required by the user. m = (q × n) mod M; Where M is the size of the key file generated by the key pool of the key center.
4. The key distribution method based on differential instructions according to claim 3, characterized in that, The specific process of step 2 is as follows: The key center obtains a list of key files from the local key pool based on the number m of key files obtained through calculation. Based on the number n of files in the key acquisition request, it determines the splitting or combination relationship in the list of key files and generates differential instructions to distribute to the quantum security terminal. The determination of the splitting or combining relationship in the key file list means that when allocating a single key file, the corresponding splitting or combining relationship is recorded as a differential instruction for the single key file, without splitting or combining the content of the key file itself.
5. The key distribution method based on differential instructions according to claim 4, characterized in that, Each key file differential instruction includes the following fields: task file sequence number seq(), index number idx_no(), key file number src(), key offset src_offset(), and key length src_length(); The seq field indicates which key file in the instruction the key file is; the idx_no field indicates the sequence number of the subkey file in the key file in the instruction; the src field indicates which key file in the key pool the subkey file originates from; the src_offset field indicates the offset position in the specified key file from which to start reading; and the src_length field indicates the length of the key file being read.
6. The key distribution method based on differential instructions according to claim 4, characterized in that, The differential instruction includes splitting or combining key files; the method for determining whether to split or combine key files is to compare the size M of the key file generated by the key center with the size q of the single key file requested by the quantum security terminal. If M ≥ q, then the difference instruction is a split instruction; the split instruction includes: Based on the calculation in step 1, the number of key files to be obtained is m. Then, the key center takes out m key files from the local key pool, extracts n key single files of size q from them, fills in the fields of each key single file, obtains the corresponding number of commands, and updates the key file table. If M < q, then the differential instruction is a combination instruction; the combination instruction includes: Based on the calculation in step 1, the number of key files to be obtained is m. Then, the key center takes out m key files from the local key pool, combines them into n key single files of size q, fills in the fields of each key single file, obtains the corresponding number of commands, and updates the key file table.
7. The key distribution method based on differential instructions according to claim 6, characterized in that, Step 3 specifically includes: the quantum-safe terminal viewing the updated key file list, downloading the key single file from the key center to the local machine according to the fields of the key single file in the key file list, and combining or splitting all the downloaded key single files according to the differential instruction to generate the final target key file.
8. The key distribution method based on differential instructions according to claim 7, characterized in that, The specific process of downloading the single key file is as follows: download the corresponding key content from the key center according to the fields src(), src_offset(), and src_length() in the command, and then combine the key content downloaded by the command with the same task file number to form a single key file with the corresponding task file number.
9. An electronic device, characterized in that, include: Memory, used to store a set of instructions; as well as At least one processor is configured to execute the set of instructions to cause the electronic device to perform the method as described in any one of claims 1 to 8.
10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores a set of instructions for a computer, which, when executed, cause the computer to perform the method as described in any one of claims 1 to 8.