Data encryption method and device, channel authentication method and device, equipment and medium

Abstract

The invention discloses a data encryption method and device, a channel authentication method and device, equipment and a medium. The specific implementation scheme comprises the steps of determining to-be-transmitted data based on a client; constructing a quantum key encryption channel between the client and the server based on the quantum authentication identifier; and encrypting the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data. Data transmission between the client and the server is realized based on the quantum key encryption channel, end-to-end data communication is realized, the to-be-transmitted data is encrypted through the quantum key encryption algorithm corresponding to the quantum key encryption channel, the anti-interference capability of ciphertext data is improved, and the security during data transmission is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a data encryption and channel authentication method, device, equipment and medium. BACKGROUND

[0002] The current virtual network console authentication system takes the remote frame buffer protocol as the core, and builds four types of mainstream schemes to adapt to differentiated security requirements and application scenarios: local password authentication: an encrypted password is generated through a tool, and the early version has the security risk of transmitting unencrypted data. After improvement, a symmetric encryption algorithm is used to enhance the link security, but the static key storage mechanism still faces the risk of leakage, and is suitable for local area network environments with low security level. Tunnel encapsulation: the virtual network console is included in the encrypted channel by means of the network port forwarding mechanism, and the strong authentication mechanism thereof is reused, without the need to modify the protocol, but the network configuration complexity is increased, and it is suitable for access scenarios across security domains. Remote desktop protocol integration: relying on the operating system (Linux) display manager to realize system-level authentication, supporting enterprise-level permission management functions, but the protocol uses plaintext transmission, and needs to rely on a firewall or additional encryption measures, which is not secure in cross-segment scenarios. Transport Layer Security (TLS) / Secure Sockets Layer (SSL) two-way authentication: two-way verification and end-to-end encryption are realized through digital certificates, which has a high security level, but has the problems of complex certificate management and large computational overhead, and is suitable for high-sensitive data interaction scenarios.

[0003] The existing schemes have multiple defects in the design of security mechanisms, for example: limitation of encryption algorithm security: traditional encryption algorithms rely on mathematical security assumptions and face potential threats from new computing technologies, and some protocol designs have inherent defects such as plaintext transmission; lack of dynamic key management: generally relying on static keys or certificate systems, lacking a true random key generation and dynamic update mechanism based on the physical layer; insufficient ciphertext resistance to analysis: fixed encryption path, ciphertext features are vulnerable to statistical analysis attacks, and lack of dynamic confusion mechanisms to resist advanced cryptographic analysis techniques. As can be seen, the existing security mechanism design has the defects of poor security, insufficient ciphertext resistance to analysis and vulnerability to attacks. SUMMARY

[0004] The present application provides a data encryption and channel authentication method, device, equipment and medium, which encrypts data through a dynamically generated key, improving the security and anti-interference capability of the data transmission process.

[0005] According to an aspect of the present application, a data encryption method is provided, applied to a client in a data transmission local area network, the method comprising:

[0006] determining data to be transmitted;

[0007] construct a quantum key encryption channel between the client and the server based on a quantum authentication identifier, the quantum authentication identifier indicating whether to construct the quantum key encryption channel, the quantum key encryption channel including a channel authenticated by a quantum key;

[0008] encrypt the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, to obtain ciphertext data.

[0009] According to another aspect of the present application, a channel authentication method is provided, applied to a server in a data transmission local area network, and the method comprises:

[0010] obtaining a quantum authentication identifier and a first device identifier, the first device identifier including a unique identifier of the client;

[0011] when the quantum authentication identifier indicates to construct a quantum key encryption channel between the client and the server in the data transmission local area network, constructing a quantum key encryption channel between the client and the server based on the first device identifier, the quantum key encryption channel including a channel authenticated by a quantum key.

[0012] According to another aspect of the present application, a data encryption device is provided, applied to a client in a data transmission local area network, and the device comprises:

[0013] a determining module configured to determine to-be-transmitted data;

[0014] a first constructing module configured to construct a quantum key encryption channel between the client and the server based on a quantum authentication identifier, the quantum authentication identifier indicating whether to construct the quantum key encryption channel, the quantum key encryption channel including a channel authenticated by a quantum key.

[0015] an encrypting module configured to encrypt the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, to obtain ciphertext data.

[0016] According to another aspect of the present application, a channel authentication device is provided, applied to a server in a data transmission local area network, and the device comprises:

[0017] an obtaining module configured to obtain a quantum authentication identifier and a first device identifier, the first device identifier including a unique identifier of the client;

[0018] a second constructing module configured to, when the quantum authentication identifier indicates to construct a quantum key encryption channel between the client and the server in the data transmission local area network, construct a quantum key encryption channel between the client and the server based on the first device identifier, the quantum key encryption channel including a channel authenticated by a quantum key.

[0019] According to another aspect of the present application, there is provided an electronic device comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein

[0022] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the data encryption method or the channel authentication method according to any one of the embodiments of the present application.

[0023] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for enabling a processor to implement the data encryption method or the channel authentication method according to any one of the embodiments of the present application when executed by the processor.

[0024] The technical solution of the embodiments of the present application determines the to-be-transmitted data based on a client; constructs a quantum key encryption channel between the client and a server based on a quantum authentication identifier; and encrypts the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data. The data transmission between the client and the server is realized based on the quantum key encryption channel, end-to-end data communication is realized, the to-be-transmitted data is encrypted through the quantum key encryption algorithm corresponding to the quantum key encryption channel, the anti-interference capability of the ciphertext data is improved, and the security of data transmission is ensured.

[0025] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0027] Figure 1 is a flowchart of a data encryption method according to the first embodiment of the present application;

[0028] Figure 2 is a flowchart of a ciphertext data generation method according to the first embodiment of the present application;

[0029] Figure 3is a schematic diagram of a third quantum key acquisition method according to an embodiment of the present application;

[0030] Figure 4 is a flow chart of a client-side quantum key encrypted channel construction method according to an embodiment of the present application;

[0031] Figure 5 is a schematic diagram of a verification stage according to an embodiment of the present application;

[0032] Figure 6 is a flow chart of a channel authentication method according to an embodiment of the present application;

[0033] Figure 7 is a flow chart of a server-side quantum key encrypted channel construction method according to an embodiment of the present application;

[0034] Figure 8 is a structural schematic diagram of a data encryption device according to an embodiment of the present application;

[0035] Figure 9 is a structural schematic diagram of a channel authentication device according to an embodiment of the present application;

[0036] Figure 10 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the personnel in the art better understand the present application scheme, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0038] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0039] Embodiment One

[0040] Figure 1 is a flowchart of a data encryption method according to Embodiment One of the present application. This embodiment can be applied to the case of encrypting data to be transmitted. The method can be executed by a data encryption device, which can be implemented in the form of hardware and / or software. The data encryption device can be configured in an electronic device, which can carry a client in a data transmission local area network. As shown in Figure 1 the method comprises:

[0041] S110, determining data to be transmitted.

[0042] In this embodiment, the data to be transmitted can be understood as data initiated by a client in a data transmission local area network and needed to be transmitted to a server in the data transmission local area network.

[0043] Specifically, the data transmission local area network can include two local area networks at different locations. The client is deployed in one local area network, and the server is deployed in the other local area network. After the client and the server establish a trust relationship and complete key synchronization, the client can transmit the data to be transmitted to the server.

[0044] S120, based on a quantum authentication identifier, constructing a quantum key encryption channel between the client and the server.

[0045] The quantum authentication identifier indicates whether to construct the quantum key encryption channel. The quantum key encryption channel includes a channel authenticated by a quantum key.

[0046] In this embodiment, the quantum authentication identifier can be understood as an identifier for determining whether to construct a quantum key encryption channel between the client and the server. The quantum key encryption channel can be understood as a channel for communication and data transmission between the client and the server. The quantum key encryption channel is a channel that is verified by both the client and the server.

[0047] Specifically, based on the quantum authentication identifier, it is determined whether the client can initiate the construction operation of the quantum key encryption channel. The construction operation of the quantum key encryption channel can be initiated by the client when the quantum authentication identifier is a first set value, so as to trigger the construction of the quantum key encryption channel. When constructing the quantum key encryption channel, the identity of both parties of the quantum key encryption channel is verified first. If both are authenticated, the channel construction operation is performed. For example, the client can be verified first, and then the server can be verified after the verification is passed. The quantum authentication identifier can be sent to the server. If the server also agrees to construct the quantum key encryption channel, the quantum key encryption channel between the client and the server is constructed.

[0048] For example, the quantum authentication identifier can be a field of the client, and when the quantum authentication identifier is a first set value 0x01, the client initiates a construction operation of the quantum key encryption channel, and triggers construction of the quantum key channel.

[0049] In S130, the to-be-transmitted data is encrypted according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, and ciphertext data is obtained.

[0050] In this embodiment, the quantum key encryption algorithm can be understood as an algorithm contained in the quantum key encryption channel, and the quantum key encryption algorithm is an encryption algorithm for the to-be-transmitted data when the to-be-transmitted data is transmitted between the client and the server.

[0051] Specifically, the quantum key encryption algorithm corresponding to the quantum key encryption channel is determined, and the quantum key encryption algorithm can encrypt the to-be-transmitted data multiple times to obtain the ciphertext data. The multiple encryption can be implemented by using a quantum key obtained randomly.

[0052] The technical scheme of the embodiment of the application includes the following steps: determining to-be-transmitted data; constructing a quantum key encryption channel between a client and a server based on a quantum authentication identifier; and encrypting the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, to obtain ciphertext data. The quantum key encryption channel is constructed based on the quantum authentication identifier, end-to-end data communication is realized, the to-be-transmitted data is encrypted by using the quantum key encryption algorithm corresponding to the quantum key encryption channel, dynamic generation of the key for encrypting the to-be-transmitted data is realized, the anti-interference ability of the ciphertext data is improved, and the security of data transmission is ensured.

[0053] On the basis of the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that, in order to make the description brief, only the differences from the above embodiment are described in the variant embodiment.

[0054] In one embodiment, the step of encrypting the to-be-transmitted data according to the quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data includes the following steps:

[0055] The quantum key encryption channel corresponding to a quantum mask sequence and an encryption order corresponding to the quantum mask sequence are determined, the quantum mask sequence is composed of at least one quantum mask, the encryption order includes an arrangement order of each quantum mask in the quantum mask sequence, the quantum mask indicates an encryption direction when the to-be-transmitted data is encrypted, and the encryption direction includes forward encryption and reverse encryption.

[0056] For each quantum mask, a third quantum key corresponding to the quantum mask is determined.

[0057] According to the encryption order, the data to be transmitted is encrypted by the third quantum key corresponding to each quantum mask in the quantum mask sequence in turn, and ciphertext data is obtained.

[0058] In this embodiment, the quantum mask sequence can be understood as a sequence composed of multiple quantum masks, and the quantum mask sequence can be composed of random numbers. The quantum mask can be used to indicate the encryption direction when encrypted using the quantum key encryption algorithm. The encryption order can be understood as the order when the data to be transmitted is encrypted multiple times. The encryption direction can be understood as the direction when the data to be transmitted is encrypted, which can include forward encryption and reverse encryption. The forward encryption can be the encryption of the data to be transmitted, and the reverse encryption can be the decryption of the data to be transmitted. The third quantum key can be understood as the quantum key corresponding to the quantum mask. For each quantum mask, a third quantum key can be randomly obtained to encrypt the data to be transmitted.

[0059] Specifically, first, the quantum mask sequence corresponding to the quantum key encryption channel is determined, and the arrangement order of each quantum mask in the quantum mask sequence is taken as the encryption order. For each quantum mask, a third quantum key corresponding to the quantum mask can be randomly applied from the quantum key management platform. According to the encryption order, the data to be transmitted is encrypted by the third quantum key corresponding to each quantum mask in the quantum mask sequence in turn, and ciphertext data is obtained. The quantum key management platform can be a platform for managing quantum keys, and the quantum key management platform can be used to issue quantum keys to the client and the server.

[0060] Exemplarily, Figure 2 is a flowchart of a ciphertext data generation method according to an embodiment of the present application. As Figure 2 shown, assuming that the first quantum mask in the quantum mask sequence indicates the forward encryption direction, and the second quantum mask indicates the reverse encryption direction. The first third quantum key (K1) can be used for forward encryption to generate intermediate ciphertext C1, then the second third quantum key (K2) is used for reverse encryption to obtain intermediate ciphertext C2, and so on, finally, the nth third quantum key (K n ) is used for encryption to form ciphertext data.

[0061] Optionally, the third quantum key corresponding to each quantum mask is determined, including:

[0062] The session key acquisition situation transmitted by the server is received, and the session key acquisition situation indicates whether the client acquires the session key, and the session key is distributed by the quantum key management platform.

[0063] In a case that the session key acquisition condition is successful, a quantum key request is initiated for each quantum mask, the quantum key request including a request initiated by the client to the quantum key management platform based on the session key;

[0064] A third quantum key transmitted by the quantum key management platform is acquired, and the third quantum key is taken as a third quantum key corresponding to the quantum mask, the third quantum key being requested by the quantum key management platform from a quantum key device, the quantum key device being used to store quantum keys.

[0065] In the embodiment, the session key acquisition condition can be understood as a condition indicating whether the client acquires the session key, and can identify whether the client and the server complete key synchronization. The session key can be understood as interaction information between the client and the quantum key management platform. The quantum key request can be understood as a request for requesting the quantum key from the quantum key management platform, and can indicate that the quantum key management platform applies for the quantum key from the quantum key device. The quantum key device can be understood as a device used to store the quantum key, and can include devices corresponding to the client and the server respectively.

[0066] Specifically, the client and the server can first complete registration with the quantum key management platform to establish an initial trust relationship. Then, the client sends a session key to the quantum key management platform and synchronizes the session key to the server, and then receives a session key acquisition condition transmitted by the server. In a case that the session key acquisition condition is successful, a quantum key request is initiated for each quantum mask to obtain a third quantum key.

[0067] Exemplarily, Figure 3 is a schematic diagram of a third quantum key acquisition method according to an embodiment of the application. As shown in Figure 3 For each quantum mask, a quantum key request is initiated by the client to the quantum key management platform. The quantum key management platform uses the public key C corresponding to the client to encrypt the third quantum key distributed by the quantum key management platform and sends the encrypted third quantum key to the client. The third quantum key distributed by the quantum key management platform can be requested by the quantum key management platform from a quantum key device, i.e., QKD-A and QKD-B, and the quantum key device can push the third quantum key directly to the server to complete key synchronization of the client and the server.

[0068] Embodiment Two

[0069] Figure 4 is a flowchart of a quantum key encryption channel construction method of a client according to an embodiment of the application, and the embodiment is developed for the construction operation of the quantum key encryption channel in the above embodiment. As shown inFigure 4 The method comprises:

[0070] S210, determining to-be-transmitted data.

[0071] S220, in a case where the quantum authentication identifier is a first set value, transmitting the quantum authentication identifier and a first device identifier to the server.

[0072] The first device identifier comprises a unique identifier of the client;

[0073] In this embodiment, the first device identifier can be understood as a unique identifier for identifying the client, and the first device identifier can be distributed by a quantum key management platform.

[0074] Specifically, in a case where the quantum authentication identifier is the first set value, i.e., the client initiates a request for building a quantum key encrypted channel, the quantum authentication identifier and the first device identifier need to be transmitted to the server, so that the server also agrees to build the quantum key encrypted channel.

[0075] S230, obtaining first to-be-verified information transmitted by the server, and verifying the first to-be-verified information to obtain a client verification result.

[0076] The client verification result indicates whether the client agrees to build the quantum key encrypted channel, and the first to-be-verified information is information determined based on the quantum authentication identifier and the first device identifier.

[0077] In this embodiment, the first to-be-verified information can be understood as information used by the client to verify whether to agree to build the quantum key encrypted channel. The client verification result can be understood as a result for indicating whether the client agrees to build the quantum key encrypted channel.

[0078] Specifically, after the client and the server both agree to initiate a building operation of the quantum key encrypted channel, the client can receive first to-be-verified information transmitted by the server, and the first device identifier transmitted by the client to the server can be included in the first to-be-verified information. Then, the client verifies the first to-be-verified information, verifies whether the identity of the server sending the first to-be-verified information to the client is a server that needs to build the quantum key encrypted channel with the client, and obtains a client verification result.

[0079] Optionally, the verifying the first to-be-verified information to obtain the client verification result comprises:

[0080] Obtaining a first quantum key, the first quantum key comprising a quantum key stored in the client;

[0081] obtain a quantum hash check value, a first device hash check value and a second quantum key hash check value in the first to-be-verified information;

[0082] check the quantum hash check value, the first device hash check value and the second quantum key hash check value using the first quantum key to obtain a client check result;

[0083] The quantum hash check value includes a hash value corresponding to a quantum random challenge value, the quantum random challenge value is generated by the second quantum key, the second quantum key includes a quantum key stored in the server, the first device hash check value includes a hash value corresponding to the first device identifier, and the second quantum key hash check value includes a hash value corresponding to the second quantum key.

[0084] In the embodiment, the first quantum key can be understood as a quantum key distributed to the client by a quantum key management platform. The second quantum key can be understood as a quantum key distributed to the server by the quantum key management platform. The quantum hash check value can be understood as an encrypted form of a quantum random challenge value. The quantum random challenge value can be understood as a random value generated based on the second quantum key. The first device hash check value can be understood as an encrypted form of the first device identifier. The second quantum key hash check value can be understood as an encrypted form of the second quantum key.

[0085] Specifically, the first quantum key distributed to the client by the quantum key management platform is obtained. Then, the first to-be-verified information transmitted by the server is received, and the first to-be-verified information includes the quantum hash check value, the first device hash check value and the second quantum key hash check value. The quantum hash check value, the first device hash check value and the second quantum key hash check value can be obtained by encrypting the quantum random challenge value, the first device identifier and the second quantum key by using a national secret algorithm. Finally, the quantum hash check value, the first device hash check value and the second quantum key hash check value in the first to-be-verified information are checked using the first quantum key to obtain the client check result.

[0086] S240, in the case that the client check result is a check pass, the second to-be-verified information is transmitted to the server, and the server check result transmitted by the server is received.

[0087] The server check result indicates whether the server agrees to build the quantum key encryption channel, and the server check result is a result obtained by checking the second to-be-verified information.

[0088] In the embodiment, the second to-be-verified information can be understood as information used by the server to verify whether to agree to build the quantum key encryption channel. The server check result can be understood as a result used to indicate whether the server agrees to build the quantum key encryption channel.

[0089] Specifically, in the case that the client check result is a check failure, the connection with the server is disconnected. In the case that the client check result is a check success, it indicates that the client considers that the server is a server that needs to build a quantum key encryption channel. The second to-be-verified information is transmitted to the server, and a server check result is obtained by the server by checking the second to-be-verified information. Finally, the client receives the server check result transmitted by the server.

[0090] Optionally, the transmitting the second to-be-verified information to the server and receiving the server check result transmitted by the server comprises:

[0091] determining a first quantum key hash check value corresponding to the first quantum key;

[0092] generating a reverse random challenge value based on the first quantum key, and generating a reverse hash check value corresponding to the reverse random challenge value;

[0093] transmitting the second to-be-verified information to the server, the second to-be-verified information comprising a second device hash check value, the reverse hash check value and the first quantum key hash check value, the second device hash check value comprising a hash value corresponding to a second device identifier, the second device identifier comprising a unique identifier of the server;

[0094] receiving the server check result transmitted by the server, the server check result comprising a result obtained by the server after checking the second to-be-verified information.

[0095] In the embodiment, the reverse random challenge value can be understood as a random value generated based on the first quantum key. The reverse hash check value can be understood as an encrypted form of the reverse random challenge value. The second device hash check value can be understood as an encrypted form of the second device identifier. The second device identifier can be understood as a unique identifier used to identify the server, and the second device identifier can be distributed by a quantum key management platform.

[0096] Specifically, a first quantum key distributed by a quantum key management platform to a client is acquired, and a reverse random challenge value is generated based on the first quantum key. The first quantum key is encrypted by a national secret algorithm to obtain a first quantum key hash check value, and the reverse random challenge value is encrypted to obtain a reverse hash check value. The second device hash check value corresponding to the second device identifier is combined with the reverse random challenge value and the first quantum key hash check value to obtain second to-be-verified information. The second to-be-verified information is verified by the server using the second quantum key to obtain a server verification result, and the server verification result is sent to the client.

[0097] S250, in the case where the server verification result is a verification pass, a quantum key encryption channel is constructed.

[0098] Specifically, in the case where the server verification result is a verification fail, the server disconnects the connection with the client. In the case where the server verification result is a verification pass, it is considered by the server that the client is a client that needs to construct a quantum key encryption channel. At this time, the client and the server complete the verification, and the quantum key encryption channel between the client and the server can be constructed.

[0099] Exemplarily, the server verification result can be described using a field, for example, field 0x00 indicates a verification pass, and other fields can indicate a reason code of a verification fail.

[0100] Exemplarily, Figure 5 is a schematic diagram of a verification stage according to Embodiment Two of the present application. As shown in Figure 5 The quantum authentication identifier and the first device identifier are transmitted by the client to the server, the first to-be-verified information is generated by the server and transmitted to the client, then the first to-be-verified information is verified by the client to obtain a client verification result. In the case where the client verification result is a verification pass, the second to-be-verified information is transmitted by the client to the server, the second to-be-verified information is verified by the server to obtain a server verification result. In the case where the server verification result is a verification pass, the server verification result is sent by the server to the client. After the client receives the server verification result transmitted by the server, a quantum key encryption channel is constructed.

[0101] S260, according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, the to-be-transmitted data is encrypted to obtain ciphertext data.

[0102] The technical scheme of the embodiment of the present application, in the case that the quantum authentication identifier is a first set value, transmits the quantum authentication identifier and a first device identifier to the server; acquires first to-be-verified information transmitted by the server, and verifies the first to-be-verified information to obtain a client verification result; in the case that the client verification result is a verification pass, transmits second to-be-verified information to the server, and receives a server verification result transmitted by the server; in the case that the server verification result is a verification pass, constructs a quantum key encryption channel. The construction of the quantum key encryption channel is initiated by the client based on the quantum authentication identifier, and the construction of the quantum key encryption channel or not is verified through the first to-be-verified information and the second to-be-verified information, thereby improving the security of the quantum key encryption channel and realizing end-to-end data communication.

[0103] Embodiment three

[0104] Figure 6 is a flowchart of a channel authentication method according to the third embodiment of the present application. The present embodiment can be applied to the case of authenticating a quantum key encryption channel. The method can be executed by a channel authentication device, which can be realized in the form of hardware and / or software. The channel authentication device can be configured in an electronic device, and the electronic device can carry a server in a data transmission local area network. As shown in Figure 6 , the method comprises:

[0105] S310, acquiring a quantum authentication identifier and a first device identifier.

[0106] The first device identifier comprises a unique identifier of the client.

[0107] In the present embodiment, the quantum authentication identifier can be understood as an identifier for judging whether to construct a quantum key encryption channel between the client and the server. The first device identifier can be understood as a unique identifier for identifying the client, and the first device identifier can be distributed by a quantum key management platform.

[0108] Specifically, the quantum authentication identifier and the first device identifier sent by the client are received. In the case that the quantum authentication identifier is a first set value, it indicates that the server also agrees to construct a quantum key encryption channel.

[0109] S320, in the case that the quantum authentication identifier indicates to construct a quantum key encryption channel with the client, constructing a quantum key encryption channel with the client based on the first device identifier.

[0110] The quantum key encryption channel comprises a channel authenticated by a quantum key.

[0111] In the embodiment, the quantum key encryption channel can be understood as a channel for communication and data transmission between the client and the server, and the quantum key encryption channel is a channel that is verified by both the client and the server.

[0112] Specifically, in the case that the quantum authentication identifier is the first set value, the quantum key encryption channel between the client is constructed. The first device identifier can be verified, and the quantum key encryption channel can be constructed after the verification.

[0113] The technical scheme of the embodiment of the application acquires a quantum authentication identifier and a first device identifier; in the case that the quantum authentication identifier indicates that a quantum key encryption channel between the client is constructed, the quantum key encryption channel between the client is constructed based on the first device identifier. The quantum key encryption channel is constructed based on the quantum authentication identifier, the data transmission between the client and the server is realized through the quantum key encryption channel, and the end-to-end data communication is completed.

[0114] Embodiment Four

[0115] Figure 7 It is a flowchart of a quantum key encryption channel construction method of a server according to the embodiment four of the application, and the embodiment is developed for the construction operation of the quantum key encryption channel in the above-mentioned embodiments. As shown in the figure, the method comprises the following steps. Figure 7

[0116] S410, acquiring a quantum authentication identifier and a first device identifier.

[0117] S420, in the case that the quantum authentication identifier indicates that a quantum key encryption channel between the client is constructed, performing S421-S425.

[0118] S421, encrypting the first device identifier, a quantum random challenge value and a second quantum key to obtain first to-be-verified information.

[0119] The first to-be-verified information comprises a first device hash check value, a quantum hash check value and a second quantum key hash check value.

[0120] In the embodiment, the first to-be-verified information can be understood as information used by the client to verify whether to agree to construct the quantum key encryption channel. The quantum random challenge value can be understood as a value generated based on the second quantum key, and a random value can be selected as the quantum random challenge value. The second quantum key can be understood as a quantum key distributed to the server by a quantum key management platform.

[0121] ​Specifically, the quantum random challenge value is generated based on the second quantum key, the first device identifier, the quantum random challenge value and the second quantum key are encrypted by using the national secret algorithm, and the first device hash check value, the quantum hash check value and the second quantum key hash check value are obtained. The first device hash check value, the quantum hash check value and the second quantum key hash check value are used as the first to-be-verified information.

[0122] S422, transmitting the first to-be-verified information to the client.

[0123] Specifically, the obtained first to-be-verified information is transmitted to the client, and the client can verify the first to-be-verified information by using the first quantum key stored in the client.

[0124] S423, obtaining second to-be-verified information transmitted by the client.

[0125] In the embodiment, the second to-be-verified information can be understood as information used by the server to verify whether to agree to build the quantum key encryption channel.

[0126] Specifically, in the case that the verification of the first to-be-verified information by the client is passed, the second to-be-verified information transmitted by the client is received. The second to-be-verified information includes the second device hash check value, the reverse hash check value and the first quantum key hash check value. The second device hash check value, the reverse hash check value and the first quantum key hash check value are obtained by respectively encrypting the second device identifier, the reverse random challenge value and the first quantum key by using the national secret algorithm in the client.

[0127] S424, verifying the second to-be-verified information by using the second quantum key to obtain a server verification result.

[0128] The server verification result indicates whether the server agrees to build the quantum key encryption channel.

[0129] In the embodiment, the server verification result can be understood as a result used to indicate whether the server agrees to build the quantum key encryption channel.

[0130] Specifically, the second device hash check value, the reverse hash check value and the first quantum key hash check value in the second to-be-verified information are verified by using the second quantum key to obtain the server verification result.

[0131] S425, in the case that the server verification result is passed, transmitting the server verification result to the client to trigger the client to build the quantum key encryption channel.

[0132] Specifically, in a case that the service end check result is a check failure, the service end disconnects the connection with the client. In a case that the service end check result is a check success, it is considered by the service end that the client is a client which needs to build a quantum key encryption channel, and the service end check result can be sent to the client. At this time, the client and the service end complete the check, and the quantum key encryption channel between the client and the service end can be built.

[0133] The technical scheme of the embodiment of the application encrypts the first device identifier, the quantum random challenge value and the second quantum key to obtain first to-be-verified information, transmits the first to-be-verified information to the client, acquires second to-be-verified information transmitted by the client, checks the second to-be-verified information using the second quantum key to obtain a service end check result, and transmits the service end check result to the client in a case that the service end check result is a check success to trigger the client to build a quantum key encryption channel. The service end responds to the building of the quantum key encryption channel initiated by the client based on the quantum authentication identifier, and checks whether the quantum key encryption channel is built or not through the first to-be-verified information and the second to-be-verified information, thereby improving the security of the quantum key encryption channel and realizing end-to-end data communication.

[0134] Embodiment five

[0135] Figure 8 is a structural schematic diagram of a data encryption device provided by the embodiment three of the application. As shown in the figure, the device comprises: Figure 8

[0136] A determination module 510 is configured to determine to-be-transmitted data.

[0137] A first construction module 520 is configured to build a quantum key encryption channel between the client and the service end based on a quantum authentication identifier, the quantum authentication identifier indicating whether to build the quantum key encryption channel, and the quantum key encryption channel comprising a channel authenticated by a quantum key.

[0138] An encryption module 530 is configured to encrypt the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data.

[0139] ​The data encryption device provided by the embodiment of the application determines the to-be-transmitted data through a determination module; a first construction module constructs a quantum key encryption channel between a client and a server based on a quantum authentication identifier; and an encryption module encrypts the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data. Through mutual cooperation between the modules, the quantum key encryption channel is constructed based on the quantum authentication identifier, end-to-end data communication is realized, the to-be-transmitted data is encrypted through the quantum key encryption algorithm corresponding to the quantum key encryption channel, the encryption of the to-be-transmitted data using a dynamically generated key is realized, the anti-interference capability of the ciphertext data is improved, and the security during data transmission is ensured.

[0140] In one embodiment, the first construction module 520 includes:

[0141] The transmission unit is configured to, in a case where the quantum authentication identifier is a first set value, transmit the quantum authentication identifier and a first device identifier to the server, the first device identifier including a unique identifier of the client.

[0142] The acquisition unit is configured to acquire first to-be-verified information transmitted by the server and verify the first to-be-verified information to obtain a client verification result, the client verification result indicating whether the client agrees to construct the quantum key encryption channel, the first to-be-verified information being information determined based on the quantum authentication identifier and the first device identifier.

[0143] The receiving unit is configured to, in a case where the client verification result is verified, transmit second to-be-verified information to the server and receive a server verification result transmitted by the server, the server verification result indicating whether the server agrees to construct the quantum key encryption channel, the server verification result being a result obtained after the second to-be-verified information is verified.

[0144] The construction unit is configured to, in a case where the server verification result is verified, construct a quantum key encryption channel.

[0145] In one embodiment, the acquisition unit is specifically configured to:

[0146] Acquire a first quantum key, the first quantum key including a quantum key stored in the client.

[0147] Acquire a quantum hash check value, a first device hash check value, and a second quantum key hash check value in the first to-be-verified information.

[0148] check the quantum hash check value, the first device hash check value and the second quantum key hash check value using the first quantum key to obtain a client check result;

[0149] The quantum hash check value includes a hash value corresponding to a quantum random challenge value, the quantum random challenge value is generated by the second quantum key, the second quantum key includes a quantum key stored in the server, the first device hash check value includes a hash value corresponding to the first device identifier, and the second quantum key hash check value includes a hash value corresponding to the second quantum key.

[0150] In an embodiment, the receiving unit is specifically configured to:

[0151] determine a first quantum key hash check value corresponding to the first quantum key;

[0152] generate a reverse random challenge value based on the first quantum key, and generate a reverse hash check value corresponding to the reverse random challenge value;

[0153] transmit second to-be-verified information to the server, the second to-be-verified information including a second device hash check value, the reverse hash check value and the first quantum key hash check value, the second device hash check value including a hash value corresponding to a second device identifier, and the second device identifier including a unique identifier of the server;

[0154] receive a server check result transmitted by the server, the server check result including a result obtained by the server after checking the second to-be-verified information.

[0155] In an embodiment, the encryption module 530 includes:

[0156] The first determining unit is configured to determine a quantum mask sequence corresponding to the quantum key encryption channel and an encryption order corresponding to the quantum mask sequence, the quantum mask sequence being composed of at least one quantum mask, the encryption order including an arrangement order of the quantum masks in the quantum mask sequence, and the quantum mask indicating an encryption direction when the to-be-transmitted data is encrypted, the encryption direction including forward encryption and reverse encryption.

[0157] The second determining unit is configured to determine, for each quantum mask, a third quantum key corresponding to the quantum mask.

[0158] The encryption unit is configured to sequentially encrypt the to-be-transmitted data through the third quantum keys corresponding to the quantum masks in the quantum mask sequence according to the encryption order to obtain ciphertext data.

[0159] In an embodiment, the second determining unit is specifically configured to:

[0160] receiving a session key acquisition condition transmitted by the server, the session key acquisition condition indicating whether the client acquires a session key, the session key being distributed by a quantum key management platform;

[0161] in a case where the session key acquisition condition is successful acquisition, initiating a quantum key request for each quantum mask, the quantum key request including a request initiated by the quantum key management platform based on the session key;

[0162] acquiring a third quantum key transmitted by the quantum key management platform, and taking the third quantum key as a third quantum key corresponding to the quantum mask, the third quantum key being requested by the quantum key management platform from a quantum key device for storing quantum keys.

[0163] The data encryption device provided by the embodiment of the application can execute the data encryption method provided by any embodiment of the application, and through mutual cooperation and collaborative work between the modules, the encryption of data is completed, and the corresponding functional modules and beneficial effects of the execution method are possessed.

[0164] Embodiment six

[0165] Figure 9 is a structural schematic diagram of a channel authentication device provided by the embodiment three of the application. As shown in the figure, Figure 9 the device includes:

[0166] The acquisition module 610 is configured to acquire a quantum authentication identifier and a first device identifier, and the first device identifier includes a unique identifier of the client.

[0167] The second construction module 620 is configured to, when the quantum authentication identifier indicates that a quantum key encryption channel between the client is to be constructed, construct a quantum key encryption channel between the client based on the first device identifier, and the quantum key encryption channel includes a channel authenticated by a quantum key.

[0168] The channel authentication device provided by the embodiment of the application acquires a quantum authentication identifier and a first device identifier through the acquisition module; and when the quantum authentication identifier indicates that a quantum key encryption channel between the client is to be constructed, constructs a quantum key encryption channel between the client based on the first device identifier through the second construction module. Through mutual cooperation between the modules, the quantum key encryption channel is constructed based on the quantum authentication identifier, the data transmission between the client and the server is realized through the quantum key encryption channel, and the end-to-end data communication is completed.

[0169] In one embodiment, the second construction module 620 is specifically configured to:

[0170] encrypt the first device identity, the quantum random challenge value and the second quantum key to obtain first to-be-verified information, the first to-be-verified information including a first device hash check value, a quantum hash check value and a second quantum key hash check value;

[0171] transmit the first to-be-verified information to the client;

[0172] obtain second to-be-verified information transmitted by the client;

[0173] verify the second to-be-verified information using the second quantum key to obtain a server verification result, the server verification result indicating whether the server agrees to construct the quantum key encryption channel;

[0174] in a case where the server verification result is a verification pass, transmit the server verification result to the client to trigger the client to construct a quantum key encryption channel.

[0175] The channel authentication apparatus provided in the embodiments of the present application can perform the channel authentication method provided in any of the embodiments of the present application, and through mutual cooperation and collaborative work between the modules, the authentication of the channel is completed, and the corresponding function modules and beneficial effects of the execution method are possessed.

[0176] Embodiment seven

[0177] According to the embodiments of the present application, the present application further provides an electronic device and a computer readable storage medium.

[0178] Figure 10 is a block diagram of an electronic device provided according to the fourth embodiment of the present application, and the electronic device can implement the data encryption method or the channel authentication method described in the embodiments of the present application. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0179] As Figure 10As shown, the electronic device 410 includes at least one processor 411, and a memory, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., connected to the at least one processor 411 in communication. The memory stores computer programs executable by the at least one processor 411, and the processor 411 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 412 or loaded from the storage unit 418 into the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other through a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0180] Various components in the electronic device are connected to the I / O interface 415, including an input unit 416, such as a keyboard, a mouse, etc., an output unit 417, such as various types of displays, a speaker, etc., a storage unit 418, such as a magnetic disk, an optical disk, etc., and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0181] The processor 411 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 411 performs various methods and processes described above, such as a data encryption method or a channel authentication method.

[0182] In some embodiments, the data encryption method or the channel authentication method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the data encryption method or the channel authentication method described above can be performed. Alternatively, in other embodiments, the processor 411 can be configured to perform the data encryption method or the channel authentication method by any other appropriate means, such as by means of firmware.

[0183] The various embodiments of the systems and techniques described above can be implemented in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a load programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0184] Computer programs used to implement the processes of the application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, can cause instructions defined in the flow charts and / or block diagrams to be implemented on the computer or other programmable apparatus. The computer programs can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0185] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store computer programs for use by or in connection with an instruction execution system, apparatus, or device. Computer-readable storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0186] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0187] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0188] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0189] The technical scheme of the embodiment of the application is a data encryption and channel authentication method, device, equipment and medium. The method determines to-be-transmitted data based on a client; constructs a quantum key encryption channel between the client and a server based on a quantum authentication identifier; and encrypts the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data. The data transmission between the client and the server is realized based on the quantum key encryption channel, end-to-end data communication is realized, the to-be-transmitted data is encrypted through the quantum key encryption algorithm corresponding to the quantum key encryption channel, the anti-interference capability of the ciphertext data is improved, and the security of data transmission is ensured.

[0190] It should be understood that the various forms of flow shown above can be used to reorder, add, or remove steps. For example, the steps recited in the present application can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which are not limited herein.

[0191] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A data encryption method characterized by, The method is applied to a client in a data transmission local area network, and comprises the following steps: determining to-be-transmitted data; based on a quantum authentication identifier, constructing a quantum key encryption channel between the client and a server, the quantum authentication identifier indicating whether to construct the quantum key encryption channel, the quantum key encryption channel including a channel authenticated by a quantum key; according to a quantum key encryption algorithm corresponding to the quantum key encryption channel, encrypting the to-be-transmitted data to obtain ciphertext data.

2. The method of claim 1, wherein, The method comprises the following steps: in a case where the quantum authentication identifier is a first set value, transmitting the quantum authentication identifier and a first device identifier to the server, the first device identifier including a unique identifier of the client; obtaining first to-be-verified information transmitted by the server and verifying the first to-be-verified information to obtain a client verification result, the client verification result indicating whether the client agrees to construct the quantum key encryption channel, the first to-be-verified information being information determined based on the quantum authentication identifier and the first device identifier; in a case where the client verification result is verified, transmitting second to-be-verified information to the server and receiving a server verification result transmitted by the server, the server verification result indicating whether the server agrees to construct the quantum key encryption channel, the server verification result being a result obtained after the second to-be-verified information is verified; in a case where the server verification result is verified, constructing the quantum key encryption channel.

3. The method of claim 2, wherein, The method comprises the following steps: obtaining a first quantum key, the first quantum key including a quantum key stored in the client; obtaining a quantum hash check value, a first device hash check value and a second quantum key hash check value in the first to-be-verified information; verifying the quantum hash check value, the first device hash check value and the second quantum key hash check value using the first quantum key to obtain a client verification result; wherein the quantum hash check value includes a hash value corresponding to a quantum random challenge value, the quantum random challenge value being generated by a second quantum key, the second quantum key including a quantum key stored in the server, the first device hash check value including a hash value corresponding to the first device identifier, and the second quantum key hash check value including a hash value corresponding to the second quantum key.

4. The method of claim 2, wherein, The method comprises the following steps: determining a first quantum key hash check value corresponding to the first quantum key; generating a reverse random challenge value based on the first quantum key and generating a reverse hash check value corresponding to the reverse random challenge value; transmit second to-be-verified information to the server, the second to-be-verified information including a second device hash check value, the reverse hash check value, and the first quantum key hash check value, the second device hash check value including a hash value corresponding to a second device identifier, and the second device identifier including a unique identifier of the server; receive a server check result transmitted by the server, the server check result including a result obtained by the server after checking the second to-be-verified information.

5. The method of claim 1, wherein, The method includes the following steps: determining a quantum mask sequence corresponding to the quantum key encryption channel and an encryption order corresponding to the quantum mask sequence, the quantum mask sequence being composed of at least one quantum mask, and the encryption order including an arrangement order of the quantum masks in the quantum mask sequence, the quantum mask indicating an encryption direction when the to-be-transmitted data is encrypted, and the encryption direction including forward encryption and reverse encryption; for each quantum mask, determining a third quantum key corresponding to the quantum mask; encrypting the to-be-transmitted data by using the third quantum key corresponding to each quantum mask in the quantum mask sequence in sequence according to the encryption order to obtain ciphertext data.

6. The method of claim 5, wherein, The method includes the following steps: receiving session key acquisition information transmitted by the server, the session key acquisition information indicating whether the client acquires a session key, and the session key being distributed by a quantum key management platform; in a case where the session key acquisition information indicates that the acquisition is successful, initiating a quantum key request for each quantum mask, the quantum key request including a request initiated by the client to the quantum key management platform based on the session key; acquiring a third quantum key transmitted by the quantum key management platform, and taking the third quantum key as the third quantum key corresponding to the quantum mask, the third quantum key being requested by the quantum key management platform from a quantum key device, and the quantum key device being used to store quantum keys.

7. A method of passageway authentication, characterized by, The method includes the following steps: acquiring a quantum authentication identifier and a first device identifier, the first device identifier including a unique identifier of the client; when the quantum authentication identifier indicates that a quantum key encryption channel between the client is to be established, establishing the quantum key encryption channel between the client based on the first device identifier, the quantum key encryption channel including a channel authenticated by a quantum key.

8. The method of claim 7, wherein, The method includes the following steps: encrypting the first device identifier, a quantum random challenge value, and a second quantum key to obtain first to-be-verified information, the first to-be-verified information including a first device hash check value, a quantum hash check value, and a second quantum key hash check value; transmitting the first to-be-verified information to the client; acquire second to be verified information transmitted by the client; verify the second to be verified information using the second quantum key to obtain a server verification result, the server verification result indicating whether the server agrees to build the quantum key encryption channel; in the case that the server verification result is a verification pass, transmit the server verification result to the client to trigger the client to build a quantum key encryption channel.

9. A data encryption device, characterized by comprising: A client applied to a data transmission local area network comprises: a determination module configured to determine to-be-transmitted data; a first building module configured to build a quantum key encryption channel between the client and a server based on a quantum authentication identifier, the quantum authentication identifier indicating whether to build the quantum key encryption channel, and the quantum key encryption channel comprising a channel authenticated by a quantum key; an encryption module configured to encrypt the to-be-transmitted data according to a quantum key encryption algorithm corresponding to the quantum key encryption channel to obtain ciphertext data.

10. A passageway authentication device characterized by comprising: A server applied to a data transmission local area network comprises: an acquisition module configured to acquire a quantum authentication identifier and a first device identifier, the first device identifier comprising a unique identifier of the client; a second building module configured to build a quantum key encryption channel with the client based on the first device identifier when the quantum authentication identifier indicates to build the quantum key encryption channel with the client, the quantum key encryption channel comprising a channel authenticated by a quantum key.

11. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the data encryption method of any one of claims 1-6 or the channel authentication method of any one of claims 7-8.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing the processor to execute the data encryption method of any one of claims 1-6 or the channel authentication method of any one of claims 7-8 when executed.

Images