Third party based key exchange method, system and components thereof
By distributing symmetric keys and random numbers between entities and trusted third parties, and using stream cipher algorithms and XOR operations to generate encrypted data, secure key exchange and strength management between entities are achieved, ensuring that third parties cannot obtain the shared keys.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- QUANTUMCTEK CO LTD
- Filing Date
- 2024-12-20
- Publication Date
- 2026-06-23
AI Technical Summary
In existing key exchange methods based on trusted third parties, the third party may obtain the shared keys between entities, leading to unintended leaks in certain application scenarios.
By distributing symmetric keys and random numbers between an entity and a trusted third party, encrypted data is generated using stream cipher algorithms and XOR operations. The trusted third party selects and exchanges encryption keys, and the entity ultimately decrypts the data to generate the final key, ensuring that the third party cannot obtain the shared key.
It enables the final key to be held only between entities, enhancing the system's control capabilities and key strength management, and meeting the security requirements of specific application scenarios.
Smart Images
Figure CN122268570A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of cryptography, and more specifically to a third-party-based key exchange method, system, and its trusted third party and entity. Background Technology
[0002] In symmetric cryptography-based authentication systems, due to the complexity of symmetric key distribution between any two points, a trusted third party is typically used as an auxiliary node for authentication and key distribution.
[0003] Figure 1 An example of a key exchange system based on a trusted third party is shown, in which entities A and B each share a symmetric key K with a trusted third party. A and K B Entity A and Entity B do not directly share a key; they rely on a trusted third party T for mutual authentication and key distribution.
[0004] Currently, existing key exchange methods based on trusted third parties typically employ... Figure 2 and Figure 3 The two implementation methods are shown.
[0005] exist Figure 2 In the key exchange method shown, a trusted third party T generates a shared key K for entities A and B. AB Then, using the symmetric key K between a trusted third party T and entities A and B respectively... A and K B In encrypted form E(K) A ,K AB ) and E(K B ,K AB ), will share key K AB Issued to Entity A and Entity B.
[0006] exist Figure 3 In the key exchange method shown, a trusted third party, upon request from an entity (e.g., entity A), uses an encrypted method E(K) to exchange keys. A ,K AB ,E(K B ,K AB Send key K to entity A AB Then entity A uses encrypted method E(K) B ,K AB ) key K AB Send to another entity B.
[0007] However, Figure 2 and Figure 3Both existing key exchange methods shown have a problem: a trusted third party may also possess the shared key K between entities A and B. AB This situation is undesirable in some application scenarios. Summary of the Invention
[0008] To address the aforementioned problems in existing technologies, this invention proposes a third-party-based key exchange method, system, and its trusted third party and entities. The trusted third party only participates in entity authentication and assists in key negotiation between the two entities, and cannot obtain the shared key used between the two entities (or any key data that could directly provide that shared key). This effectively solves the problem in existing trusted third-party-based key exchange schemes where the trusted third party cannot be prevented from obtaining the exchange key, ensuring that the final exchanged key is possessed only by the two entities involved in the key exchange. Furthermore, in this invention, the trusted third party can also provide random numbers to participate in the final key generation, thereby guaranteeing the strength of the final key and meeting the requirement for a trusted third party to manage the strength of the exchanged key in specific application scenarios, enhancing the system's control capabilities.
[0009] Specifically, the first aspect of the present invention relates to a third-party-based key exchange method, which includes the following steps:
[0010] A first symmetric key is distributed between a first entity and a trusted third party, and a second symmetric key is distributed between a second entity and a trusted third party;
[0011] The first entity uses a first symmetric key to encrypt a first random number it possesses, generating first encrypted data, which is then sent to the second entity.
[0012] The second entity uses its second random number to encrypt the first encrypted data to generate the second encrypted data, and uses the second symmetric key to encrypt the second encrypted data to generate the third encrypted data and send it to a trusted third party;
[0013] A trusted third party decrypts the third encrypted data using the first and second symmetric keys to obtain the fourth encrypted data, and then uses the third random number it possesses to encrypt the fourth encrypted data to generate the fifth encrypted data.
[0014] A trusted third party selects one of a first symmetric key and a second symmetric key as the first encryption key, and uses the other as the second encryption key; the fifth encrypted data is encrypted using the first encryption key to generate the sixth encrypted data, and sent to the entity corresponding to the first encryption key in the first entity and the second entity; and the third random number is encrypted using the second encryption key to generate the seventh encrypted data, and sent to the entity corresponding to the second encryption key in the first entity and the second entity.
[0015] The entity corresponding to the first encryption key in the first entity and the second entity decrypts the sixth encrypted data with the first encryption key to obtain the eighth encrypted data, and uses the random number it possesses to decrypt the eighth encrypted data to obtain the final key.
[0016] The entity corresponding to the second encryption key in the first and second entities uses the second encryption key to decrypt the seventh encrypted data to obtain the third random number, and uses the random number it possesses to encrypt the third random number to generate the final key.
[0017] Furthermore, by using a stream cipher algorithm to encrypt the first symmetric key to generate a first keystream, and then XORing the first keystream with a first random number, first encrypted data is generated; and / or,
[0018] A second keystream is generated by encrypting the second symmetric key using a stream cipher algorithm, and then the second keystream is XORed with the second encrypted data to generate the third encrypted data; and / or,
[0019] The sixth encrypted data is generated by encrypting the first encryption key using a stream cipher algorithm to generate a third keystream, and then XORing the third keystream with the fifth encrypted data; and / or,
[0020] The fourth key stream is generated by encrypting the second encryption key using a stream cipher algorithm, and then the fourth key stream is XORed with the third random number to generate the seventh encrypted data.
[0021] Furthermore, the second encrypted data is generated by XORing the second random number with the first encrypted data; and / or,
[0022] The fifth encrypted data is generated by XORing the third random number with the fourth encrypted data; and / or,
[0023] The entity corresponding to the second encryption key in the first and second entities generates the final key by performing an XOR operation between its random number and a third random number.
[0024] Furthermore, the stream cipher algorithm employs the CTR mode of SM4; and / or,
[0025] The key exchange method further includes a step of authenticating the entity; and / or
[0026] To distribute the first and second symmetric keys using quantum key distribution; and / or,
[0027] The first random number is generated by the first entity; and / or,
[0028] The second random number is generated by the second entity; and / or,
[0029] The third random number is generated by a trusted third party.
[0030] A second aspect of the present invention relates to a third-party-based key exchange system, comprising a first entity, a second entity, and a trusted third party, wherein a first symmetric key is distributed between the first entity and the trusted third party, and a second symmetric key is distributed between the second entity and the trusted third party.
[0031] The first entity is configured to encrypt a first random number it possesses using a first symmetric key to generate first encrypted data and send it to the second entity.
[0032] The second entity is configured to encrypt the first encrypted data using its second random number to generate the second encrypted data, and to encrypt the second encrypted data using the second symmetric key to generate the third encrypted data and send it to a trusted third party.
[0033] A trusted third party is configured to decrypt third encrypted data using a first symmetric key and a second symmetric key to obtain fourth encrypted data, and to encrypt the fourth encrypted data using a third random number to generate fifth encrypted data; select one of the first symmetric key and the second symmetric key as the first encryption key, and the other as the second encryption key; encrypt the fifth encrypted data using the first encryption key to generate sixth encrypted data, and send it to the entity corresponding to the first encryption key in the first entity and the second entity; and encrypt the third random number using the second encryption key to generate seventh encrypted data, and send it to the entity corresponding to the second encryption key in the first entity and the second entity.
[0034] The entity corresponding to the first encryption key in the first entity and the second entity is also configured to decrypt the sixth encrypted data with the first encryption key to obtain the eighth encrypted data, and to decrypt the eighth encrypted data with its random number to obtain the final key.
[0035] The entity corresponding to the second encryption key in the first and second entities is also configured to decrypt the seventh encrypted data using the second encryption key to obtain a third random number, and to encrypt the third random number using the random number it possesses to generate the final key.
[0036] Furthermore, the key exchange system of the present invention is used to implement the above-described key exchange method.
[0037] A third aspect of the invention relates to a trusted third party for exchanging keys between a first entity and a second entity, comprising a first symmetric key pool, a second symmetric key pool, a third random number module, and a control module.
[0038] The first symmetric key pool stores the first symmetric key distributed between the first entity and a trusted third party;
[0039] The second symmetric key pool stores the second symmetric key distributed between the second entity and a trusted third party;
[0040] The third random number module is configured to provide a third random number;
[0041] The control module is configured to decrypt the third encrypted data using a first symmetric key and a second symmetric key to obtain the fourth encrypted data, and encrypt the fourth encrypted data using a third random number to generate the fifth encrypted data; select one of the first symmetric key and the second symmetric key as the first encryption key, and the other as the second encryption key; encrypt the fifth encrypted data using the first encryption key to generate the sixth encrypted data, and send it to the entity corresponding to the first encryption key in the first entity and the second entity; and encrypt the third random number using the second encryption key to generate the seventh encrypted data, and send it to the entity corresponding to the second encryption key in the first entity and the second entity.
[0042] The third encrypted data is generated by encrypting the second encrypted data with the second symmetric key. The second encrypted data is generated by encrypting the first encrypted data with the second random number possessed by the second entity. The first encrypted data is generated by encrypting the first random number possessed by the first entity with the first symmetric key.
[0043] Furthermore, the control module is also configured to authenticate the first entity and / or the second entity.
[0044] Furthermore, a trusted third party is configured for use in the aforementioned key exchange system.
[0045] A fourth aspect of the invention relates to an entity for the aforementioned key exchange system, comprising a symmetric key pool, a random number module, and an encryption / decryption module; wherein,
[0046] The symmetric key pool stores the symmetric keys distributed between itself and trusted third parties;
[0047] The random number module is configured to provide random numbers;
[0048] The encryption / decryption module is configured for data encryption and decryption operations. Attached Figure Description
[0049] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.
[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0051] Figure 1 An example of a key exchange system based on a trusted third party is shown;
[0052] Figure 2 An example of a key exchange method based on a trusted third party in the prior art is shown;
[0053] Figure 3 This illustrates another example of a key exchange method based on a trusted third party in the prior art;
[0054] Figure 4 An example of a key exchange system and method based on a trusted third party according to the present invention is illustrated schematically. Detailed Implementation
[0055] In the following description, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are provided by way of example in order to fully convey the spirit of the invention to those skilled in the art. Therefore, the invention is not limited to the embodiments disclosed herein.
[0056] Figure 4 An example of a key exchange system and method based on a trusted third party according to the present invention is illustrated schematically.
[0057] like Figure 4 As shown, the key exchange system of the present invention may include a trusted third party T and multiple entities, such as a first entity A and a second entity B.
[0058] Within the trusted third party T of this invention, at least a first symmetric key pool, a second symmetric key pool, a third random number module, and a control module may be provided.
[0059] The first symmetric key pool is used to store the first symmetric key K distributed between the first entity A and the trusted third party T. A .
[0060] The second symmetric key pool is used to store the second symmetric key K distributed between the second entity B and the trusted third party T. B .
[0061] The third random number module is used to provide a third random number R. TFor example, the random number module may include a random number generator for generating random numbers (as a third random number R). T (For use by trusted third parties T)
[0062] The control module performs the encryption and decryption operations required during key exchange. Furthermore, the control module can also be used for other functions such as entity authentication.
[0063] Within the entity of this invention, at least a symmetric key pool, a random number module, and an encryption / decryption module may be provided.
[0064] Accordingly, the entity’s symmetric key pool is used to store the symmetric keys distributed between it and trusted third parties.
[0065] A random number module within an entity can provide random numbers for, for example, possible data encryption / decryption operations. For instance, a random number module may include a random number generator for generating random numbers for use by the entity in which it resides.
[0066] The encryption / decryption module within the entity can perform data encryption / decryption operations required, for example, during key exchange.
[0067] exist Figure 4 In the example, the first entity A may include a first symmetric key pool, a first random number module, and a first encryption / decryption module.
[0068] The first symmetric key pool may store the first symmetric key K distributed between the first entity A and the trusted third party T. A .
[0069] The first random number module can generate and output the first random number R. A .
[0070] The first encryption / decryption module can be used to implement the encryption / decryption operations that the first entity A needs to perform during the key exchange process.
[0071] The second entity B may include a second symmetric key pool, a second random number module, and a second encryption / decryption module.
[0072] The second symmetric key pool can store the second symmetric key K distributed between the second entity B and the trusted third party T. B .
[0073] The second random number module can generate and output a second random number R. B .
[0074] The second encryption / decryption module is used to perform the encryption / decryption operations that the second entity B needs to perform during the key exchange process.
[0075] To facilitate understanding of the configuration or function of each component in the key exchange system of this invention, the following will be based on... Figure 4 The illustrated key exchange system serves as an example to illustrate the third-party-based key exchange method of the present invention. Those skilled in the art will understand that the data encryption and decryption operations in the key exchange method can be implemented by a control module of a trusted third party or by an encryption / decryption module within an entity.
[0076] According to the present invention, in order to realize key exchange between a first entity A and a second entity B with the help of a trusted third party T, it is first necessary to distribute a first symmetric key K between the first entity A and the trusted third party T. A And the distribution of the second symmetric key K between the second entity B and the trusted third party T. B .
[0077] As a preferred example, the distribution of the aforementioned symmetric key between the entity and a trusted third party can be achieved using a quantum key distribution process.
[0078] In a preferred example, the identities of the first entity A and the second entity B can also be authenticated by a trusted third party T before the key exchange between the first entity A and the second entity B.
[0079] For example, after completing entity authentication and the distribution of symmetric keys between the two entities and a trusted third party, such as Figure 4 As shown, the first entity A can use the first symmetric key K A The first random number R it possesses A (For example, it can be generated by the first random number module within the first entity A) to encrypt and generate the first encrypted data E(K). A ,R A And send it to the second entity B.
[0080] In this invention, the first entity A can first use a stream cipher algorithm to process the first symmetric key K. A Perform encryption operations to generate the first key stream f(K) A Then, the first key stream f(K) A ) and the first random number R A The first encrypted data is generated by performing an XOR operation.
[0082] In a preferred example, the stream cipher algorithm can employ the CTR (counter) mode of SM4, which generates a stream cipher for the key stream by encrypting an incrementing counter.
[0083] The second entity B receives the first encrypted data E(K) A ,R AAfter that, you can use the second random number R that it possesses. B (which, for example, can be generated by the second random number module within the second entity B) for the first encrypted data E(K) A ,R A ) to generate the second encrypted data E(K) A ,R B ,R A Then, with the help of the second symmetric key K B For the second encrypted data E(K) A ,R B ,R A ) to generate third encrypted data E(K) B ,K A ,R B ,R A And send it to a trusted third party T.
[0084] In this invention, the second entity B can be determined by using the second random number R. B With the first encrypted data E(K) A ,R A The second encrypted data is generated by performing an XOR operation.
[0085] Furthermore, the second entity B can first use a stream cipher algorithm to process the second symmetric key K. B Perform encryption operations to generate a second key stream f(K) B Then the second key stream f(K) B ) and the second encrypted data E(K) A ,R B ,R A The third encrypted data is generated by performing an XOR operation.
[0086] Trusted third party T receives third encrypted data E(K) B ,K A ,R B ,R A After that, we can first use the first symmetric key K A Second symmetric key K B For the third encrypted data E(K) B ,K A ,R B ,R A Decryption yields the fourth encrypted data E(R) B ,R A Then, using its third random number R... T For the fourth encrypted data E(R) B ,R AThe fifth encrypted data E(R) is obtained by performing encryption operations. B ,R T ,R A ).
[0087] In this invention, a trusted third party T can first use a stream cipher algorithm to process the first symmetric key K. A Second symmetric key K B Perform encryption operations to generate the first key stream f(K) A ) and the second key stream f(K) B Then, using the first key stream f(K) A ) and the second key stream f(K) B ) and third encrypted data By performing an XOR operation, the fourth encrypted data is obtained through decryption.
[0088] Furthermore, a trusted third party T can use a third random number R... T With the fourth encrypted data E(R) B ,R A The fifth encrypted data is generated by performing an XOR operation.
[0089] After obtaining the fifth encrypted data E(R) B ,R T ,R A Based on this, a trusted third party T can obtain the first symmetric key K. A Second symmetric key K B Choose one as the first encryption key and the other as the second encryption key, so that the fifth encrypted data E(R) can be encrypted using the first encryption key. B ,R T ,R A The system performs encryption operations to generate sixth encrypted data, which is sent to the entity corresponding to the first encryption key in the first entity and the second entity to mention the final key. It also uses the second encryption key to encrypt the third random number to generate seventh encrypted data, which is sent to the entity corresponding to the second encryption key in the first entity and the second entity to mention the final key.
[0090] exist Figure 4 In the example, the trusted third party T can choose a second symmetric key K. B As the first encryption key, the first symmetric key K A As a second encryption key.
[0091] Therefore, a trusted third party T can first use a stream cipher algorithm to encrypt the first encryption key K. B Perform encryption operations to generate a third key stream f(K)B Then the third key stream f(K) B ) and the fifth encrypted data E(R) B ,R T ,R A The sixth encrypted data is generated by performing an XOR operation. And send it to the one with the first encryption key K B The second entity B corresponding to the symmetric key.
[0092] A trusted third party T can also use a stream cipher algorithm to first encrypt the second key K. A Perform encryption operations to generate a fourth key stream f(K) A Then the fourth key stream f(K) A ) and the third random number R T The seventh encrypted data is generated by performing an XOR operation. And send it to someone with the second encryption key K A The first entity A corresponding to the symmetric key.
[0093] Therefore, the entity corresponding to the first encryption key in the first entity A and the second entity B (e.g., entity B) can use the first encryption key (i.e., the symmetric key possessed by the entity) to decrypt the sixth encrypted data to obtain the eighth encrypted data, and use its random number to decrypt the eighth encrypted data to obtain the final key.
[0094] The entity corresponding to the second encryption key in the first entity A and the second entity B (e.g., entity A) can use the second encryption key (i.e., the symmetric key possessed by the entity) to decrypt the seventh encrypted data to obtain the third random number, and use the random number it possesses to perform encryption operations on the third random number to generate the final key.
[0095] Thus, both entity A and entity B can obtain the same final key, thereby enabling key exchange between them.
[0096] exist Figure 4 In the example, the second entity B receives the sixth encrypted data E(K) B ,R B ,R T ,R A After that, the first encryption key K can be encrypted using a stream cipher algorithm. B Perform encryption operations to generate a third key stream f(K) B Then the third key stream f(K) B ) and the sixth encrypted data E(K) B ,R B ,R T ,R AThe eighth encrypted data is generated by performing an XOR operation. Finally, it utilizes its second random number R. B The eighth encrypted data E(R) B ,R T ,R A Perform an XOR operation to decrypt and obtain the final key.
[0097] Entity A receives the seventh encrypted data E(K) A ,R T After that, the second encryption key K can be encrypted using a stream cipher algorithm. A Perform encryption operations to generate a fourth key stream f(K) A Then the fourth key stream f(K) A ) and the seventh encrypted data E(K) A ,R T By performing an XOR operation, the third random number R is obtained through decryption. T Finally, it uses its first random number R. A For the third random number R T Perform an XOR operation to obtain the final key R. T ⊕R A .
[0098] At this point, both entity A and entity B have obtained the same key R. T ⊕R A This enabled key exchange between the two.
[0099] As can be seen from the above, with the help of the key exchange system and method of the present invention, in the process of key exchange between two entities based on a trusted third party, the trusted third party can at most obtain encrypted data. The random number R used to generate the final key cannot be obtained independently. A and R B Unable to obtain the final key R used between the two entities T ⊕R A This invention effectively solves the problem in existing key exchange schemes based on trusted third parties that cannot prevent the trusted third party from obtaining the exchanged key, ensuring that the final exchanged key is only possessed by the two entities involved in the key exchange. Furthermore, in the key exchange scheme of this invention, the trusted third party can also provide random numbers to participate in the final key generation, thereby guaranteeing the strength of the final key and meeting the requirements of specific application scenarios where a trusted third party needs to manage the strength of the exchanged key, thus enhancing the system's control capabilities.
[0100] Although the present invention has been described above with reference to the accompanying drawings and specific embodiments, those skilled in the art will readily recognize that the above embodiments are merely exemplary and used to illustrate the principles of the present invention. They do not limit the scope of the present invention. Those skilled in the art can make various combinations, modifications and equivalent substitutions to the above embodiments without departing from the spirit and scope of the present invention.
Claims
1. A third-party-based key exchange method, comprising the following steps: A first symmetric key is distributed between a first entity and a trusted third party, and a second symmetric key is distributed between a second entity and a trusted third party; The first entity uses a first symmetric key to encrypt a first random number it possesses, generating first encrypted data, which is then sent to the second entity. The second entity uses its second random number to encrypt the first encrypted data to generate the second encrypted data, and uses the second symmetric key to encrypt the second encrypted data to generate the third encrypted data and send it to a trusted third party; A trusted third party decrypts the third encrypted data using the first and second symmetric keys to obtain the fourth encrypted data, and then uses the third random number it possesses to encrypt the fourth encrypted data to generate the fifth encrypted data. A trusted third party selects one of a first symmetric key and a second symmetric key as the first encryption key, and uses the other as the second encryption key; The fifth encrypted data is encrypted using the first encryption key to generate the sixth encrypted data, and then sent to the entity corresponding to the first encryption key in the first entity and the second entity; and the third random number is encrypted using the second encryption key to generate the seventh encrypted data, and then sent to the entity corresponding to the second encryption key in the first entity and the second entity. The entity corresponding to the first encryption key in the first entity and the second entity decrypts the sixth encrypted data with the first encryption key to obtain the eighth encrypted data, and uses the random number it possesses to decrypt the eighth encrypted data to obtain the final key. The entity corresponding to the second encryption key in the first and second entities uses the second encryption key to decrypt the seventh encrypted data to obtain the third random number, and uses the random number it possesses to encrypt the third random number to generate the final key.
2. The key exchange method as described in claim 1, wherein: First encrypted data is generated by encrypting a first symmetric key using a stream cipher algorithm to generate a first keystream, and then XORing the first keystream with a first random number; and / or, A second keystream is generated by encrypting the second symmetric key using a stream cipher algorithm, and then the second keystream is XORed with the second encrypted data to generate the third encrypted data; and / or, The third key stream is generated by encrypting the first encryption key using a stream cipher algorithm, and then the third key stream is XORed with the fifth encrypted data to generate the sixth encrypted data. And / or, The fourth key stream is generated by encrypting the second encryption key using a stream cipher algorithm, and then the fourth key stream is XORed with the third random number to generate the seventh encrypted data.
3. The key exchange method as described in claim 2, wherein: The second encrypted data is generated by XORing the second random number with the first encrypted data; and / or, The fifth encrypted data is generated by XORing the third random number with the fourth encrypted data; and / or, The entity corresponding to the second encryption key in the first and second entities generates the final key by performing an XOR operation between its random number and a third random number.
4. The key exchange method according to any one of claims 2-3, wherein: The stream cipher algorithm uses the SM4 CTR mode; and / or, The key exchange method further includes the step of authenticating the entity; And / or, To distribute the first and second symmetric keys using quantum key distribution; and / or, The first random number is generated by the first entity; and / or, The second random number is generated by the second entity; and / or, The third random number is generated by a trusted third party.
5. A third-party-based key exchange system, comprising a first entity, a second entity, and a trusted third party, wherein, The first entity distributes a first symmetric key with a trusted third party, and the second entity distributes a second symmetric key with a trusted third party; The first entity is configured to encrypt a first random number it possesses using a first symmetric key to generate first encrypted data and send it to the second entity. The second entity is configured to encrypt the first encrypted data using its second random number to generate the second encrypted data, and to encrypt the second encrypted data using the second symmetric key to generate the third encrypted data and send it to a trusted third party. A trusted third party is configured to decrypt the third encrypted data using a first symmetric key and a second symmetric key to obtain the fourth encrypted data, and to encrypt the fourth encrypted data using a third random number to generate the fifth encrypted data; one of the first symmetric key and the second symmetric key is selected as the first encryption key, and the other is selected as the second encryption key; The fifth encrypted data is encrypted using the first encryption key to generate the sixth encrypted data, and then sent to the entity corresponding to the first encryption key in the first entity and the second entity; and the third random number is encrypted using the second encryption key to generate the seventh encrypted data, and then sent to the entity corresponding to the second encryption key in the first entity and the second entity. The entity corresponding to the first encryption key in the first entity and the second entity is also configured to decrypt the sixth encrypted data with the first encryption key to obtain the eighth encrypted data, and to decrypt the eighth encrypted data with its random number to obtain the final key. The entity corresponding to the second encryption key in the first and second entities is also configured to decrypt the seventh encrypted data using the second encryption key to obtain a third random number, and to encrypt the third random number using the random number it possesses to generate the final key.
6. The key exchange system as described in claim 5, which is used to implement the key exchange method as described in any one of claims 1-4.
7. A trusted third party for exchanging keys between a first entity and a second entity, comprising a first symmetric key pool, a second symmetric key pool, a third random number module, and a control module; The first symmetric key pool stores the first symmetric key distributed between the first entity and a trusted third party; The second symmetric key pool stores the second symmetric key distributed between the second entity and a trusted third party; The third random number module is configured to provide a third random number; The control module is configured to decrypt the third encrypted data using the first symmetric key and the second symmetric key to obtain the fourth encrypted data, and to encrypt the fourth encrypted data using the third random number to generate the fifth encrypted data; one of the first symmetric key and the second symmetric key is selected as the first encryption key, and the other is selected as the second encryption key; The fifth encrypted data is encrypted using the first encryption key to generate the sixth encrypted data, and then sent to the entity corresponding to the first encryption key in the first entity and the second entity; and the third random number is encrypted using the second encryption key to generate the seventh encrypted data, and then sent to the entity corresponding to the second encryption key in the first entity and the second entity. The third encrypted data is generated by encrypting the second encrypted data with the second symmetric key. The second encrypted data is generated by encrypting the first encrypted data with the second random number possessed by the second entity. The first encrypted data is generated by encrypting the first random number possessed by the first entity with the first symmetric key.
8. The trusted third party as described in claim 7, wherein, The control module is also configured to authenticate the first entity and / or the second entity.
9. The trusted third party as described in claim 7, configured for use in the key exchange system as described in claim 5 or 6.
10. An entity for use in the key exchange system as described in claim 5 or 6, comprising a symmetric key pool, a random number module, and an encryption / decryption module; wherein, The symmetric key pool stores the symmetric keys distributed between itself and trusted third parties; the random number module is configured to provide random numbers. The encryption / decryption module is configured for data encryption and decryption operations.