Data processing method, device, system, storage medium and processor

Abstract

The present invention discloses a data processing method, device, system, storage medium and processor. The method comprises: a first quantum key distribution system obtains a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed. The present invention solves the technical problem of low security in protecting data.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a data processing method, device, system, storage medium and processor. Background Art

[0002] Currently, when using the Key Management Service (KMS), data keys need to be transmitted between the data center of the cloud service provider and the data center of government and enterprise users, but they are usually transmitted in encrypted channels that are not resistant to quantum attacks, such as in the encrypted channels of the Transport Layer Security (TLS) protocol.

[0003] In addition, when KMS provides support for user-defined key materials to generate master keys (BYOK), the KMS service usually encrypts the key materials provided by users based on classic public key algorithms (RSA, Diffie-Hellman) and other encryption algorithms.

[0004] Assuming that an attacker uses a quantum computer to intercept the TLS communication protocol, the attacker can calculate the private key information based on the public key information generated by the Diffie-Hellman algorithm or RSA algorithm used, and then immediately obtain the data key. If a similar attack is further carried out on the RSA algorithm used in BYOK, the key material created by the user can be decrypted, making it possible for the attacker to further perform a man-in-the-middle attack, thus posing a technical problem of low security in protecting data.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] Embodiments of the present invention provide a data processing method, device, system, storage medium, and processor to at least solve the technical problem of low security in protecting data.

[0007] According to one aspect of an embodiment of the present invention, a data processing method is provided. The method may include: a first quantum key distribution system obtains a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0008] According to another aspect of an embodiment of the present invention, another data processing method is also provided. The method may include: a terminal sends a first request to a first quantum key distribution system; the terminal obtains a quantum key at least sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0009] According to another aspect of an embodiment of the present invention, another data processing method is also provided. The method may include: the second quantum key distribution system obtains a third request sent by the key management service system; the second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0010] According to another aspect of an embodiment of the present invention, another data processing method is also provided. The method may include: the key management service system sends a third request to the second quantum key distribution system; the management service system obtains the quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0011] According to another aspect of an embodiment of the present invention, a data processing system is also provided. The system may include: a terminal, configured to send a first request; and a first quantum key distribution system, configured to respond to the first request and send at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0012] According to another aspect of an embodiment of the present invention, another data processing system is provided. The system may include: a key management service system, configured to send a third request; and a second quantum key distribution system, configured to respond to the third request and send at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0013] According to another aspect of an embodiment of the present invention, a data processing device is also provided. The device may include: a first acquisition unit, configured to enable a first quantum key distribution system to acquire a first request sent by a terminal; a first sending unit, configured to enable the first quantum key distribution system to respond to the first request and send at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0014] According to another aspect of an embodiment of the present invention, another data processing device is provided. The device may include: a second sending unit, configured to enable a terminal to send a first request to a first quantum key distribution system; a second obtaining unit, configured to enable the terminal to obtain at least a quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0015] According to another aspect of an embodiment of the present invention, a data processing device is also provided. The device may include: a third acquisition unit, configured to enable the second quantum key distribution system to acquire a third request sent by the key management service system; a third sending unit, configured to enable the second quantum key distribution system to respond to the third request and send at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0016] According to another aspect of an embodiment of the present invention, a data processing device is also provided. The device may include: a fourth sending unit, configured to enable the key management service system to send a third request to the second quantum key distribution system; a fourth obtaining unit, configured to enable the management service system to obtain at least a quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0017] According to another aspect of an embodiment of the present invention, a storage medium is also provided. The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to perform the following steps: obtaining a first request sent by a terminal; in response to the first request, sending at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0018] According to another aspect of an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the following steps are performed when the program is run: obtaining a first request sent by a terminal; in response to the first request, sending at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0019] According to another aspect of an embodiment of the present invention, a mobile terminal is also provided. The data mobile terminal may include: a processor; a transmission device connected to the processor, used to obtain a first request sent by the terminal; and a memory connected to the processor and the transmission device, used to provide the processor with instructions for processing the following processing steps: in response to the first request, at least a quantum key is sent to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0020] In an embodiment of the present invention, a first quantum key distribution system is used to obtain a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed. In other words, this embodiment is based on the quantum key provided by the first quantum key distribution system to the terminal to perform security reinforcement in terms of anti-quantum attacks, thereby achieving the purpose of anti-quantum attacks. It is a solution with a small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in protecting data and achieving improved security in protecting data. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0022] Figure 1 is a schematic diagram of a data processing system according to an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of another data processing system according to an embodiment of the present invention;

[0024] Figure 3 is a schematic diagram of a data system for performing security reinforcement on key materials of a master key brought by a user against quantum attacks according to an embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of a data processing system for performing security reinforcement on data keys against quantum attacks according to an embodiment of the present invention;

[0026] Figure 5 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data processing method according to an embodiment of the present invention;

[0027] Figure 6 is a flow chart of a data processing method according to an embodiment of the present invention;

[0028] Figure 7 is a flow chart of another data processing method according to an embodiment of the present invention;

[0029] Figure 8 is a flow chart of another data processing method according to an embodiment of the present invention;

[0030] Fig. 9 is a flow chart of another data processing method according to an embodiment of the present invention;

[0031] Fig.10 It is a schematic diagram of creating a master key according to the related art;

[0032] Fig.11 It is a schematic diagram of creating a data key according to the related art;

[0033] Fig.12 is a schematic diagram of encrypting sensitive data according to one of the related arts;

[0034] Fig.13 is a schematic diagram of decrypting sensitive data according to one of the related technologies;

[0035] Fig.14 is a schematic diagram of a data processing device according to an embodiment of the present invention;

[0036] Fig.15 is a schematic diagram of a data processing device according to an embodiment of the present invention;

[0037] Fig.16 is a schematic diagram of another data processing device according to an embodiment of the present invention;

[0038] Fig.17 is a schematic diagram of another data processing device according to an embodiment of the present invention; and

[0039] Fig.18 is a structural block diagram of a mobile terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] First, some nouns or terms that appear in the description of the embodiments of the present application are subject to the following explanations:

[0043] Quantum Key Distribution (QKD), used to distribute quantum keys;

[0044] Transport Layer Security (TLS), which provides confidentiality and data integrity between two communicating applications;

[0045] Bring Your Own Key (BYOK) is a technology that can be used to support user-defined key material to generate master keys;

[0046] Public key algorithms (RSA, Diffie-Hellman), used to encrypt key material provided by users;

[0047] Key Management Service (KMS) can be used to help users create, delete and manage keys, and ensure the confidentiality, integrity and availability of keys;

[0048] Envelope Encryption is a technology applied to key management services. When users encrypt and decrypt core data, they only need to transmit the data key without using the user master key. Therefore, the data key is used to encrypt and decrypt user data.

[0049] Master Key, which is usually created in KMS and saved by KMS, can be used to encrypt and decrypt small amounts of sensitive data, and can also be used to generate, encrypt and decrypt data keys;

[0050] Hierarchical Storage Management (HSM) refers to the process of automatically migrating data objects between storage devices, usually passively.

[0051] Security protocol (Open Secure Sockets Layer, referred to as OpenSSL), a protocol used to provide security and data integrity for network communications;

[0052] Virtual Private Network (VPN) is a communication method used to connect private networks between medium and large enterprises or groups.

[0053] Example 1

[0054] An embodiment of the present invention provides a data processing system.

[0055] Figure 1 Schematic diagram of a data processing system according to an embodiment of the present invention. Figure 1 The data processing system 100 may include: a terminal 101 and a first quantum key distribution system 102.

[0056] Terminal 101 is used to send a first request.

[0057] In this embodiment, the terminal 101, that is, the user terminal, can be used for protocol interaction between the first quantum key distribution system (Quantum Key Distribution, referred to as QKD) 102, and a first request (Get Quantum Key) can be sent to the terminal 101. The first request, that is, the quantum key acquisition request, is used to request the first quantum key distribution system 102 to obtain a quantum key (Quantum Key).

[0058] The first quantum key distribution system 102 is used to send at least a quantum key to the terminal 101 in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0059] In this embodiment, the first quantum key distribution system 102 is used to realize the distribution of quantum keys, and can be deployed in the same data center as the terminal 101, for example, in the data center of government and enterprise users, or in the computer room owned by government and enterprise users. The data center can be used to store important data of users, for example, sensitive configuration information, database connection information, database passwords, login keys, sensitive communication content, confidential files and confidential information, etc. The first quantum key distribution system 102 of this embodiment obtains the first request sent by the terminal 101, responds to the first request, and sends at least a quantum key to the terminal 101, which is also the user quantum key, so that the terminal 101 obtains the quantum key, and then uses it to encrypt or decrypt the data to be processed, wherein the data to be processed can be the target parameters required for importing the encrypted user key material (Keymaterial), or can be the key material that needs to be sent to the key management service system. Among them, the key management service, as a very important basic service in the data encryption link, plays a key role in data security, and can be used to help users create, delete and manage keys, and can ensure the confidentiality, integrity and availability of the keys.

[0060] Hybrid cloud is the most common form for government and enterprise users in the process of gradually moving to the cloud. The data processing system of this embodiment can be applied in the hybrid cloud scenario. Based on the first quantum key distribution system 102, by providing quantum keys to the terminal 101 for security reinforcement against quantum attacks, the purpose of resisting quantum attacks is achieved. It is a solution with small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and improving the security of data protection.

[0061] The following introduces the security reinforcement of the key material of the user's own master key (Master Key) against quantum attacks based on the QKD system of the data system of this embodiment.

[0062] As an optional implementation, after the terminal obtains the quantum key, the key material can be encrypted on the terminal, and the terminal sends the encrypted key material.

[0063] In this embodiment, the quantum key is used to encrypt the key material on the terminal, wherein the key material is the key material created by the user host, and the key material must ensure randomness, and a random source generated by a quantum random number generator can be used as the key material. The terminal of this embodiment sends the encrypted key material to the key management service system, and the key management service system decrypts the encrypted key material to obtain the key material, and the key material and the corresponding master key can be stored in the hierarchical storage management system (HSM) to improve the security of the master key. Among them, the master key is usually created in the KMS and saved by the KMS, which can be used for encryption and decryption with a small amount of sensitive data, and can also be used to generate, encrypt and decrypt data keys.

[0064] As an optional implementation, the first quantum key distribution system sends not only the quantum key but also the identification information (ID) of the quantum key to the terminal, where the identification information is used to uniquely identify the quantum key.

[0065] As an optional implementation, the terminal sends the identification information to the key management service system, and the key management service system obtains the quantum key based on the identification information, and encrypts the target parameter by the obtained quantum key. The key management service system sends the encrypted target parameter to the terminal. At this time, the RSA algorithm is replaced by the quantum key, so this embodiment no longer needs to send the RSA public key information. After the terminal obtains the encrypted target parameter, the encrypted target parameter can be decrypted by the quantum key in the terminal to obtain the target parameter, and the target parameter is processed accordingly, which can be used to import the key material, so that the key material and the master key are saved in the hierarchical storage system.

[0066] In this embodiment, the target parameter may be a parameter required for importing the key material, such as a token or other required target parameters, etc. After the terminal performs relevant processing on the key material, the terminal may encrypt the key material using the quantum key of the terminal and then send it to the key management service system.

[0067] As an optional implementation, the key management service system obtains the quantum key based on the identification information, which may be that the key management service system obtains the quantum key from the second quantum key distribution system based on the identification information.

[0068] As an optional implementation, before the first quantum key distribution system obtains the first request sent by the terminal, identity authentication is first performed, and the first quantum key distribution system sends a second request (Auth request), which is also an identity authentication request, for requesting the first quantum key distribution system to authenticate the terminal. The first quantum key distribution system obtains the second request, responds to the second request, authenticates the terminal, and can return an authentication result (Auth Ack) of authenticating the terminal to the terminal.

[0069] As an optional implementation, when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request to the first quantum key distribution system, and the first quantum key distribution system responds to the first request and returns the quantum key and corresponding identification information to the terminal.

[0070] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0071] The following introduces the security reinforcement of the data key against quantum attacks based on the QKD system of the data system of this embodiment.

[0072] As an optional implementation, the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system, so that the first quantum key distribution system obtains the first request carrying the above identification information.

[0073] As an optional implementation, the first quantum key distribution system can search for the quantum key based on the acquired identification information, and send the found quantum key to the terminal.

[0074] As an optional implementation, before the first quantum key distribution system obtains the first request sent by the terminal, when the terminal receives the identification information of the quantum key, the terminal sends a second request to the first quantum key distribution system to request the first quantum key distribution system to authenticate the terminal; the first quantum key distribution system responds to the above second request and authenticates the terminal.

[0075] In this embodiment, the terminal can receive a request message sent by the key management service system, for example, receive a key ID synchronization message (Quantum key ID notification). If it is determined that the message includes identification information of the quantum key, the terminal performs protocol interaction with the first quantum key distribution system, and authenticates the identity of the terminal through the first quantum key distribution system.

[0076] As an optional implementation, when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request carrying identification information to the first quantum key distribution system to request to obtain a quantum key.

[0077] As an optional implementation, the key management service system sends identification information of the quantum key to the terminal.

[0078] In this embodiment, the terminal receives the identification information of the quantum key, which may be a synchronization message of the key ID sent by the key management service system to the terminal.

[0079] As an optional implementation, the key management service system sends a third request to the second quantum key distribution system to request to obtain the identification information of the quantum key. The second quantum key distribution system responds to the third request and sends the identification information of the quantum key to the key management service system, so that the key management service system obtains the identification information of the quantum key.

[0080] As an optional implementation, the above-mentioned third request is also used for the key management service system to request the second quantum key distribution system to obtain the quantum key, that is, the second quantum key distribution system can return the quantum key and the identification information of the quantum key to the key management service system at the same time.

[0081] As an optional implementation, the key management service system encrypts the data key by using the quantum key obtained from the second quantum key distribution system, and sends the encrypted data key to the terminal. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks; after the terminal obtains the encrypted data key, the terminal uses the quantum key obtained from the first quantum key distribution system to decrypt the encrypted data key, wherein the decrypted data key is used to encrypt the local data of the terminal.

[0082] As an optional implementation, when the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

[0083] In this embodiment, when the terminal obtains the quantum key, a key ID notification message (Notification ack) can be sent to the key management service system, and then the quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal.

[0084] This embodiment targets the TLS protocol that is not resistant to quantum attacks. Based on the QKD system, the data key is reinforced to resist quantum attacks, thereby improving the security of data protection.

[0085] Figure 2 FIG. 1 is a schematic diagram of another data processing system according to an embodiment of the present invention. Figure 2 As shown, the data processing system 200 of this embodiment may include: a key management service system 201 and a second quantum key distribution system 202.

[0086] The key management service system 201 is used to send a third request.

[0087] In this embodiment, the key management service system 201 is used to send a third request to the second quantum key distribution system 202, where the third request is used to request at least to obtain a quantum key from the key management service system.

[0088] The second quantum key distribution system 202 is used to respond to the third request and at least send a quantum key to the key management service system 201, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0089] In this embodiment, the key management service system 201 and the second quantum key distribution system 202 are deployed in the first data center, which can be a data center of a cloud service provider, and transmits data with the data center where the first quantum key distribution system and the terminal are deployed. After the second quantum key distribution system 202 obtains the third request, it can respond to the third request and at least send a quantum key to the key management system, which can be used to encrypt or decrypt the data to be processed, wherein the data to be processed can be parameters, data keys, etc. required when importing self-contained key materials.

[0090] This embodiment can be applied in the scenario of hybrid cloud. Based on the second quantum key distribution system 202, the quantum key is provided to the key management service system 201 for security reinforcement against quantum attacks, thereby achieving the purpose of resisting quantum attacks. It is a solution with smaller granularity and lower development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and improving the security of data protection.

[0091] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0092] The following introduces the security reinforcement of the key material of the user's own master key against quantum attacks based on the QKD system of the data system of this embodiment.

[0093] As an optional implementation, the key management service system can encrypt the target parameters through the quantum key in the key management system. At this time, the quantum key replaces the RSA algorithm, so there is no need to send the RSA public key information; the encrypted target parameters are sent to the terminal, and the terminal decrypts the encrypted target parameters through the quantum key in the terminal to obtain the target parameters, which are used to save the key material and the corresponding master key in the hierarchical storage system.

[0094] In this embodiment, the target parameter may be a parameter required for importing the key material, such as a token or other required target parameters, etc. After the terminal performs relevant processing on the key material, the terminal may encrypt the key material by a quantum key and then send the encrypted key material to the key management service system.

[0095] As an optional implementation, the key management service system obtains the identification information of the quantum key sent by the terminal, and sends a third request carrying the identification information of the quantum key to the second quantum key distribution system, so that the second quantum key distribution system responds to the third request and sends at least the quantum key to the key management service system.

[0096] As an optional implementation, the second quantum key distribution system can respond to the third request, search for the quantum key based on the identification information carried in the third request, and send the found quantum key to the key management service system.

[0097] As an optional implementation, before the second quantum key distribution system obtains the third request sent by the key management service system, when the key management service system receives the identification information, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0098] In this embodiment, the key management service system receives the request message and finds the identification information included therein, such as quantum key ID information. The key management service system then performs a protocol interaction with the second quantum key distribution system, and the key management service system sends a fourth request to the second quantum key distribution system to authenticate the key management service system. The second quantum key distribution system obtains and responds to the fourth request, and authenticates the key management service system, which may be authenticating the identity of the key management service system.

[0099] As an optional implementation, when the second quantum key distribution system successfully authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0100] In this embodiment, after the key management service system passes the identity authentication, the key management service system sends a third request carrying the identification information of the quantum key to the second quantum key distribution system, so that the second quantum key distribution system sends the quantum key to the key management system according to the identification information, and then encrypts the target parameter by the quantum key in the key management system to send the encrypted target parameter to the terminal.

[0101] As an optional implementation, the quantum key in the terminal is also used to encrypt the key material on the terminal. The encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system. The decrypted key material and master key are stored in the hierarchical storage management system.

[0102] In this embodiment, the quantum key obtained by the terminal from the first quantum key distribution system is used to encrypt the key material generated by the user on the terminal. The key management service system obtains the encrypted key material, decrypts it using the quantum key obtained from the second quantum key distribution system, and stores the decrypted key material and master key in the hierarchical management system.

[0103] As an optional implementation, the quantum key in the terminal is obtained by a first quantum key distribution system in response to a first request sent by the terminal.

[0104] This embodiment targets the RSA algorithm and TLS protocol that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key is reinforced against quantum attacks, thereby improving the security of data protection.

[0105] The following introduces the security reinforcement of the data key against quantum attacks based on the QKD system of the data system of this embodiment.

[0106] As an optional implementation, the second quantum key distribution system not only sends the quantum key but also the identification information of the quantum key to the key management service system.

[0107] As an optional implementation, after the key management service system obtains the identification information of the quantum key, the key management service system sends it to the terminal, and the first request carrying the identification information of the quantum key can be sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

[0108] In this embodiment, the key management service system may send a synchronization message of the key ID to the terminal.

[0109] As an optional implementation, the key management service system encrypts the data key by using the quantum key obtained from the second quantum key distribution system. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks; the key management service system sends the encrypted data key to the terminal, and the encrypted data key is decrypted by the terminal through the quantum key in the first quantum key distribution system, and the decrypted data key is used to encrypt the local data of the terminal.

[0110] As an optional implementation, when the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

[0111] In this embodiment, when the terminal obtains the quantum key from the first quantum key distribution system, the key management system obtains the key ID notification message sent by the terminal, and can respond to the key ID notification message to encrypt the data key.

[0112] As an optional implementation, before the second quantum key distribution system obtains the third request sent by the key management service system, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0113] In this embodiment, before the key management service system sends the third request to the second quantum key distribution system, it can first directly send a fourth request to the second quantum key distribution system, and the fourth request is used to request the second quantum key distribution system to authenticate the key management service system. The second quantum key distribution system obtains the fourth request, responds to the fourth request, authenticates the key management service system, and then sends the authentication result to the key management service system.

[0114] As an optional implementation, the second quantum key distribution system obtains the third request sent by the key management service system, including: when the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0115] In this embodiment, when the authentication result is that the second quantum key distribution system has successfully authenticated the key management service system, the key management service system may send a third request to the second quantum key distribution system to request the quantum key and corresponding identification information.

[0116] This embodiment targets the TLS protocol that is not resistant to quantum attacks. Based on the QKD system, the data key is reinforced to resist quantum attacks, thereby improving the security of data protection.

[0117] The above technical solution of this embodiment is further illustrated below with examples.

[0118] The following example introduces the security reinforcement of the user's own master key material against quantum attacks based on the QKD system for the RSA algorithm and TLS protocol that are not resistant to quantum attacks.

[0119] Figure 3 1 is a schematic diagram of a data system for strengthening the security of a key material of a user's own master key against quantum attacks according to an embodiment of the present invention. Figure 3 As shown, the data processing system of this embodiment includes: IDCA or enterprise DC and IDCB, wherein IDCA or enterprise DC includes QKD1 and terminal 3, and IDCB includes KMS4, QKD2 and HSM5. The data processing system can be used to perform the following steps:

[0120] S1, terminal 3 sends an identity authentication request to QKD1.

[0121] S2, QKD1 responds to the identity authentication request and returns the authentication result of terminal 3 to terminal 3.

[0122] In this embodiment, a protocol interaction is performed between the terminal 3 and QKD1. First, QKD1 performs identity authentication on the terminal 3.

[0123] S3: When the terminal 3 is successfully authenticated, the terminal 3 sends a quantum key acquisition request to QKD1.

[0124] S4, QKD1 returns the quantum key and the corresponding quantum key ID information to terminal 3.

[0125] S5, after the terminal 3 generates the key material, it sends a request message to the KMS 4 for obtaining the parameters required to import the key material. The request message needs to include the ID information of the quantum key.

[0126] S6, KMS4 receives the request message, determines that the request message includes the ID information of the quantum key, and sends an identity authentication request to QKD2.

[0127] S7, QKD2 responds to the identity authentication request and returns the authentication result of KMS4's identity authentication to KMS4.

[0128] S8. When the authentication of KMS4 is successful, KMS4 sends a key acquisition request to QKD2 according to the given key ID to request the corresponding quantum key.

[0129] S9, KMS4 obtains the quantum key returned by QKD2.

[0130] S10, KMS4 imports the user key material into the required target parameters (such as tokens, or other required parameters, etc.) and encrypts them using quantum keys.

[0131] S11, KMS4 returns the encrypted target parameters to terminal 3, thereby replacing the RSA algorithm with the quantum key, so there is no need to send RSA public key information.

[0132] S12, after obtaining the encrypted target parameters, terminal 3 uses the quantum key obtained from QKD1 to decrypt the encrypted target parameters, obtains the target parameters required by the user to import the key material, and performs relevant processing on them to import the key material.

[0133] S13, terminal 3 then encrypts the key material using the quantum key obtained from QKD1.

[0134] S14, the terminal 3 sends the encrypted key material to the KMS 4;

[0135] S15, KMS4 uses the quantum key obtained from QKD2 to decrypt the encrypted key material to obtain the key material.

[0136] S16, KMS4 saves the master key corresponding to the key material to HSM5.

[0137] The following example introduces the security reinforcement of data keys against quantum attacks based on the QKD system for the TLS protocol that is not resistant to quantum attacks.

[0138] It should be noted that the above steps S1-S5 and S12-14 are performed in the data center IDCA or the enterprise computer room Enterprise; the above steps S6-S11, S15, and S16 are performed in the data center IDCB.

[0139] Figure 4 FIG. 1 is a schematic diagram of a data processing system for strengthening the security of data keys against quantum attacks according to an embodiment of the present invention. Figure 4 As shown, the processing system includes: IDCA or enterprise DC and IDCB, wherein IDCA or enterprise DC includes QKD1 and terminal 3, and IDCB includes KMS4, QKD2 and HSM5. The data processing system can be used to perform the following steps:

[0140] S1, KMS4 sends an identity authentication request to QKD2.

[0141] S2, QKD2 responds to the identity authentication request and returns the authentication result of KMS4 to terminal 3.

[0142] In this embodiment, a protocol interaction is performed between KMS4 and QKD2. First, QKD2 performs identity authentication on KMS4.

[0143] S3: When KMS4 authentication succeeds, KMS4 sends a quantum key acquisition request to QKD2.

[0144] S4, QKD2 returns the quantum key and the corresponding quantum key ID information to KMS4.

[0145] S5, KMS4 sends a key ID synchronization message to terminal 3.

[0146] S6, terminal 3 receives the synchronization message and finds the quantum key ID information contained therein, and then similarly interacts with QKD1 through protocol, sending an identity authentication request to QKD1 to authenticate terminal 3.

[0147] S7, QKD1 returns the authentication result to terminal 3.

[0148] S8, when the terminal 3 succeeds in authentication, the terminal 3 sends a quantum key acquisition request carrying the ID information of the quantum key to QKD1, requesting to obtain the quantum key;

[0149] S9, QKD1 sends the quantum key to terminal 3.

[0150] S10, the terminal 3 sends a key ID notification message to the KMS 4.

[0151] S11, KMS4 encrypts the data key using the quantum key obtained from QKD2.

[0152] S12, KMS4 sends the encrypted data key to terminal 3. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thus achieving the purpose of resisting quantum attacks.

[0153] S13, terminal 3 uses the quantum key obtained from QKD1 to decrypt the encrypted data key, and can use it to encrypt local data.

[0154] It should be noted that the above steps S1-S5, S11, and S12 are performed in the data center IDCB; and the above steps S6-S10 and S13 are performed in the data center IDCA or the enterprise computer room Enterprise.

[0155] In the related technology, a security protocol (Open Secure Sockets Layer, referred to as OpenSSL) open source branch that supports PQC to provide security and data integrity for network communications can be used to provide anti-quantum attack capabilities for all communication traffic. However, PQC is not mature enough compared to QKD at present, and the algorithm-based anti-quantum method is essentially based on mathematical complexity. It cannot guarantee that there will be no possibility of being hacked in the future, and the deployment is relatively complex. Each KMS service node and each user-side node that needs to call the KMS service need to deploy the OpenSSL software version that supports PQC and perform corresponding configuration, which makes the deployment and operation costs high; the related technology is also based on the Guodun QKD device combined with the quantum secure virtual private network (Virtual Private Network, referred to as VPN) to provide anti-quantum attack capabilities for all communication traffic, but the VPN product based on the integration of software and hardware has poor deployment flexibility and high product prices. For all communication data, an additional layer of IPSec encryption is provided on the basis of TLS. The deployment of VPN not only increases the complexity of the network, but also affects the network performance. Therefore, the data security protection in the related technology is a security protection solution with too large granularity, which will bring disadvantages such as high cost, complex operation and maintenance deployment, increased system complexity, and performance degradation.

[0156] This embodiment improves the traditional envelope encryption technology by combining it with the QKD system, and uses the quantum key generated by the QKD system to protect the weak links of the KMS system envelope encryption technology in a targeted manner. This is the data security aspect that government and enterprise users pay the most attention to in the hybrid cloud model. It is a solution with smaller granularity and lower development and deployment difficulty. The use of this embodiment can achieve the purpose of KMS system's resistance to quantum attacks, further enhance the security of data keys and master keys, and give them the ability to resist quantum attacks, so that the data security of government and enterprise users in the hybrid cloud model is further strengthened.

[0157] It should be noted that, assuming that an attacker uses a quantum computer to intercept the TLS communication protocol, the private key information is calculated based on the public key information generated by the Diffie-Hellman algorithm or the RSA algorithm used, and then the data key can be obtained immediately. If a similar attack is further carried out on the RSA algorithm used in BYOK, the key material created by the user can be decrypted, making it possible for the attacker to further perform a man-in-the-middle attack. In order to solve the technical problem of low security in protecting data, the quantum key of the embodiment of the present invention is used to encrypt or decrypt the data to be processed to perform security reinforcement against quantum attacks. If there is a subsequent encryption method with a security reinforcement strength similar to or stronger than the above-mentioned quantum key against quantum attacks, it can also be further combined or processed according to the encryption method mentioned above in this embodiment to further improve the security of data protection.

[0158] Example 2

[0159] According to an embodiment of the present invention, an embodiment of a data processing method is also provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0160] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 5 FIG. 1 is a hardware structure block diagram of a computer terminal (or mobile device) for implementing a data processing method according to an embodiment of the present invention. Figure 5 As shown, the computer terminal 50 (or mobile device 50) may include one or more (502a, 502b, ..., 502n are used to illustrate) processors 502 (the processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 504 for storing data, and a transmission device 506 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown.

[0161] It should be noted that the one or more processors 502 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 50 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0162] The memory 504 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in the embodiment of the present invention. The processor 502 executes various functional applications and data processing by running the software programs and modules stored in the memory 504, that is, realizing the vulnerability detection method of the above-mentioned application program. The memory 504 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 504 may further include a memory remotely arranged relative to the processor 502, and these remote memories may be connected to the computer terminal 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0163] The transmission device 506 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 50. In one example, the transmission device 506 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 506 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0164] It should be noted that, in some optional embodiments, the above Figure 5 The computer device (or mobile device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 5 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or mobile device).

[0165] Under the above operating environment, this application provides the following from the first quantum key distribution system side: Figure 6It should be noted that the data processing method of this embodiment can be Figure 5 The illustrated embodiment is executed by a mobile terminal.

[0166] Figure 6 is a flow chart of a data processing method according to an embodiment of the present invention. Figure 6 As shown, the method may include the following steps:

[0167] Step S602: The first quantum key distribution system obtains a first request sent by a terminal.

[0168] In the technical solution provided in the above step S602 of the present invention, the first quantum key distribution system obtains the first request sent by the terminal, that is, the quantum key acquisition request, for requesting to obtain the quantum key.

[0169] Step S604: The first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, where the quantum key is used to encrypt or decrypt the data to be processed.

[0170] In the technical solution provided in step S604 of the present invention, after the first quantum key distribution system obtains the first request sent by the terminal, the first quantum key distribution system may respond to the first request.

[0171] The first quantum key distribution system of this embodiment obtains the above-mentioned first request sent by the terminal, responds to the first request, and sends at least a quantum key to the terminal, which is also the user quantum key, so that the terminal 101 obtains the quantum key, and then uses it to encrypt or decrypt the data to be processed, wherein the data to be processed can be the target parameters required for importing the encrypted user key material, or can be the key material that needs to be sent to the key management service system, etc.

[0172] Through the above steps S602 to S604 of the embodiment of the present invention, the first quantum key distribution system obtains the first request sent by the terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed. In other words, the present application provides quantum keys to the terminal based on the first quantum key distribution system for security reinforcement against quantum attacks, thereby achieving the purpose of anti-quantum attacks. It is a solution with small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in protecting data and achieving the goal of improving the security of data protection.

[0173] The following introduces a method for strengthening the security of the key material of the user's own master key against quantum attacks based on the QKD system in this embodiment.

[0174] As an optional implementation, the quantum key is used to encrypt the key material on the terminal. The encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system. The decrypted key material and the corresponding master key are stored in the hierarchical storage management system.

[0175] In this embodiment, the quantum key is used to encrypt the key material on the terminal, wherein the key material is the key material created by the user host, and the key material must ensure randomness, and a random source generated by a quantum random number generator can be used as the key material. The encrypted key material of this embodiment can be sent by the terminal to the key management service system, and the key management service system decrypts the encrypted key material, and the decrypted key material and the corresponding master key can be stored in the hierarchical storage management system to improve the security of the master key.

[0176] As an optional implementation, step S604, the first quantum key distribution system sends at least a quantum key to the terminal, including: the first quantum key distribution system sends the quantum key and identification information of the quantum key to the terminal.

[0177] In this embodiment, the first quantum key distribution system sends at least a quantum key to the terminal. The first quantum key distribution system may not only send a quantum key to the terminal, but also send identification information of the quantum key to the terminal. For example, the identification information is ID information of the quantum key.

[0178] As an optional implementation, the identification information is sent by the terminal to the key management service system, so that the key management service system obtains the quantum key, and the obtained quantum key is used to encrypt the target parameters. The encrypted target parameters are sent by the key management service system to the terminal, and the quantum key in the terminal is used to decrypt the encrypted target parameters to obtain the target parameters. The target parameters are used to save the key material and the master key in the hierarchical storage system.

[0179] In this embodiment, the identification information of the quantum key sent by the first quantum key distribution system to the terminal can be sent by the terminal to the key management service system. Optionally, the identification information of the quantum key of this embodiment can be carried by a request message sent by the terminal to the key management service system, and the request message is used to request the key management system to obtain the target parameters required to import the key material.

[0180] The identification information of the quantum key of this embodiment can be used to obtain the quantum key in the key management service system. The quantum key obtained by the key management system can encrypt the target parameter, and the encrypted target parameter is sent to the terminal by the key management system. At this time, the RSA algorithm is replaced by the quantum key, so this embodiment no longer needs to send RSA public key information. The encrypted target parameter of this embodiment can be decrypted by the quantum key obtained by the terminal from the first quantum key distribution system, so that the terminal obtains the target parameter, and performs relevant processing on the target parameter, which can be used to import the key material, so that the key material and the master key are saved in the hierarchical storage system.

[0181] In this embodiment, the target parameter may be a parameter required for importing the key material, such as a token or other required target parameters. After the terminal performs relevant processing, the key material may be encrypted by the quantum key of the terminal and then sent to the key management service system. The encrypted key material may be decrypted by the quantum key in the key management service system, and then the key material and the corresponding master key may be stored in the hierarchical storage system.

[0182] As an optional implementation, the identification information is used to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

[0183] In this embodiment, the identification information is used to enable the key management service system to obtain the quantum key, which may be to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

[0184] As an optional implementation, the key management service system and the second quantum key distribution system are deployed in the first data center.

[0185] The first data center of this embodiment may be a data center of a cloud service provider, that is, the key management service system and the second quantum key distribution system are deployed in the data center of the cloud service provider.

[0186] As an optional implementation, in step S602, before the first quantum key distribution system obtains the first request sent by the terminal, the method also includes: the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0187] In this embodiment, before the first quantum key distribution system obtains the first request sent by the terminal, the first quantum key distribution system can perform protocol interaction with the terminal to authenticate the terminal. Optionally, the first quantum key distribution system of this embodiment can obtain a second request sent by the terminal, which is also an identity authentication request, for authenticating the terminal. The first quantum key distribution system obtains the second request, responds to the second request, authenticates the terminal, and can return an authentication result of authenticating the terminal to the terminal.

[0188] As an optional implementation, step S602, the first quantum key distribution system obtains a first request sent by the terminal, including: when the first quantum key distribution system successfully authenticates the terminal, obtaining the first request sent by the terminal.

[0189] In this embodiment, the terminal may send a first request for obtaining a quantum key to the first quantum key distribution system only when the terminal is authenticated by the first quantum key distribution system, thereby enabling the first quantum key distribution system to obtain the first request.

[0190] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0191] The following introduces a method for strengthening the security of data keys against quantum attacks based on the QKD system of this embodiment.

[0192] As an optional implementation, step S602, the first quantum key distribution system obtains a first request sent by a terminal, including: the first quantum key distribution system obtains a first request sent by a terminal and carrying identification information of a quantum key.

[0193] In this embodiment, the first request for requesting to obtain a quantum key obtained by the first quantum key distribution system may carry identification information of the quantum key.

[0194] As an optional implementation, in step S604, the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, including: the first quantum key distribution system searches for the quantum key based on the identification information and sends the found quantum key to the terminal.

[0195] In this embodiment, after the first quantum key distribution system obtains the identification information carrying the quantum password sent by the terminal, the quantum key can be searched according to the identification information. When the first quantum key distribution system finds the quantum key corresponding to the identification information, the found quantum key can be sent to the terminal.

[0196] As an optional implementation, in step S602, before the first quantum key distribution system obtains the first request sent by the terminal, the method also includes: when the terminal receives the identification information, the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0197] In this embodiment, the terminal can receive a request message sent by the key management service system. If it is determined that the message includes identification information of the quantum key, the first quantum key distribution system can perform protocol interaction with the terminal to authenticate the identity of the terminal.

[0198] As an optional implementation, the first quantum key distribution system obtains a first request carrying identification information of a quantum key sent by a terminal, including: when the first quantum key distribution system authenticates the terminal, the first quantum key distribution system obtains the first request carrying identification information sent by the terminal.

[0199] In this embodiment, only when the first quantum key distribution system authenticates the terminal successfully, the terminal can send a first request carrying identification information to the first quantum key distribution system, so that the first quantum key distribution system obtains the identification information.

[0200] As an optional implementation manner, the identification information received by the terminal is sent by the key management service system.

[0201] In this embodiment, the key management service system has identification information, and the identification information received by the terminal may be identification information sent by the key management service system, for example, identification information carried by a synchronization message of a key ID sent by the key management service system.

[0202] As an optional implementation, the identification information in the key management service system is obtained by the second quantum key distribution system responding to the third request sent by the key management service system.

[0203] In this embodiment, the identification information in the above-mentioned key management service system can be obtained by sending a third request to the second quantum key distribution system through the key management service system, and the second quantum key distribution system obtains it by responding to the third request.

[0204] As an optional implementation, the third request is also used by the key management service system to request the second quantum key distribution system to obtain the quantum key.

[0205] In this embodiment, the third request is not only used to request the second quantum key distribution system to obtain the identification information of the quantum key, but also used by the key management service system to request the second quantum key distribution system to obtain the quantum key, that is, the second quantum key distribution system can return the quantum key and the identification information of the quantum key to the key management service system at the same time.

[0206] As an optional implementation, the quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal, and the encrypted data key is decrypted by the terminal using the quantum key on the terminal, wherein the decrypted data key is used to encrypt the local data of the terminal.

[0207] In this embodiment, the key management service system obtains the quantum key from the second quantum service system to the data key, and sends the encrypted data key to the terminal. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks. The quantum key sent by the first quantum key distribution system to the terminal can enable the terminal to decrypt the encrypted data key, and the decrypted data key can be used to encrypt the local data of the terminal.

[0208] As an optional implementation, when the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

[0209] In this embodiment, when the terminal obtains the quantum key from the first quantum key distribution system, a key ID notification message can be sent to the key management service system, so that the quantum key in the key management service system is used to encrypt the data key.

[0210] As an optional implementation, the first quantum key distribution system and the terminal are deployed in the second data center.

[0211] In this embodiment, the second data center can be a data center for government and enterprise users, and can be a computer room owned by government and enterprise users. The first quantum key distribution system and the terminal can be deployed in the above-mentioned second data center, wherein the second data center can be used to store important user data, such as sensitive configuration information, database connection information, database passwords, login keys, sensitive communication content, confidential files and confidential information, etc.

[0212] This embodiment targets the TLS protocol that is not resistant to quantum attacks. Based on the QKD system, the data key is reinforced to resist quantum attacks, thereby improving the security of data protection.

[0213] The data processing method of this embodiment can be applied in the hybrid cloud scenario. It is based on the first quantum key distribution system and provides quantum keys to terminals to perform security reinforcement against quantum attacks, thereby achieving the purpose of resisting quantum attacks. It is a solution with small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and improving the security of data protection.

[0214] The embodiment of the present invention also provides another data processing method from the terminal side.

[0215] Figure 7 FIG. 1 is a flow chart of another data processing method according to an embodiment of the present invention. Figure 7 As shown, the method may include the following steps:

[0216] Step S702: The terminal sends a first request to the first quantum key distribution system.

[0217] In the technical solution provided in the above step S702 of the present invention, the terminal can send a first request to the first quantum key distribution system, and the first request is also a quantum key acquisition request, so as to request the first quantum key distribution system to obtain a quantum key.

[0218] Step S704: The terminal obtains a quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0219] In the technical solution provided in the above step S704 of the present invention, after the terminal sends a first request to the first quantum key distribution system, the terminal can obtain at least a quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0220] The terminal of this embodiment sends the above-mentioned first request to the first quantum key distribution system, and the terminal obtains the quantum key sent by the first quantum key distribution system to the terminal in response to the first request. The quantum key is also the user quantum key, which is further used to encrypt or decrypt the data to be processed, wherein the data to be processed can be the target parameters required for importing the encrypted user key material, or can be the key material that needs to be sent to the key management service system, etc.

[0221] Through the above steps S702 to S704 of the embodiment of the present invention, the terminal sends a first request to the first quantum key distribution system; the terminal obtains the quantum key at least sent by the first quantum key distribution system in response to the first request. In other words, the present application provides quantum keys to the terminal based on the first quantum key distribution system for security reinforcement against quantum attacks, thereby achieving the purpose of anti-quantum attacks. It is a solution with small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in protecting data and achieving the goal of improving the security of data protection.

[0222] The following introduces a method for strengthening the security of the key material of the user's own master key against quantum attacks based on the QKD system in this embodiment.

[0223] As an optional implementation, in step S704, after the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, the method further includes: the terminal encrypts the key material by means of the quantum key, and sends the encrypted key material to the key management service system, wherein the encrypted key material is decrypted by the key management service system, and the decrypted key material and the corresponding master key are stored in the hierarchical storage management system.

[0224] In this embodiment, after the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, the terminal can use the quantum key obtained from the first quantum key distribution system to encrypt the key material, and then send the encrypted key material to the key management system. The encrypted key material can be decrypted by the key management system using the obtained quantum key, and saved together with the corresponding master key in the hierarchical storage management system to improve the security of the master key.

[0225] As an optional implementation, step S704, the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, including: the terminal obtains the quantum key and identification information of the quantum key sent by the first quantum key distribution system in response to the first request.

[0226] In this embodiment, the terminal can not only obtain the quantum key sent by the first quantum key distribution system in response to the first request, but also obtain the identification information of the quantum key sent by the first quantum key distribution system in response to the first request.

[0227] As an optional implementation, the method also includes: the terminal sends identification information to a key management service system, wherein the identification information is used to enable the key management service system to obtain a quantum key, and the obtained quantum key is used to encrypt a target parameter; the terminal obtains the encrypted target parameter sent by the key management service system; the terminal decrypts the encrypted target parameter by using the quantum key to obtain the target parameter, wherein the target parameter is used to save the key material in a hierarchical storage system.

[0228] In this embodiment, after the terminal obtains the identification information obtained from the first quantum key distribution system, the identification information can be sent to the key management service system. The identification information of the quantum key can be used to obtain the quantum key in the key management service system. The quantum key obtained by the key management system can encrypt the target parameter, and the encrypted target parameter is sent to the terminal by the key management system. At this time, the RSA algorithm is replaced by the quantum key, so this embodiment no longer needs to send RSA public key information. The terminal of this embodiment can use the quantum key obtained from the first quantum key distribution system to decrypt the encrypted target parameter, so that the terminal obtains the target parameter, and performs relevant processing on the target parameter, which can be used to import the key material, so that the key material and the master key are saved in the hierarchical storage system.

[0229] As an optional implementation, the identification information is used to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

[0230] In this embodiment, the identification information is used to enable the key management service system to obtain the quantum key, which may be to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

[0231] As an optional implementation, in step S702, before the terminal sends a first request to the first quantum key distribution system, the method also includes: the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0232] In this embodiment, before the terminal sends the first request to the first quantum key distribution system, the terminal can perform protocol interaction with the first quantum key distribution system so that the first quantum key distribution system authenticates the terminal. Optionally, the terminal of this embodiment sends a second request to the first quantum key distribution system, and the second request is also an identity authentication request, which is used to authenticate the terminal. The terminal can obtain the authentication result of the first quantum key distribution system responding to the second request to authenticate the terminal.

[0233] As an optional implementation, step S702, the terminal sends a first request to the first quantum key distribution system, including: when the terminal is authenticated by the first quantum key distribution system, the terminal sends the first request to the first quantum key distribution system.

[0234] In this embodiment, only when the terminal is authenticated by the first quantum key distribution system can the terminal send a first request to the first quantum key distribution system for requesting to obtain a quantum key, thereby enabling the first quantum key distribution system to obtain the above first request.

[0235] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0236] The following introduces a method for strengthening the security of data keys against quantum attacks based on the QKD system of this embodiment.

[0237] As an optional implementation manner, step S702, the terminal sends a first request to the first quantum key distribution system, including: the terminal sends the first request carrying identification information of the quantum key to the first quantum key distribution system.

[0238] In this embodiment, the terminal may first obtain identification information of the quantum key, and then send a first request carrying the identification information of the quantum key to the first quantum key distribution system.

[0239] As an optional implementation, step S704, the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request, including: the terminal obtains the quantum key found by the first quantum key distribution system based on the identification information.

[0240] In this embodiment, after the terminal sends a first request carrying identification information of a quantum key to the first quantum key distribution system, the terminal can obtain the quantum key found by the first quantum key distribution system in response to the first request based on the identification information.

[0241] As an optional implementation, in step S702, before the terminal sends a first request to the first quantum key distribution system, the method also includes: when the terminal receives the identification information, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0242] In this embodiment, the terminal can receive a request message sent by the key management service system. If it is determined that the message includes identification information of the quantum key, the first quantum key distribution system can perform protocol interaction with the terminal and start authenticating the identity of the terminal.

[0243] As an optional implementation, the terminal sends a first request carrying identification information of a quantum key to a first quantum key distribution system, including: when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request carrying identification information to the first quantum key distribution system.

[0244] In this embodiment, only when the terminal is authenticated by the first quantum key distribution system can the terminal send a first request carrying identification information to the first quantum key distribution system, thereby enabling the first quantum key distribution system to obtain the identification information.

[0245] As an optional implementation, before the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system, the method further includes: the terminal receives identification information sent by the key management service system.

[0246] In this embodiment, the key management service system has identification information, and the identification information received by the terminal may be identification information sent by the key management service system, for example, identification information carried by a synchronization message of a key ID sent by the key management service system.

[0247] As an optional implementation, the identification information in the key management service system is obtained by the second quantum key distribution system responding to the third request sent by the key management service system.

[0248] In this embodiment, the identification information in the above-mentioned key management service system can be obtained by sending a third request to the second quantum key distribution system through the key management service system, and the second quantum key distribution system obtains it by responding to the third request.

[0249] As an optional implementation, the third request is also used by the key management service system to request the second quantum key distribution system to obtain the quantum key.

[0250] In this embodiment, the third request is not only used to request the second quantum key distribution system to obtain the identification information of the quantum key, but also used by the key management service system to request the second quantum key distribution system to obtain the quantum key, that is, the second quantum key distribution system can return the quantum key and the identification information of the quantum key to the key management service system at the same time.

[0251] As an optional implementation, the method also includes: the terminal obtains an encrypted data key obtained by pairing the data key with a quantum key in a key management service system; the terminal decrypts the encrypted data key using the quantum key on the terminal; and the terminal encrypts local data of the terminal using the decrypted data key.

[0252] In this embodiment, the key management service system uses the quantum key pair data key obtained from the second quantum service system, and the terminal can obtain the data key encrypted by the key management service system. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks. After the terminal obtains the encrypted data key, the encrypted data key can be decrypted by the quantum key obtained from the first quantum key distribution system, and then the decrypted data key is used to encrypt the local data of the terminal.

[0253] Optionally, in this embodiment, when the terminal obtains the quantum key from the first quantum key distribution system, a key ID notification message can be sent to the key management service system, so that the quantum key in the key management service system is used to encrypt the data key.

[0254] This embodiment targets the TLS protocol that is not resistant to quantum attacks. Based on the QKD system, the data key is reinforced to resist quantum attacks, thereby improving the security of data protection.

[0255] The data processing method of an embodiment of the present invention is introduced below from the side of the second quantum key distribution system.

[0256] Figure 8 FIG. 1 is a flow chart of another data processing method according to an embodiment of the present invention. Figure 8 As shown, the method may include the following steps:

[0257] Step S802: The second quantum key distribution system obtains a third request sent by the key management service system.

[0258] In the technical solution provided in the above step S802 of the present invention, the third request is used to request at least obtaining a quantum key from the key management service system.

[0259] Step S804: The second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system, where the quantum key is used to encrypt or decrypt the data to be processed.

[0260] In the technical solution provided in the above step S804 of the present invention, after the second quantum key distribution system obtains the third request sent by the key management service system, the second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system. The quantum key can be used to encrypt or decrypt the data to be processed, wherein the data to be processed can be parameters required when importing self-contained key materials, data keys, etc.

[0261] This embodiment can be applied in the hybrid cloud scenario. It provides quantum keys to the key management service system based on the second quantum key distribution system to perform security reinforcement against quantum attacks, thereby achieving the purpose of resisting quantum attacks. It is a solution with smaller granularity and lower development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and improving the security of data protection.

[0262] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0263] The following introduces the security reinforcement of the key material of the user's own master key against quantum attacks based on the QKD system of the data system of this embodiment.

[0264] As an optional implementation, the quantum key is used to encrypt the target parameters in the key management service system. The encrypted target parameters are sent to the terminal by the key management service system. The quantum key in the terminal is used to decrypt the encrypted target parameters to obtain the target parameters. The target parameters are used to save the key material and the corresponding master key in the hierarchical storage system.

[0265] In this embodiment, the quantum key sent by the second quantum key distribution system to the key management service system is used to encrypt the target parameters. The encrypted target parameters can be sent to the terminal by the key management service system. At this time, the RSA algorithm is replaced by the quantum key, so there is no need to send the RSA public key information; the quantum key obtained from the first quantum key distribution system in the terminal is used to decrypt the encrypted target parameters to obtain the target parameters, which are used to save the key material and the corresponding master key in the hierarchical storage system.

[0266] In this embodiment, the target parameter may be a parameter required for importing the key material, such as a token or other required target parameters, etc. After the terminal performs relevant processing on the key material, the terminal may encrypt the key material by a quantum key and then send the encrypted key material to the key management service system.

[0267] As an optional implementation, step S802, the second quantum key distribution system obtains the third request sent by the key management service system, including: the second quantum key distribution system obtains the third request carrying identification information of the quantum key.

[0268] In this embodiment, the key management service system may first obtain the identification information of the quantum key, and the second quantum key distribution system may obtain the third request sent by the key management service system and carrying the identification information of the quantum key.

[0269] As an optional implementation, in step S804, the second quantum key distribution system responds to the third request and sends the quantum key to the key management service system, including: the second quantum key distribution system searches for the quantum key based on the identification information, and sends the found quantum key to the key management service system.

[0270] In this embodiment, after the second quantum key distribution system obtains the identification information sent by the key management server, the corresponding quantum key can be searched based on the identification information. When the second quantum key distribution system finds the corresponding quantum key, the found quantum key can be sent to the key management service system.

[0271] As an optional implementation, in step S802, before the second quantum key distribution system obtains the third request sent by the key management service system, the method also includes: when the key management service system receives the identification information, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0272] In this embodiment, the key management service system receives a request message and finds that it includes identification information of the quantum key, such as quantum key ID information. The key management service system can perform a protocol interaction with the second quantum key distribution system. The second quantum key distribution system obtains the fourth request sent by the key management service system and responds to the fourth request to authenticate the key management service system, which may be to authenticate the identity of the key management service system.

[0273] As an optional implementation, step S802, the second quantum key distribution system obtains the third request sent by the key management service system, including: when the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0274] In this embodiment, after the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system can obtain the third request carrying the identification information of the quantum key sent by the key management service system, so that the second quantum key distribution system sends the quantum key to the key management system according to the identification information, and then encrypts the target parameters by the quantum key in the key management system to send the encrypted target parameters to the terminal.

[0275] As an optional implementation, the quantum key in the terminal is also used to encrypt the key material on the terminal. The encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system. The decrypted key material and master key are stored in the hierarchical storage management system.

[0276] In this embodiment, the quantum key obtained by the terminal from the first quantum key distribution system is used to encrypt the key material generated by the user on the terminal, and the key management service system obtains the encrypted key material and decrypts it using the quantum key obtained from the second quantum key distribution system to store the decrypted key material and the master key in the hierarchical management system.

[0277] As an optional implementation, the quantum key in the terminal is obtained by a first quantum key distribution system in response to a first request sent by the terminal.

[0278] As an optional implementation, the second quantum key distribution system sends at least a quantum key to the key management service system, including: the second quantum key distribution system sends the quantum key and identification information of the quantum key to the key management service system.

[0279] This embodiment targets the RSA algorithm and TLS protocol that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key is reinforced against quantum attacks, thereby improving the security of data protection.

[0280] The following introduces a method for strengthening the security of data keys against quantum attacks based on the QKD system of this embodiment.

[0281] As an optional implementation, the identification information of the quantum key is sent by the key management service system to the terminal, and the first request carrying the identification information of the quantum key is sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

[0282] In this embodiment, the second quantum key distribution system can send identification information of the quantum key to the key management service system, and the identification information of the quantum key can be sent to the terminal by the key management service system through a synchronization message of the key ID, so that the terminal sends a first request carrying the identification information to the first quantum key distribution system, and then obtains the quantum key sent by the first quantum key distribution system.

[0283] As an optional implementation, the quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal, and the encrypted data key is decrypted by the terminal using the quantum key on the terminal, wherein the decrypted data key is used to encrypt the local data of the terminal.

[0284] In this embodiment, the quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks; the encrypted data key is decrypted by the terminal through the quantum key obtained by the terminal from the first quantum key distribution system, so that the terminal can encrypt the local data of the terminal through the decrypted data key.

[0285] As an optional implementation, when the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

[0286] In this embodiment, when the terminal obtains the quantum key from the first quantum key distribution system, the key ID notification message is obtained and sent by the terminal to the key management service system, and the key management service system can respond to the key ID notification message and encrypt the data key.

[0287] As an optional implementation, in step S802, before the second quantum key distribution system obtains the third request sent by the key management service system, the method also includes: the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0288] In this embodiment, before the second quantum key distribution system obtains the third request sent by the key management service system, the second quantum key distribution system can directly obtain the fourth request sent by the key management service system, respond to the fourth request, start to authenticate the key management service system, and then send the authentication result to the key management service system.

[0289] As an optional implementation, step S802, the second quantum key distribution system obtains the third request sent by the key management service system, including: when the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0290] In this embodiment, when the authentication result is that the second quantum key distribution system has passed the authentication of the key management service system, the second quantum key distribution system can obtain the third request sent by the key management service system, and return the quantum key and corresponding identification information to the key management service system in response to the third request.

[0291] In this embodiment, for the TLS protocol that is not resistant to quantum attacks, the data key can be reinforced against quantum attacks based on the QKD system, thereby improving the security of data protection.

[0292] The following is an introduction to the data processing method on the key management service system side of this embodiment.

[0293] Fig. 9 FIG. 1 is a flow chart of another data processing method according to an embodiment of the present invention. Fig. 9 As shown, the method may include the following steps:

[0294] Step S902: The key management service system sends a third request to the second quantum key distribution system.

[0295] In the technical solution provided in the above step S902 of the present invention, the key management service system can be used to help users create, delete and manage keys, and can ensure the confidentiality, integrity and availability of keys. As a very important basic service in the data encryption link, it plays a key role in data security. How to manage keys more securely is a top priority to ensure the security of sensitive data of government and enterprise users. The key management service system generally uses envelope encryption technology (Envelope Encryption), and its security strictly depends on the security of the user's master key and data key. Among them, envelope encryption technology is a technology applied to the key management service system. When the user encrypts or decrypts the core data, only the data key needs to be transmitted without using the user's master key. Thereby, the data key is used to encrypt or decrypt the user data.

[0296] The key management service system of this embodiment can send a third request to the second quantum key distribution system. The third request is also a quantum key acquisition request, which is used to request the key management service system to at least obtain a quantum key.

[0297] Step S904: The key management service system obtains at least a quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0298] In the technical solution provided in the above step S904 of the present invention, after the key management service system sends the third request to the second quantum key distribution system, the second quantum key distribution system responds to the third request and obtains at least the quantum key. The key management service system obtains the quantum key sent by the second quantum key distribution system, and the quantum key is used to encrypt or decrypt the data to be processed, wherein the data to be processed may be parameters required when importing self-contained key materials, data keys, etc.

[0299] This embodiment can be applied in the hybrid cloud scenario. It provides quantum keys to the key management service system based on the second quantum key distribution system to perform security reinforcement against quantum attacks, thereby achieving the purpose of resisting quantum attacks. It is a solution with smaller granularity and lower development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and improving the security of data protection.

[0300] This embodiment can be used for RSA algorithms and TLS protocols that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key can be reinforced against quantum attacks, thereby improving the security of data protection.

[0301] The following introduces the security reinforcement of the key material of the user's own master key against quantum attacks based on the QKD system of the data system of this embodiment.

[0302] As an optional implementation, the method also includes: the key management service system encrypts the target parameter by means of a quantum key, and sends the encrypted target parameter to the terminal, wherein the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter, and the target parameter is used to save the key material and the corresponding master key in the hierarchical storage system.

[0303] In this embodiment, the key management service system can obtain the quantum key from the second quantum key distribution system, encrypt the target parameter by the quantum key, and then send the encrypted target parameter to the terminal. At this time, the RSA algorithm is replaced by the quantum key, so there is no need to send the RSA public key information; the quantum key obtained from the first quantum key distribution system in the terminal is used to decrypt the encrypted target parameter sent by the key management system, so as to obtain the target parameter, which is used to save the key material and the corresponding master key in the hierarchical storage system.

[0304] In this embodiment, the target parameter may be a parameter required for importing the key material, such as a token or other required target parameters, etc. After the terminal performs relevant processing on the key material, the key material may be encrypted by the quantum key, and the key management service system obtains the encrypted key material, decrypts the encrypted key material by the quantum key obtained from the second quantum key distribution system, and then saves the key material and the corresponding master key to the hierarchical storage system.

[0305] As an optional implementation, step S902, the key management service system sends a third request to the second quantum key distribution system, including: the key management service system sends a third request carrying identification information of the quantum key to the second quantum key distribution system.

[0306] In this embodiment, the key management service system may first obtain the identification information of the quantum key, for example, obtain the identification information of the quantum key obtained from the first quantum key distribution system sent by the terminal, and then send a third request carrying the identification information of the quantum key to the second quantum key distribution system.

[0307] As an optional implementation, in step S904, the key management service system obtains the quantum key sent by the second quantum key distribution system in response to the third request, including: the key management service system obtains the quantum key found by the second quantum key distribution system based on the identification information.

[0308] In this embodiment, after the key management service system sends a third request carrying identification information of the quantum key to the second quantum key distribution system, the second quantum key distribution system can search for the corresponding quantum key based on the identification information, and the key management service system obtains the quantum key found by the second quantum key distribution system based on the identification information.

[0309] As an optional implementation, in step S902, before the key management service system sends the third request to the second quantum key distribution system, the method also includes: when the key management service system receives the identification information, the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the prime number second quantum key distribution system to authenticate the key management service system.

[0310] In this embodiment, the key management service system receives a request message and finds that it includes identification information of the quantum key, for example, quantum key ID information. The key management service system can perform protocol interaction with the second quantum key distribution system, send a fourth request to the second quantum key distribution system, and receive the result of authentication of the key management service system sent by the second quantum key distribution system in response to the fourth request.

[0311] As an optional implementation, step S902, the key management service system sends a third request to the second quantum key distribution system, including: when the key management service system is authenticated by the second quantum key distribution system, the key management service system sends a third request to the second quantum key distribution system.

[0312] In this embodiment, after the key management service system passes the identity authentication, the key management system can send a third request carrying the identification information of the quantum key to the second quantum key distribution system, so that the second quantum key distribution system sends the quantum key to the key management system according to the identification information, and then encrypts the target parameter by the quantum key in the key management system to send the encrypted target parameter to the terminal.

[0313] As an optional implementation, the method also includes: the key management service system obtains the encrypted key material obtained by encrypting the key material with the quantum key in the terminal; the key management service system decrypts the encrypted key material, wherein the decrypted key material and the master key are stored in a hierarchical storage management system.

[0314] In this embodiment, the quantum key obtained by the terminal from the first quantum key distribution system is used to encrypt the key material generated by the user on the terminal, and the key management service system obtains the encrypted key material and decrypts it using the quantum key obtained from the second quantum key distribution system to store the decrypted key material and the master key in the hierarchical management system.

[0315] As an optional implementation, the quantum key in the terminal is obtained by a first quantum key distribution system in response to a first request sent by the terminal.

[0316] This embodiment targets the RSA algorithm and TLS protocol that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key is reinforced against quantum attacks, thereby improving the security of data protection.

[0317] As an optional implementation, in step S904, the key management service system obtains at least the quantum key sent by the second quantum key distribution system in response to the third request, including: the key management service system obtains the quantum key and identification information of the quantum key sent by the second quantum key distribution system in response to the third request.

[0318] The following introduces a method for strengthening the security of data keys against quantum attacks based on the QKD system of this embodiment.

[0319] As an optional implementation, the method also includes: the key management service system sends the identification information of the quantum key to the terminal, wherein a first request carrying the identification information of the quantum key is sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

[0320] In this embodiment, the key management service system can obtain the identification information of the quantum key sent by the second quantum key distribution system. The key management service system sends the identification information of the quantum key to the terminal through a key ID synchronization message, so that the terminal sends a first request carrying the identification information to the first quantum key distribution system, and then obtains the quantum key sent by the first quantum key distribution system.

[0321] As an optional implementation, the method also includes: the key management service system encrypts the data key using the acquired quantum key, and sends the encrypted data key to the terminal, wherein the encrypted data key is decrypted by the terminal using the quantum key on the terminal, and the decrypted data key is used to encrypt the local data of the terminal.

[0322] In this embodiment, the key management service system encrypts the data key by using the quantum key obtained from the second quantum key distribution system, and sends the encrypted data key to the terminal. At this time, even if the TLS protocol is cracked, the data key cannot be decrypted, thereby achieving the purpose of resisting quantum attacks; the encrypted data key is decrypted by the terminal through the quantum key obtained by the terminal from the first quantum key distribution system, so that the terminal can encrypt the local data of the terminal through the decrypted data key.

[0323] As an optional implementation, the key management service system encrypts the data key by using the acquired quantum key, including: when the terminal acquires the quantum key, the key management service system encrypts the data key by using the acquired quantum key.

[0324] In this embodiment, when the terminal obtains the quantum key from the first quantum key distribution system, the key management system obtains the key ID notification message sent by the terminal, and can respond to the key ID notification message to encrypt the data key.

[0325] As an optional implementation, in step S902, before the key management service system sends the third request to the second quantum key distribution system, the method also includes: the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the second quantum key distribution system to authenticate the key management service system.

[0326] In this embodiment, before the key management service system sends the third request to the second quantum key distribution system, the key management service system can be authenticated first. The key management service system can directly send a fourth request to the second quantum key distribution system, so that the second quantum key distribution system responds to the fourth request, starts to authenticate the key management service system, and obtains the authentication result of the second quantum key distribution system authenticating the key management service system.

[0327] As an optional implementation, the key management service system sends a third request to the second quantum key distribution system, including: when the second quantum key distribution system authenticates the key management service system, the key management service system sends the third request to the second quantum key distribution system.

[0328] In this embodiment, when the authentication result received by the key management service system is that the key management service system authentication is passed, the key management service system can send a third request to the second quantum key distribution system to obtain the quantum key and corresponding identification information issued by the second quantum key distribution system in response to the third request.

[0329] This embodiment improves the traditional envelope encryption technology by combining it with the QKD system, and uses the quantum key generated by the QKD system to protect the weak links of the KMS system envelope encryption technology in a targeted manner. This is the data security aspect that government and enterprise users pay the most attention to in the hybrid cloud model. It is a solution with smaller granularity and lower development and deployment difficulty. The use of this embodiment can achieve the purpose of KMS system's resistance to quantum attacks, further enhance the security of data keys and master keys, and give them the ability to resist quantum attacks, so that the data security of government and enterprise users in the hybrid cloud model is further strengthened.

[0330] Example 3

[0331] In this embodiment, in the hybrid cloud mode, when government and enterprise users use the KMS cloud service product, four typical operations include: creation of a master key; creation of a data key; encryption of sensitive data; and decryption of sensitive data.

[0332] In the hybrid cloud scenario, basic services such as KMS are deployed in the cloud service provider's data center, and users' important data (such as sensitive configuration information, database connection information, database passwords, login keys, sensitive communication content, confidential files and confidential information, etc.) are deployed in the government and enterprise users' own computer rooms or data centers. Therefore, in the actual process of using KMS, plaintext data keys need to be transmitted between the cloud service provider's data center and the government and enterprise users' data center, usually in an encrypted channel that is not resistant to quantum attacks (such as TLS).

[0333] Fig.10 FIG. 1 is a schematic diagram of creating a master key according to the related art. Fig.10 As shown, the following steps may be included:

[0334] S1, terminal 3 initiates a request to create a master key.

[0335] After receiving a creation request, KMS4 usually generates a master key using default parameters and saves it in the hierarchical storage management.

[0336] S2: If you want to further improve the security of the master key, you can choose to import the key material created by the user.

[0337] The key material must ensure randomness. It is recommended to use the random source generated by a quantum random number generator as the key material.

[0338] S3, two-way message, first, terminal 3 sends a request message to KMS4, requesting the parameters needed to import the self-contained key material. After receiving it, KMS4 returns a response message, which includes RSA public key, token and other information. At this time, the request message is protected by TLS encryption channel (indicated by A).

[0339] S4, after the terminal 3 performs relevant decoding operations on the RSA public key, the terminal 3 uses the RSA public key to encrypt the key material and performs relevant encoding operations;

[0340] S5, sends the encrypted message to KMS4, and the message is protected through the TLS encryption channel (indicated by B).

[0341] The data processing method of the present application can be as follows Figure 3 As shown, Fig.10 The difference between A and B is that this application is aimed at RSA algorithm and TLS protocol that are not resistant to quantum attacks. Based on the QKD system, the key material of the user's own master key is reinforced against quantum attacks. This is achieved through the following steps:

[0342] S1, terminal 3 sends an identity authentication request to QKD1.

[0343] S2, QKD1 responds to the identity authentication request and returns the authentication result of terminal 3 to terminal 3.

[0344] In this embodiment, a protocol interaction is performed between the terminal 3 and QKD1. First, QKD1 performs identity authentication on the terminal 3.

[0345] S3: When the terminal 3 is successfully authenticated, the terminal 3 sends a quantum key acquisition request to QKD1.

[0346] S4, QKD1 returns the quantum key and the corresponding quantum key ID information to terminal 3.

[0347] S5, after the terminal 3 generates the key material, it sends a request message to the KMS 4 for obtaining the parameters required to import the key material. The request message needs to include the ID information of the quantum key.

[0348] S6, KMS4 receives the request message, determines that the request message includes the ID information of the quantum key, and sends an identity authentication request to QKD2.

[0349] S7, QKD2 responds to the identity authentication request and returns the authentication result of KMS4's identity authentication to KMS4.

[0350] S8. When the authentication of KMS4 is successful, KMS4 sends a key acquisition request to QKD2 according to the given key ID to request the corresponding quantum key.

[0351] S9, KMS4 obtains the quantum key returned by QKD2.

[0352] S10, KMS4 imports the user key material into the required target parameters (such as tokens, or other required parameters, etc.) and encrypts them using quantum keys.

[0353] S11, KMS4 returns the encrypted target parameter to terminal 3, that is, the RSA algorithm is replaced by the quantum key, so there is no need to send the RSA public key information, so Fig.10 A and B are different.

[0354] S12, after obtaining the encrypted target parameters, terminal 3 uses the quantum key obtained from QKD1 to decrypt the encrypted target parameters, obtains the target parameters required by the user to import the key material, and performs relevant processing on them to import the key material.

[0355] S13, terminal 3 then encrypts the key material using the quantum key obtained from QKD1.

[0356] S14, the terminal 3 sends the encrypted key material to the KMS 4;

[0357] S15, KMS4 uses the quantum key obtained from QKD2 to decrypt the encrypted key material to obtain the key material.

[0358] S16, KMS4 saves the master key corresponding to the key material to HSM5.

[0359] The above method of this embodiment uses the quantum key generated by the QKD system to protect the weak links of the KMS4 system envelope encryption technology in a targeted manner. It is a solution with small granularity and relatively low development and deployment difficulty. The use of this solution can achieve the purpose of KMS4 system's resistance to quantum attacks, and provides further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model.

[0360] Fig.11 FIG. 1 is a schematic diagram of creating a data key according to the related art. Fig.11 As shown, the following steps may be included:

[0361] S1, terminal 3 sends a request message for creating a data key to KMS4, wherein the request message must include the ID information of the master key used to encrypt the data key.

[0362] S2, S3, S4, KMS4 generates an unencrypted data key, and obtains the corresponding master key from HSM5 according to the master key ID in the user request message, and uses the master key to encrypt the unencrypted data key through the symmetric encryption algorithm.

[0363] S5, KMS4 sends the encrypted data key and the unencrypted data key to terminal 3. At this time, the data is protected through the TLS encryption channel. (Indicated by C)

[0364] Fig.12 is a schematic diagram of encrypting sensitive data according to a related technology. Fig.12 As shown, the following steps may be included:

[0365] S1, the user uses the unencrypted data key to encrypt important plaintext data (sensitive data) to obtain ciphertext data.

[0366] S2, the terminal 3 puts the encrypted data key and the encrypted ciphertext data into a ciphertext file (secret file) for local secure storage.

[0367] For S3, unencrypted data keys need to be destroyed in memory after use for key security.

[0368] Fig.13 is a schematic diagram of decrypting sensitive data according to a related technology. Fig.13 As shown, the following steps may be included:

[0369] S1, S2 terminal 3 needs to decrypt the encrypted data (Encrypted data key), firstly takes out the encrypted data key from the secret file (secret file), and sends it to KMS4.

[0370] S3, S4, and KMS4 obtain the master key from HSM5 and use the master key to decrypt the encrypted data key.

[0371] S5, KMS4 returns the decrypted data key (unencrypted data key) to the user, and the key content is protected through the TLS encryption channel (indicated by D).

[0372] S6 and S7 unencrypted data keys are encrypted using an encryption algorithm and stored in encrypted files.

[0373] The data processing method of the present application can be as follows Figure 4 As shown, Fig.11 C in Fig.13 The difference is that this application is for the TLS protocol that is not resistant to quantum attacks. We use the QKD system to strengthen the security of data keys against quantum attacks. This is achieved through the following steps:

[0374] S1, KMS4 sends an identity authentication request to QKD2.

[0375] S2, QKD2 responds to the identity authentication request and returns the authentication result of KMS4 to terminal 3.

[0376] In this embodiment, a protocol interaction is performed between KMS4 and QKD2. First, QKD2 performs identity authentication on KMS4.

[0377] S3: When KMS4 authentication succeeds, KMS4 sends a quantum key acquisition request to QKD2.

[0378] S4, QKD2 returns the quantum key and the corresponding quantum key ID information to KMS4.

[0379] S5, KMS4 sends a key ID synchronization message to terminal 3.

[0380] S6, terminal 3 receives the synchronization message and finds the quantum key ID information contained therein, and then similarly interacts with QKD1 through protocol, sending an identity authentication request to QKD1 to authenticate terminal 3.

[0381] S7, QKD1 returns the authentication result to terminal 3.

[0382] S8, when the terminal 3 succeeds in authentication, the terminal 3 sends a quantum key acquisition request carrying the ID information of the quantum key to QKD1, requesting to obtain the quantum key;

[0383] S9, QKD1 sends the quantum key to terminal 3.

[0384] S10, the terminal 3 sends a key ID notification message to the KMS 4.

[0385] S11, KMS4 encrypts the data key using the quantum key obtained from QKD2.

[0386] S12, KMS4 sends the encrypted data key to terminal 3, that is, even if the TLS protocol is cracked, the data key cannot be decrypted, thus achieving the purpose of resisting quantum attacks, and Fig.11 C in Fig.13The D in is different.

[0387] S13, terminal 3 uses the quantum key obtained from QKD1 to decrypt the encrypted data key, and can use it to encrypt local data.

[0388] The above method of this embodiment uses the quantum key generated by the QKD system to specifically protect the weak links of the KMS system envelope encryption technology. It is a solution with small granularity and relatively low development and deployment difficulty. The use of this solution can achieve the purpose of KMS system's resistance to quantum attacks, and provides further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model.

[0389] The data processing method of this embodiment can be a method for providing anti-quantum attack capability for envelope encryption technology based on the QKD system, which is to improve the traditional envelope encryption technology by combining the QKD system, so that the security of data keys and master keys is further improved, and the ability to resist quantum attacks is given, so that the data security of government and enterprise users in the hybrid cloud mode is further strengthened.

[0390] Example 4

[0391] The embodiment of the present invention further provides a data processing device. It should be noted that the data processing device of this embodiment can be used to execute the embodiment of the present invention. Figure 6 The data processing method shown.

[0392] Fig.14 is a schematic diagram of a data processing device according to an embodiment of the present invention. Fig.14 As shown, the data processing device 140 may include: a first acquiring unit 141 and a first sending unit 142 .

[0393] The first obtaining unit 141 is configured to enable the first quantum key distribution system to obtain a first request sent by a terminal.

[0394] The first sending unit 142 is used to enable the first quantum key distribution system to respond to the first request and send at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0395] The embodiment of the present invention also provides another data processing device. It should be noted that the data processing device of this embodiment can be used to execute the embodiment of the present invention. Figure 7 The data processing method shown.

[0396] Fig.15 is a schematic diagram of a data processing device according to an embodiment of the present invention. Fig.15As shown, the data processing device 150 may include: a second sending unit 151 and a second acquiring unit 152 .

[0397] The second sending unit 151 is used to enable the terminal to send a first request to the first quantum key distribution system.

[0398] The second acquisition unit 152 is used to enable the terminal to acquire at least the quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0399] The embodiment of the present invention also provides another data processing device. It should be noted that the data processing device of this embodiment can be used to execute the embodiment of the present invention. Figure 8 The data processing method shown.

[0400] Fig.16 is a schematic diagram of another data processing device according to an embodiment of the present invention. Fig.16 As shown, the data processing device 160 may include: a third acquiring unit 161 and a third sending unit 162 .

[0401] The third obtaining unit 161 is used to enable the second quantum key distribution system to obtain a third request sent by the key management service system.

[0402] The third sending unit 162 is used to enable the second quantum key distribution system to respond to the third request and send at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0403] The embodiment of the present invention also provides another data processing device. It should be noted that the data processing device of this embodiment can be used to execute the embodiment of the present invention. Fig. 9 The data processing method shown.

[0404] Fig.17 is a schematic diagram of another data processing device according to an embodiment of the present invention. Fig.17 As shown, the data processing device 170 may include: a fourth sending unit 171 and a fourth acquiring unit 172 .

[0405] The fourth sending unit 171 is used to enable the key management service system to send a third request to the second quantum key distribution system.

[0406] The fourth obtaining unit 172 is used to enable the key management service system to obtain the quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0407] The data processing device of this embodiment performs security reinforcement against quantum attacks based on the quantum key provided to the terminal by the first quantum key distribution system, thereby achieving the purpose of resisting quantum attacks. It is a solution with small granularity and relatively low development and deployment difficulty. It can provide further security reinforcement for data security, which is the most important aspect for government and enterprise users in the hybrid cloud model, thereby solving the technical problem of low security in data protection and achieving the goal of improving the security of data protection.

[0408] Example 5

[0409] An embodiment of the present invention may provide a mobile terminal, which may be any computer terminal device in a computer terminal group.

[0410] Optionally, in this embodiment, the mobile terminal may be located in at least one network device among a plurality of network devices of a computer network.

[0411] In this embodiment, the mobile terminal may execute the program codes of the following steps in the data processing method of the application program:

[0412] The first quantum key distribution system obtains a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0413] Optionally, Fig.18 is a structural block diagram of a mobile terminal according to an embodiment of the present invention. Fig.18 As shown, the mobile terminal A may include: one or more (only one is shown in the figure) processors 182 , a memory 184 , and a transmission device 186 .

[0414] Among them, a transmission device is connected to the processor and is used to obtain a first request sent by the terminal; and a memory is connected to the processor and the transmission device, and is used to provide the processor with instructions for processing the following processing steps: in response to the first request, at least a quantum key is sent to the terminal, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0415] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the data processing method and device in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned data processing method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the mobile terminal A via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0416] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the first quantum key distribution system sends the quantum key and the identification information of the quantum key to the terminal.

[0417] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the first quantum key distribution system obtains the first request sent by the terminal, the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0418] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the first quantum key distribution system authenticates the terminal successfully, obtain the first request sent by the terminal.

[0419] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the first quantum key distribution system obtains a first request sent by the terminal that carries identification information of the quantum key.

[0420] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the first quantum key distribution system searches for the quantum key based on the identification information and sends the found quantum key to the terminal.

[0421] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the first quantum key distribution system obtains the first request sent by the terminal, when the terminal receives the identification information, the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0422] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the first quantum key distribution system successfully authenticates the terminal, the first quantum key distribution system obtains the first request carrying identification information sent by the terminal.

[0423] As another optional implementation, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal sends a first request to the first quantum key distribution system; the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0424] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: after the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request, the terminal encrypts the key material by the quantum key and sends the encrypted key material to the key management service system, wherein the encrypted key material is decrypted by the key management service system, and the decrypted key material and the corresponding master key are stored in the hierarchical storage management system.

[0425] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal obtains the quantum key and identification information of the quantum key sent by the first quantum key distribution system in response to the first request.

[0426] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal sends the identification information to the key management service system, wherein the identification information is used to enable the key management service system to obtain the quantum key, and the obtained quantum key is used to encrypt the target parameter; the terminal obtains the encrypted target parameter sent by the key management service system; the terminal decrypts the encrypted target parameter by using the quantum key to obtain the target parameter, wherein the target parameter is used to save the key material in the hierarchical storage system.

[0427] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the terminal sends a first request to the first quantum key distribution system, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0428] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request to the first quantum key distribution system.

[0429] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system.

[0430] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal obtains the quantum key found by the first quantum key distribution system based on the identification information.

[0431] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the terminal sends a first request to the first quantum key distribution system, when the terminal receives the identification information, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0432] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request carrying identification information to the first quantum key distribution system.

[0433] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system, the terminal receives identification information sent by the key management service system.

[0434] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the terminal obtains the encrypted data key obtained by the quantum key in the key management service system; the terminal decrypts the encrypted data key through the quantum key on the terminal; the terminal encrypts the local data of the terminal through the decrypted data key.

[0435] As another optional implementation, the processor may call the information and application stored in the memory through the transmission device to perform the following steps: the second quantum key distribution system obtains a third request sent by the key management service system; the second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0436] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the second quantum key distribution system obtains a third request carrying identification information of the quantum key.

[0437] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the second quantum key distribution system searches for the quantum key based on the identification information and sends the found quantum key to the key management service system.

[0438] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the second quantum key distribution system obtains the third request sent by the key management service system, when the key management service system receives the identification information, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0439] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0440] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the second quantum key distribution system sends the quantum key and the identification information of the quantum key to the key management service system.

[0441] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the second quantum key distribution system obtains the third request sent by the key management service system, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0442] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the second quantum key distribution system authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

[0443] As an optional implementation, the processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system sends a third request to the second quantum key distribution system; the key management service system obtains the quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0444] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: the key management service system encrypts the target parameters through the quantum key and sends the encrypted target parameters to the terminal, wherein the quantum key in the terminal is used to decrypt the encrypted target parameters to obtain the target parameters, and the target parameters are used to save the key materials and the corresponding master keys in the hierarchical storage system.

[0445] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system sends a third request carrying identification information of the quantum key to the second quantum key distribution system.

[0446] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system obtains the quantum key found by the second quantum key distribution system based on the identification information.

[0447] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the key management service system sends a third request to the second quantum key distribution system, when the key management service system receives the identification information, the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the prime number second quantum key distribution system to authenticate the key management service system.

[0448] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the key management service system is authenticated by the second quantum key distribution system, the key management service system sends a third request to the second quantum key distribution system.

[0449] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system obtains the encrypted key material obtained by encrypting the key material with the quantum key in the terminal; the key management service system decrypts the encrypted key material, wherein the decrypted key material and the master key are stored in the hierarchical storage management system.

[0450] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system obtains the quantum key and identification information of the quantum key sent by the second quantum key distribution system in response to the third request.

[0451] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the key management service system sends the identification information of the quantum key to the terminal, wherein a first request carrying the identification information of the quantum key is sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

[0452] The processor can call the information and applications stored in the memory through the transmission device to perform the following steps: the key management service system encrypts the data key through the acquired quantum key, and sends the encrypted data key to the terminal, wherein the encrypted data key is decrypted by the terminal through the quantum key on the terminal, and the decrypted data key is used to encrypt the local data of the terminal.

[0453] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the terminal obtains the quantum key, the key management service system encrypts the data key using the obtained quantum key.

[0454] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: before the key management service system sends the third request to the second quantum key distribution system, the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the second quantum key distribution system to authenticate the key management service system.

[0455] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: when the second quantum key distribution system authenticates the key management service system, the key management service system sends a third request to the second quantum key distribution system.

[0456] An embodiment of the present invention provides a data processing method, wherein a first quantum key distribution system obtains a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed, thereby achieving a technical effect of improving the security of data protection, thereby solving the technical problem of low security of data protection.

[0457] It can be understood by those skilled in the art that Fig.18 The structure shown is for illustration only, and the mobile terminal A may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Fig.18It does not limit the structure of the above mobile terminal. For example, mobile terminal A may also include Fig.18 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Fig.18 Different configurations are shown.

[0458] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0459] Example 6

[0460] The embodiment of the present invention further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data processing method provided in the above embodiment 1.

[0461] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0462] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: the first quantum key distribution system obtains a first request sent by a terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0463] Optionally, the storage medium is configured to store a program code for executing the following steps: the first quantum key distribution system sends a quantum key and identification information of the quantum key to a terminal.

[0464] Optionally, the storage medium is configured to store program code for performing the following steps: before the first quantum key distribution system obtains the first request sent by the terminal, the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0465] Optionally, the storage medium is configured to store a program code for executing the following steps: when the first quantum key distribution system successfully authenticates the terminal, obtaining a first request sent by the terminal.

[0466] Optionally, the storage medium is configured to store a program code for executing the following steps: the first quantum key distribution system obtains a first request sent by a terminal and carrying identification information of a quantum key.

[0467] Optionally, the storage medium is configured to store a program code for executing the following steps: the first quantum key distribution system searches for a quantum key based on the identification information, and sends the found quantum key to the terminal.

[0468] Optionally, the storage medium is configured to store program code for performing the following steps: before the first quantum key distribution system obtains the first request sent by the terminal, when the terminal receives identification information, the first quantum key distribution system obtains the second request sent by the terminal; the first quantum key distribution system responds to the second request and authenticates the terminal.

[0469] Optionally, the storage medium is configured to store a program code for executing the following steps: when the first quantum key distribution system successfully authenticates the terminal, the first quantum key distribution system obtains a first request carrying identification information sent by the terminal.

[0470] Optionally, in this embodiment, the storage medium is configured to store program codes for executing the following steps: the terminal sends a first request to a first quantum key distribution system; the terminal obtains a quantum key at least sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0471] Optionally, the storage medium is configured to store program code for performing the following steps: after the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, the terminal encrypts the key material by means of the quantum key, and sends the encrypted key material to the key management service system, wherein the encrypted key material is decrypted by the key management service system, and the decrypted key material and the corresponding master key are stored in the hierarchical storage management system.

[0472] Optionally, the storage medium is configured to store program code for executing the following steps: the terminal obtains the quantum key and identification information of the quantum key sent by the first quantum key distribution system in response to the first request.

[0473] Optionally, the storage medium is configured to store program code for performing the following steps: the terminal sends identification information to a key management service system, wherein the identification information is used to enable the key management service system to obtain a quantum key, and the obtained quantum key is used to encrypt a target parameter; the terminal obtains the encrypted target parameter sent by the key management service system; the terminal decrypts the encrypted target parameter by using the quantum key to obtain the target parameter, wherein the target parameter is used to save the key material in a hierarchical storage system.

[0474] Optionally, the storage medium is configured to store program code for performing the following steps: before the terminal sends a first request to the first quantum key distribution system, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0475] Optionally, the storage medium is configured to store a program code for executing the following steps: when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request to the first quantum key distribution system.

[0476] Optionally, the storage medium is configured to store program code for executing the following steps: the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system.

[0477] Optionally, the storage medium is configured to store a program code for executing the following steps: the terminal obtains the quantum key found by the first quantum key distribution system based on the identification information.

[0478] Optionally, the storage medium is configured to store program code for performing the following steps: before the terminal sends a first request to the first quantum key distribution system, when the terminal receives identification information, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

[0479] Optionally, the storage medium is configured to store a program code for executing the following steps: when the terminal is authenticated by the first quantum key distribution system, the terminal sends a first request carrying identification information to the first quantum key distribution system.

[0480] Optionally, the storage medium is configured to store a program code for executing the following steps: before the terminal sends a first request carrying identification information of the quantum key to the first quantum key distribution system, the terminal receives identification information sent by the key management service system.

[0481] Optionally, the storage medium is configured to store program code for executing the following steps: the terminal obtains an encrypted data key obtained by pairing the data key with a quantum key in a key management service system; the terminal decrypts the encrypted data key using the quantum key on the terminal; and the terminal encrypts local data of the terminal using the decrypted data key.

[0482] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: the second quantum key distribution system obtains a third request sent by the key management service system; the second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0483] Optionally, the storage medium is configured to store a program code for executing the following steps: the second quantum key distribution system obtains a third request carrying identification information of the quantum key.

[0484] Optionally, the storage medium is configured to store a program code for executing the following steps: the second quantum key distribution system searches for the quantum key based on the identification information, and sends the searched quantum key to the key management service system.

[0485] Optionally, the storage medium is configured to store program code for performing the following steps: before the second quantum key distribution system obtains the third request sent by the key management service system, when the key management service system receives identification information, the second quantum key distribution system obtains the fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0486] Optionally, the storage medium is configured to store a program code for executing the following steps: when the second quantum key distribution system successfully authenticates the key management service system, the second quantum key distribution system obtains a third request sent by the key management service system.

[0487] Optionally, the storage medium is configured to store a program code for executing the following steps: the second quantum key distribution system sends a quantum key and identification information of the quantum key to a key management service system.

[0488] Optionally, the storage medium is configured to store program code for performing the following steps: before the second quantum key distribution system obtains the third request sent by the key management service system, the second quantum key distribution system obtains a fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0489] Optionally, the storage medium is configured to store a program code for executing the following steps: when the second quantum key distribution system successfully authenticates the key management service system, the second quantum key distribution system obtains a third request sent by the key management service system.

[0490] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: the key management service system sends a third request to the second quantum key distribution system; the key management service system obtains at least the quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0491] Optionally, the storage medium is configured to store program code for performing the following steps: the key management service system encrypts the target parameters by means of a quantum key, and sends the encrypted target parameters to a terminal, wherein the quantum key in the terminal is used to decrypt the encrypted target parameters to obtain the target parameters, and the target parameters are used to save the key material and the corresponding master key in a hierarchical storage system.

[0492] Optionally, the storage medium is configured to store program code for executing the following steps: the key management service system sends a third request carrying identification information of the quantum key to the second quantum key distribution system.

[0493] Optionally, the storage medium is configured to store a program code for executing the following steps: the key management service system obtains the quantum key found by the second quantum key distribution system based on the identification information.

[0494] Optionally, the storage medium is configured to store program code for performing the following steps: before the key management service system sends a third request to the second quantum key distribution system, when the key management service system receives identification information, the second quantum key distribution system obtains a fourth request sent by the key management service system; the second quantum key distribution system responds to the fourth request and authenticates the key management service system.

[0495] Optionally, the storage medium is configured to store a program code for executing the following steps: when the second quantum key distribution system successfully authenticates the key management service system, the key management service system sends a third request to the second quantum key distribution system.

[0496] Optionally, the storage medium is configured to store program code for performing the following steps: the key management service system obtains the encrypted key material obtained by encrypting the key material by the quantum key in the terminal; the key management service system decrypts the encrypted key material, wherein the decrypted key material and the master key are stored in a hierarchical storage management system.

[0497] Optionally, the storage medium is configured to store a program code for executing the following steps: the key management service system obtains the quantum key and identification information of the quantum key sent by the second quantum key distribution system in response to the third request.

[0498] Optionally, the storage medium is configured to store program code for executing the following steps: the key management service system sends the identification information of the quantum key to the terminal, wherein a first request carrying the identification information of the quantum key is sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

[0499] Optionally, the storage medium is configured to store program code for performing the following steps: the key management service system encrypts the data key using the acquired quantum key, and sends the encrypted data key to the terminal, wherein the encrypted data key is decrypted by the terminal using the quantum key on the terminal, and the decrypted data key is used to encrypt the local data of the terminal.

[0500] Optionally, the storage medium is configured to store program code for executing the following steps: when the terminal obtains the quantum key, the key management service system encrypts the data key using the obtained quantum key.

[0501] Optionally, the storage medium is configured to store program code for performing the following steps: before the key management service system sends a third request to the second quantum key distribution system, the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the second quantum key distribution system to authenticate the key management service system.

[0502] Optionally, the storage medium is configured to store a program code for executing the following steps: when the second quantum key distribution system successfully authenticates the key management service system, the key management service system sends a third request to the second quantum key distribution system.

[0503] Example 7

[0504] The embodiment of the present invention further provides a processor. Optionally, in this embodiment, the processor runs the program of the data processing method provided in the embodiment 1 above.

[0505] Optionally, in this embodiment, the processor is configured to run the program code of the following steps: the first quantum key distribution system obtains a first request sent by the terminal; the first quantum key distribution system responds to the first request and sends at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0506] Optionally, in this embodiment, the processor is configured to run the program code of the following steps: the terminal sends a first request to a first quantum key distribution system; the terminal obtains a quantum key at least sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed.

[0507] Optionally, in this embodiment, the processor is configured to run the program code of the following steps: the second quantum key distribution system obtains a third request sent by the key management service system; the second quantum key distribution system responds to the third request and sends at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0508] Optionally, in this embodiment, the processor is configured to run the program code of the following steps: the key management service system sends a third request to the second quantum key distribution system; the management service system obtains at least the quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed.

[0509] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0510] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0511] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0512] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0513] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0514] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0515] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: include: The first quantum key distribution system obtains a first request sent by the terminal; The first quantum key distribution system sends at least a quantum key to the terminal in response to the first request, wherein the quantum key is used to encrypt or decrypt the data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

2. The method according to claim 1, characterized in that The decrypted key material and the corresponding master key are stored in a hierarchical storage management system.

3. The method according to claim 2, characterized in that The first quantum key distribution system sends at least a quantum key to the terminal, including: The first quantum key distribution system sends the quantum key and identification information of the quantum key to the terminal.

4. The method according to claim 3, characterized in that The identification information is sent by the terminal to the key management service system, so that the key management service system obtains the quantum key. The obtained quantum key is used to encrypt the target parameter. The encrypted target parameter is sent by the key management service system to the terminal. The quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter. The target parameter is used to save the key material and the master key in the hierarchical storage system.

5. The method according to claim 4, characterized in that The identification information is used to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

6. The method according to claim 5, characterized in that The key management service system and the second quantum key distribution system are deployed in a first data center.

7. The method according to claim 2, characterized in that: Before the first quantum key distribution system obtains the first request sent by the terminal, the method further includes: The first quantum key distribution system obtains a second request sent by the terminal; The first quantum key distribution system responds to the second request and authenticates the terminal.

8. The method according to claim 7, characterized in that The first quantum key distribution system obtains a first request sent by a terminal, including: When the first quantum key distribution system successfully authenticates the terminal, the first request sent by the terminal is obtained.

9. The method according to claim 1, characterized in that: The first quantum key distribution system obtains a first request sent by a terminal, including: The first quantum key distribution system obtains the first request sent by the terminal and carrying identification information of the quantum key.

10. The method according to claim 9, characterized in that The first quantum key distribution system sends at least a quantum key to the terminal in response to the first request, including: The first quantum key distribution system searches for the quantum key based on the identification information, and sends the searched quantum key to the terminal.

11. The method according to claim 9, characterized in that Before the first quantum key distribution system obtains the first request sent by the terminal, the method further includes: When the terminal receives the identification information, the first quantum key distribution system obtains a second request sent by the terminal; The first quantum key distribution system responds to the second request and authenticates the terminal.

12. The method according to claim 11, characterized in that The first quantum key distribution system obtains the first request sent by the terminal and carrying the identification information of the quantum key, including: When the first quantum key distribution system successfully authenticates the terminal, the first quantum key distribution system obtains the first request carrying the identification information sent by the terminal.

13. The method according to claim 11, characterized in that The identification information received by the terminal is sent by a key management service system.

14. The method according to claim 13, characterized in that The identification information in the key management service system is obtained by the second quantum key distribution system responding to a third request sent by the key management service system.

15. The method according to claim 14, characterized in that The third request is also used by the key management service system to request the second quantum key distribution system to obtain the quantum key.

16. The method according to claim 15, characterized in that The quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal, and the encrypted data key is decrypted by the terminal through the quantum key on the terminal, wherein the decrypted data key is used to encrypt the local data of the terminal.

17. The method according to claim 16, characterized in that When the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

18. The method according to any one of claims 1 to 17, characterized in that The first quantum key distribution system and the terminal are deployed in a second data center.

19. A data processing method, characterized in that: include: The terminal sends a first request to the first quantum key distribution system; The terminal obtains at least a quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed; Wherein, after the terminal obtains at least the quantum key sent by the first quantum key distribution system in response to the first request, the method further includes: the terminal encrypts the key material by using the quantum key, and sends the encrypted key material to the key management service system, wherein the encrypted key material is decrypted by the key management service system.

20. The method according to claim 19, characterized in that The decrypted key material and the corresponding master key are stored in a hierarchical storage management system.

21. The method according to claim 20, characterized in that The terminal obtains at least a quantum key sent by the first quantum key distribution system in response to the first request, including: The terminal obtains the quantum key and identification information of the quantum key sent by the first quantum key distribution system in response to the first request.

22. The method according to claim 21, characterized in that The method further comprises: The terminal sends the identification information to a key management service system, wherein the identification information is used to enable the key management service system to obtain the quantum key, and the obtained quantum key is used to encrypt the target parameter; The terminal obtains the encrypted target parameter sent by the key management service system; The terminal decrypts the encrypted target parameter by using the quantum key to obtain the target parameter, wherein the target parameter is used to save the key material in a hierarchical storage system.

23. The method according to claim 22, characterized in that The identification information is used to enable the key management service system to obtain the quantum key from the second quantum key distribution system.

24. The method according to claim 20, characterized in that Before the terminal sends the first request to the first quantum key distribution system, the method further includes: The terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

25. The method according to claim 24, characterized in that The terminal sends a first request to the first quantum key distribution system, including: In a case where the terminal is authenticated by the first quantum key distribution system, the terminal sends the first request to the first quantum key distribution system.

26. The method according to claim 19, characterized in that The terminal sends a first request to the first quantum key distribution system, including: The terminal sends the first request carrying identification information of the quantum key to the first quantum key distribution system.

27. The method according to claim 26, characterized in that The terminal obtains at least a quantum key sent by the first quantum key distribution system in response to the first request, including: The terminal obtains the quantum key found by the first quantum key distribution system based on the identification information.

28. The method according to claim 26, characterized in that Before the terminal sends the first request to the first quantum key distribution system, the method further includes: When the terminal receives the identification information, the terminal sends a second request to the first quantum key distribution system, wherein the second request is used to request the first quantum key distribution system to authenticate the terminal.

29. The method according to claim 28, characterized in that The terminal sends the first request carrying the identification information of the quantum key to the first quantum key distribution system, including: In a case where the terminal is authenticated by the first quantum key distribution system, the terminal sends the first request carrying the identification information to the first quantum key distribution system.

30. The method according to claim 26, characterized in that Before the terminal sends the first request carrying the identification information of the quantum key to the first quantum key distribution system, the method further includes: The terminal receives the identification information sent by the key management service system.

31. The method according to claim 30, characterized in that The identification information in the key management service system is obtained by the second quantum key distribution system responding to a third request sent by the key management service system.

32. The method according to claim 31, characterized in that The third request is also used by the key management service system to request the second quantum key distribution system to obtain the quantum key.

33. The method according to claim 32, characterized in that The method further comprises: The terminal obtains the encrypted data key obtained by using the quantum key in the key management service system to encrypt the data key; The terminal decrypts the encrypted data key by using the quantum key on the terminal; The terminal encrypts the local data of the terminal by using the decrypted data key.

34. A data processing method, characterized in that: include: The second quantum key distribution system obtains a third request sent by the key management service system; The second quantum key distribution system sends at least a quantum key to the key management service system in response to the third request, wherein the quantum key is used to encrypt or decrypt the data to be processed; Among them, the quantum key is used to encrypt the target parameter in the key management service system, the encrypted target parameter is sent to the terminal by the key management service system, and the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter.

35. The method according to claim 34, characterized in that The target parameters are used to enable key material and corresponding master keys to be stored in a tiered storage system.

36. The method according to claim 35, characterized in that The second quantum key distribution system obtains a third request sent by the key management service system, including: The second quantum key distribution system obtains the third request carrying identification information of the quantum key.

37. The method according to claim 36, characterized in that The second quantum key distribution system sends a quantum key to the key management service system in response to the third request, including: The second quantum key distribution system searches for the quantum key based on the identification information, and sends the searched quantum key to the key management service system.

38. The method according to claim 36, characterized in that Before the second quantum key distribution system obtains the third request sent by the key management service system, the method further includes: When the key management service system receives the identification information, the second quantum key distribution system obtains a fourth request sent by the key management service system; The second quantum key distribution system responds to the fourth request and authenticates the key management service system.

39. The method according to claim 38, characterized in that The second quantum key distribution system obtains a third request sent by the key management service system, including: When the second quantum key distribution system successfully authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

40. The method according to claim 35, characterized in that The quantum key in the terminal is also used to encrypt the key material on the terminal. The encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system. The decrypted key material and the master key are stored in a hierarchical storage management system.

41. The method according to claim 35, characterized in that The quantum key in the terminal is obtained by a first quantum key distribution system in response to a first request sent by the terminal.

42. The method according to claim 34, characterized in that The second quantum key distribution system sends at least a quantum key to the key management service system, including: The second quantum key distribution system sends the quantum key and identification information of the quantum key to the key management service system.

43. The method according to claim 42, characterized in that The identification information of the quantum key is sent by the key management service system to the terminal, and the first request carrying the identification information of the quantum key is sent by the terminal to the first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

44. The method according to claim 43, characterized in that The quantum key in the key management service system is used to encrypt the data key, and the encrypted data key is sent to the terminal, and the encrypted data key is decrypted by the terminal through the quantum key on the terminal, wherein the decrypted data key is used to encrypt the local data of the terminal.

45. The method according to claim 44, characterized in that When the terminal obtains the quantum key, the quantum key in the key management service system is used to encrypt the data key.

46. ​​The method according to claim 42, characterized in that Before the second quantum key distribution system obtains the third request sent by the key management service system, the method further includes: The second quantum key distribution system obtains a fourth request sent by the key management service system; The second quantum key distribution system responds to the fourth request and authenticates the key management service system.

47. The method according to claim 46, characterized in that The second quantum key distribution system obtains a third request sent by the key management service system, including: When the second quantum key distribution system successfully authenticates the key management service system, the second quantum key distribution system obtains the third request sent by the key management service system.

48. A data processing method, characterized in that: include: The key management service system sends a third request to the second quantum key distribution system; The key management service system obtains at least a quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt data to be processed; The method further includes: the key management service system encrypts the target parameter by using the quantum key, and sends the encrypted target parameter to the terminal, wherein the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter.

49. The method according to claim 48, characterized in that The method further comprises: The target parameters are used to enable key material and corresponding master keys to be stored in a tiered storage system.

50. The method according to claim 49, characterized in that The key management service system sends a third request to the second quantum key distribution system, including: The key management service system sends the third request carrying the identification information of the quantum key to the second quantum key distribution system.

51. The method according to claim 50, characterized in that The key management service system obtains at least the quantum key sent by the second quantum key distribution system in response to the third request, including: The key management service system obtains the quantum key found by the second quantum key distribution system based on the identification information.

52. The method according to claim 50, characterized in that Before the key management service system sends the third request to the second quantum key distribution system, the method further includes: When the key management service system receives the identification information, the key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the prime number second quantum key distribution system to authenticate the key management service system.

53. The method according to claim 52, characterized in that The key management service system sends a third request to the second quantum key distribution system, including: When the key management service system is authenticated by the second quantum key distribution system, the key management service system sends the third request to the second quantum key distribution system.

54. The method according to claim 49, characterized in that The method further comprises: The key management service system obtains the encrypted key material obtained by encrypting the key material with the quantum key in the terminal; The key management service system decrypts the encrypted key material, wherein the decrypted key material and the master key are stored in a hierarchical storage management system.

55. The method according to claim 49, characterized in that The quantum key in the terminal is obtained by a first quantum key distribution system in response to a first request sent by the terminal.

56. The method of claim 48, wherein: The key management service system obtains at least a quantum key sent by the second quantum key distribution system in response to the third request, including: The key management service system obtains the quantum key and identification information of the quantum key sent by the second quantum key distribution system in response to the third request.

57. The method according to claim 56, characterized in that The method further comprises: The key management service system sends the identification information of the quantum key to the terminal, wherein a first request carrying the identification information of the quantum key is sent by the terminal to a first quantum key distribution system, so that the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request.

58. The method according to claim 57, characterized in that The method further comprises: The key management service system encrypts the data key by using the acquired quantum key, and sends the encrypted data key to the terminal, wherein the encrypted data key is decrypted by the terminal using the quantum key on the terminal, and the decrypted data key is used to encrypt the local data of the terminal.

59. The method according to claim 58, characterized in that The key management service system encrypts the data key by using the acquired quantum key, including: When the terminal obtains the quantum key, the key management service system encrypts the data key using the obtained quantum key.

60. The method of claim 54, wherein: Before the key management service system sends the third request to the second quantum key distribution system, the method further includes: The key management service system sends a fourth request to the second quantum key distribution system, wherein the fourth request is used to request the second quantum key distribution system to authenticate the key management service system.

61. The method according to claim 60, characterized in that The key management service system sends a third request to the second quantum key distribution system, including: When the second quantum key distribution system successfully authenticates the key management service system, the key management service system sends the third request to the second quantum key distribution system.

62. A data processing system, characterized in that: include: A terminal, used for sending a first request; a first quantum key distribution system, configured to send at least a quantum key to the terminal in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

63. A data processing system, characterized in that: include: The key management service system is used to send a third request; a second quantum key distribution system, configured to send at least a quantum key to the key management service system in response to the third request, wherein the quantum key is used to encrypt or decrypt data to be processed; Among them, the quantum key is used to encrypt the target parameter in the key management service system, the encrypted target parameter is sent to the terminal by the key management service system, and the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter.

64. A data processing device, characterized in that: include: A first obtaining unit, configured to enable the first quantum key distribution system to obtain a first request sent by a terminal; a first sending unit, configured to enable the first quantum key distribution system to respond to the first request and send at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

65. A data processing device, characterized in that: include: A second sending unit, configured to enable the terminal to send a first request to the first quantum key distribution system; A second acquisition unit, configured to enable the terminal to acquire at least a quantum key sent by the first quantum key distribution system in response to the first request, wherein the quantum key is used to encrypt or decrypt data to be processed; Among them, after the terminal obtains the quantum key sent by the first quantum key distribution system in response to the first request, the device is also used to enable the terminal to encrypt the key material by using the quantum key, and send the encrypted key material to the key management service system, wherein the encrypted key material is decrypted by the key management service system.

66. A data processing device, characterized in that: include: A third obtaining unit, configured to enable the second quantum key distribution system to obtain a third request sent by the key management service system; a third sending unit, configured to enable the second quantum key distribution system to respond to the third request and send at least a quantum key to the key management service system, wherein the quantum key is used to encrypt or decrypt data to be processed; Among them, the quantum key is used to encrypt the target parameter in the key management service system, the encrypted target parameter is sent to the terminal by the key management service system, and the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter.

67. A data processing device, characterized in that: include: A fourth sending unit, configured to enable the key management service system to send a third request to the second quantum key distribution system; a fourth acquisition unit, configured to enable the management service system to acquire at least a quantum key sent by the second quantum key distribution system in response to the third request, wherein the quantum key is used to encrypt or decrypt data to be processed; The device is also used to enable the key management service system to encrypt the target parameter through the quantum key and send the encrypted target parameter to the terminal, wherein the quantum key in the terminal is used to decrypt the encrypted target parameter to obtain the target parameter.

68. A storage medium, characterized in that The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to perform the following steps: Obtaining a first request sent by a terminal; In response to the first request, at least a quantum key is sent to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

69. A processor, characterized in that: The processor is used to run a program, wherein the following steps are performed when the program is run: Obtaining a first request sent by a terminal; In response to the first request, at least a quantum key is sent to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

70. A mobile terminal, characterized in that: include: processor; A transmission device, connected to the processor, and configured to obtain a first request sent by a terminal; as well as A memory connected to the processor and the transmission device, and configured to provide the processor with instructions for processing the following processing steps: in response to the first request, sending at least a quantum key to the terminal, wherein the quantum key is used to encrypt or decrypt data to be processed; The quantum key is used to encrypt the key material on the terminal, and the encrypted key material is sent by the terminal to the key management service system and decrypted by the key management service system.

Images