Quantum key distribution method, device and computer readable storage medium
By using QRNG to generate and encrypt data keys in the quantum key distribution method, the problem that wireless key demanders cannot transmit quantum keys through fiber channel is solved, and the high security and real-time provision of keys are achieved, which improves the secrets Key security and efficiency.
Patent Information
- Application Number
- CN202210904362.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-28
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-07-28
AI Technical Summary
When the existing quantum key distribution scheme is the wireless key demander, the quantum key cannot be transmitted through the fiber channel, resulting in a long storage time of keys and reducing the security of the key.
By obtaining the request message, generating a data key based on QRNG, and encrypting it using the device identifier and root key, sending the encrypted data key to the key demander, avoiding the key demander for a long time to store it and providing the key in real time.
It improves the security of the key, reduces the possibility that the key will be cracked during transmission, avoids the key demander for a long time, and improves the efficiency of the key usage.
Smart Images
Figure CN115276981B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of cryptography, and in particular to a quantum key distribution method, device, and computer-readable storage medium. Background Art
[0002] In the field of communications, in order to ensure the security and confidentiality of communication data, the two parties in communication can encrypt and decrypt the communication data through quantum keys, and the two parties in communication can also be called key demanders. For example, taking the power distribution network as an example, the master station server and mobile terminals in the power distribution network can encrypt and decrypt the communication data through quantum keys.
[0003] Generally, the quantum key can be transmitted to the key demander through the optical fiber channel, but when the key demander is a wireless key demander, the quantum key cannot be transmitted through the optical fiber channel. In this case, the quantum key can be transmitted to the key demander through offline charging. Figure 1 A schematic diagram of quantum key distribution based on offline filling provided in this application, such as Figure 1 As shown, the key management server provides the quantum key to the key demander through an offline key filling machine.
[0004] In this scheme, the key demander will store the quantum key on his own device after obtaining it for subsequent use. Generally speaking, the longer the quantum key is stored, the easier it is to crack and the lower its security. Therefore, the existing quantum key distribution scheme will result in a longer storage time for the quantum key, which reduces the security of the quantum key. Summary of the invention
[0005] The present application provides a quantum key distribution method, device and computer-readable storage medium, which can avoid long-term storage of quantum keys and improve the security of the keys.
[0006] In order to achieve the above objectives, this application adopts the following technical solutions:
[0007] In a first aspect, a quantum key distribution method is provided, which can be performed by a quantum key distribution device, and the method includes: obtaining a first request message; the first request message is used to request a first key demander to obtain a data key and a second key demander to obtain a data key; the data key is used to encrypt data, the first request message includes a first device identifier of the first key demander and a second device identifier of the second key demander, and the second key demander is a key demander communicating with the first key demander; in response to the first request message, generating a data key based on QRNG; encrypting the data key based on a first key encryption key and a root key corresponding to the first device identifier to obtain a first encrypted data key; encrypting the data key based on a second key encryption key and a root key corresponding to the second device identifier to obtain a second encrypted data key; the root key is used to decrypt the first key encryption key and the second key encryption key; sending a first response message to the first key demander; the first response message includes the first encrypted data key; sending a second response message to the second key demander; the second response message includes the second encrypted data key.
[0008] Based on this scheme, by obtaining a first request message for requesting the first key demander to obtain the data key and the second key demander to obtain the data key, the encrypted data key is sent to the first key demander and the encrypted data key is sent to the second key demander respectively. Compared with the scheme in the prior art in which the key demander stores the key for a long time, on the one hand, the data key in the scheme of the present application is a quantum key with high security, and on the other hand, the scheme of the present application re-encrypts the data key, so that the possibility of the data key being cracked during the transmission process is greatly reduced. Therefore, the scheme of the present application does not need to worry about the data key being cracked during the transmission process, and can provide the data key to the key demander in real time when the key demander needs the data key. The key demander does not need to store the data key for a long time, thereby improving the security of the key.
[0009] In combination with the first aspect, in certain embodiments of the first aspect, a data key is encrypted based on a first key encryption key and a root key corresponding to a first device identifier to obtain a first encrypted data key, including: decrypting the first key encryption key according to the root key to obtain a first re-decryption key; and encrypting the data key according to the first re-decryption key to obtain a first encrypted data key.
[0010] In combination with the first aspect, in certain embodiments of the first aspect, the data key is decrypted based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key, including: encrypting the second key encryption key according to the root key to obtain a second re-decryption key; encrypting the data key according to the second re-decryption key to obtain a second encrypted data key.
[0011] In combination with the first aspect, in certain embodiments of the first aspect, the method also includes: obtaining a second request message; the second request message is used to request the first key demander to obtain the first re-decryption key and the second key demander to obtain the second re-decryption key, and the second request message includes the first device identifier and the second device identifier; generating a first re-decryption key based on QRNG and storing a first correspondence between the first key encryption key and the first device identifier; the first key encryption key is a key after the first re-decryption key is encrypted by the root key; generating a second re-decryption key based on QKD and storing a second correspondence between the second key encryption key and the second device identifier; the second key encryption key is a key after the second re-decryption key is encrypted by the root key; sending a third response message to the first key demander, the third response message including the first re-decryption key; sending a fourth response message to the second key demander, the fourth response message including the second re-decryption key.
[0012] Based on this scheme, by obtaining a second request message for requesting the first key requester to obtain the first key encryption key and the second key requester to obtain the second key encryption key, sending a third response message including the first key encryption key to the first key requester and sending a fourth response message including the second key encryption key to the second key requester, the first key requester can obtain the first key encryption key and the second key requester can obtain the second key encryption key, so that the first key requester can subsequently decrypt the first encrypted data key and the second key requester can subsequently decrypt the second encrypted data key.
[0013] In a second aspect, a quantum key distribution device is provided for implementing the quantum key distribution method of the first aspect. The quantum key distribution device includes a module, unit, or means corresponding to the above method, and the module, unit, or means can be implemented by hardware, software, or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the above functions.
[0014] In combination with the second aspect, in certain embodiments of the second aspect, the quantum key distribution device includes: a transceiver module and a processing module; the transceiver module is used to obtain a first request message; the first request message is used to request the first key demander to obtain a data key and the second key demander to obtain a data key; the data key is used to encrypt data, the first request message includes the first device identifier of the first key demander and the second device identifier of the second key demander, and the second key demander is a key demander communicating with the first key demander; the processing module is used to generate a data key based on QRNG in response to the first request message; the processing module is also used to encrypt the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key; the processing module is also used to encrypt the data key based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key; the root key is used to decrypt the first key encryption key and the second key encryption key; the transceiver module is also used to send a first response message to the first key demander; the first response message includes the first encrypted data key; the transceiver module is also used to send a second response message to the second key demander; the second response message includes the second encrypted data key.
[0015] In combination with the second aspect, in certain embodiments of the second aspect, the processing module is also used to decrypt the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key, including: encrypting the first key encryption key according to the root key to obtain a first re-decryption key; encrypting the data key according to the first re-decryption key to obtain a first encrypted data key.
[0016] In combination with the second aspect, in certain embodiments of the second aspect, the processing module is also used to decrypt the data key based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key, including: encrypting the second key encryption key according to the root key to obtain a second re-decryption key; encrypting the data key according to the second re-decryption key to obtain a second encrypted data key.
[0017] In combination with the second aspect, in certain embodiments of the second aspect, the processing module is also used to: obtain a second request message; the second request message is used to request the first key demander to obtain the first re-decryption key and the second key demander to obtain the second re-decryption key, and the second request message includes the first device identifier and the second device identifier; generate a first re-decryption key based on QRNG and store the first correspondence between the first key encryption key and the first device identifier; the first key encryption key is the first re-decryption key encrypted by the root key; generate a second re-decryption key based on QKD and store the second correspondence between the second key encryption key and the second device identifier; the second key encryption key is the second re-decryption key encrypted by the root key; send a third response message to the first key demander, the third response message includes the first re-decryption key; send a fourth response message to the second key demander, the fourth response message includes the second re-decryption key.
[0018] In a third aspect, a quantum key distribution device is provided, comprising: at least one processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the method provided in the first aspect and any possible implementation manner thereof.
[0019] In a fourth aspect, a computer-readable storage medium is provided. When the instructions in the computer-readable storage medium are executed by a processor of a key distribution device, the key distribution device is enabled to perform the method provided in the first aspect and any possible implementation manner thereof.
[0020] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the method provided in the first aspect and any possible implementation manner thereof.
[0021] In the sixth aspect, a chip system is provided, comprising: a processor and an interface circuit; the interface circuit is used to receive a computer program or instruction and transmit it to the processor; the processor is used to execute the computer program or instruction so that the chip system executes the method provided in the first aspect above and any possible implementation manner thereof.
[0022] Among them, the technical effects brought about by any implementation of the second to sixth aspects can refer to the technical effects brought about by different implementations of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 A schematic diagram of quantum key distribution based on offline filling provided in this application;
[0024] Figure 2 A schematic diagram of the architecture of a quantum key distribution system provided for this application;
[0025] Figure 3 A schematic diagram of the architecture of another quantum key distribution system provided in this application;
[0026] Figure 4 A schematic diagram of a process of quantum key distribution method provided in this application;
[0027] Figure 5 A flowchart of another quantum key distribution method provided in this application;
[0028] Figure 6a A flowchart of another quantum key distribution method provided in this application;
[0029] Figure 6b A schematic diagram of multiple encryption provided for this application;
[0030] Figure 7 A flowchart of another quantum key distribution method provided in this application;
[0031] Figure 8 A schematic diagram of the structure of a quantum key distribution device provided in this application;
[0032] Fig. 9 This is a schematic diagram of the structure of another quantum key distribution device provided in this application. DETAILED DESCRIPTION
[0033] In the description of this application, unless otherwise specified, "plurality" means two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.
[0034] In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.
[0035] Meanwhile, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.
[0036] It is understood that the "embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, the various embodiments in the entire specification do not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It is understood that in various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.
[0037] It can be understood that in the present application, "when", "if" and "if" all mean that corresponding processing will be carried out under certain objective circumstances, but do not limit the time, nor do they require judgment actions when implementing them, nor do they mean the existence of other limitations.
[0038] It can be understood that some optional features in the embodiments of the present application may be implemented independently in certain scenarios without relying on other features, such as the solution on which they are currently based, to solve corresponding technical problems and achieve corresponding effects, or may be combined with other features according to needs in certain scenarios. Accordingly, the devices provided in the embodiments of the present application may also realize these features or functions accordingly, which will not be elaborated here.
[0039] In this application, unless otherwise specified, the same or similar parts between the various embodiments can refer to each other. In the various embodiments in this application, and the various implementation methods in each embodiment, if there is no special description and logical conflict, the terms and / or descriptions between different embodiments and the various implementation methods in each embodiment are consistent and can be referenced to each other. The technical features in different embodiments and the various implementation methods in each embodiment can be combined to form new embodiments, implementation methods, implementation methods, or implementation methods according to their inherent logical relationships. The following implementation methods of this application do not constitute a limitation on the scope of protection of this application.
[0040] Figure 2 This is a schematic diagram of the architecture of a quantum key distribution system provided in this application. The technical solution of the embodiment of this application can be applied to Figure 2 The quantum key distribution system shown in Figure 2As shown, the quantum key distribution system 20 includes a quantum key distribution device 21 and an electronic device 22.
[0041] Among them, the quantum key distribution device 21 is directly or indirectly connected to the electronic device 22. In this connection relationship, a wired connection or a wireless connection can be adopted, which is not limited in the embodiment of the present application.
[0042] The quantum key distribution device 21 may also be referred to as an edge access node. The quantum key distribution device 21 may be used to generate keys and receive data from the electronic device 22.
[0043] The quantum key distribution device 21 includes two quantum key generators 211 ( Figure 2 Only one quantum key generator 211) and a key management server 212 are shown, wherein the quantum key generator 211 is used to generate keys, and the key management server 212 is used to manage the keys, such as deleting keys and storing keys.
[0044] The two quantum key generators 211 may be a quantum random number generator (QRNG) and a quantum key distribution (QKD).
[0045] The electronic device 22 can be used to send data to the quantum key distribution device 21.
[0046] It should be noted that the quantum key distribution device 21 and the electronic device 22 can be independent devices or integrated into the same device, and this application does not make any specific limitations on this.
[0047] When the quantum key distribution device 21 and the electronic device 22 are integrated into the same device, the communication between the quantum key distribution device 21 and the electronic device 22 is the communication between the internal modules of the device. In this case, the communication process between the two is the same as "the communication process between the quantum key distribution device 21 and the electronic device 22 when they are independent of each other".
[0048] In the following embodiments provided in the present application, the present application is explained by taking the quantum key distribution device 21 and the electronic device 22 as an example in which they are independently configured.
[0049] In practical applications, the quantum key distribution method provided in the embodiments of the present application can be applied to the quantum key distribution device 21, and can also be applied to the device included in the quantum key distribution device 21.
[0050] Figure 3 A schematic diagram of the architecture of another quantum key distribution system provided in this application is as follows: Figure 3 As shown, the quantum key distribution system 20 provided in the present application also includes a first key demander 23, a second key demander 24, and a bearer network 25.
[0051] Among them, the first key demander 23 is directly or indirectly connected to the quantum key distribution device 21 through a wireless communication network.
[0052] The second key demander 24 is directly or indirectly connected to the quantum key distribution device 21 via an optical fiber communication network.
[0053] The first key requesting party 23 and the second key requesting party 24 may be directly or indirectly connected via the bearer network 25 .
[0054] The first key requester 23 and the second key requester 24 can be used to obtain the key from the quantum key distribution device 21 . After obtaining the key, the first key requester 23 and the second key requester 24 can communicate through the bearer network 25 .
[0055] When the second key demander 24 communicates with the quantum key distribution device 21, if the transmission data of both parties includes the key, the data can be transmitted through a dedicated optical fiber channel. For example, the data is transmitted through a quantum optical fiber channel. If the transmission data of both parties does not include the key, the data can be transmitted through a common optical fiber channel.
[0056] Taking the power distribution network as an example, the first key demander 23 may be a mobile terminal, and the mobile terminal may be a marketing collection terminal, an intelligent fusion terminal, or a distribution automation terminal, which is not limited in this application.
[0057] The bearer network may be a wireless communication network, for example, the wireless communication network may be a fifth generation (5th generation, 5G) mobile communication network, a 4G network, or a 3G network, and this application does not impose any limitation on this.
[0058] Taking the power distribution network as an example, the second key demander 24 may be a master server, and the second key demander 24 includes a server 241 and a core key device 242 .
[0059] Server 241 is used to support various businesses. For example, server 241 can be a vertical encryption authentication server, a transit server, a front-end server, or a main site business system server, and this application does not impose any restrictions on this.
[0060] The core key device 242 may also be referred to as a core quantum node. The core key device 242 may be used to obtain a key from the quantum key distribution device 21 and transmit it to the server 241. The core key device 242 may include a quantum key generator 2421 and a key management server 2422, wherein the quantum key generator 2421 is used to generate a key, and the key management server 2422 is used to manage the key, such as deleting the key and storing the key.
[0061] The quantum key generator 2421 may be QKD.
[0062] It should be noted that the server 241 and the core key device 242 can be independent devices, or can be integrated into the second key requester 24.
[0063] When the server 241 and the core key device 242 are independent devices, the server 241 and the core key device 242 may communicate with each other through a fiber optic communication network.
[0064] Figure 3 The server 241 and the core key device 242 are integrated into the second key demander 24. When the server 241 and the core key device 242 are integrated into the second key demander 24, the communication mode between the server 241 and the core key device 242 is the communication between the internal modules of the second key demander 24.
[0065] In the following, in conjunction with the accompanying drawings, the quantum key distribution method provided in the embodiment of the present application is described by taking the application of the quantum key distribution method to a quantum key distribution device 21 as an example.
[0066] Figure 4 A schematic diagram of a quantum key distribution method provided in this application, such as Figure 4 As shown, the method comprises the following steps:
[0067] S401. The quantum key distribution device obtains a first request message.
[0068] The first request message is used to request the first key requester to obtain the data key and the second key requester to obtain the data key; the data key is used to encrypt data, the first request message includes the first device identifier of the first key requester and the second device identifier of the second key requester, and the second key requester is the key requester that communicates with the first key requester.
[0069] It should be noted that the data may be data that the first key requester or the second key requester needs to transmit. For example, the data may be status data of the first key requester or the second key requester, or the data may be log data of the first key requester or the second key requester. This application does not impose any restrictions on this.
[0070] The first device identifier may be a physical address of the first key requester, or the first device identifier may be an Internet Protocol address of the first key requester, which is not limited in this application.
[0071] The second device identifier may be a physical address of the second key requester, or the second device identifier may be an Internet Protocol address of the second key requester, which is not limited in this application.
[0072] As a possible implementation, combining Figure 2 The quantum key distribution device receives a message from the electronic device 22, the message including the first request information, and the quantum key distribution device obtains the first request information from the message.
[0073] As another possible implementation manner, the quantum key distribution device receives a message from a first key demander, where the message includes first request information, and the quantum key distribution device obtains the first request information from the message.
[0074] As another possible implementation manner, the quantum key distribution device receives a message from the second key demander, where the message includes the first request information, and the quantum key distribution device obtains the first request information from the message.
[0075] S402. The quantum key distribution device generates a data key based on QRNG in response to the first request message.
[0076] As a possible implementation method, the quantum key distribution device generates an initial data key based on QRNG, processes the initial data key, and obtains a data key.
[0077] It should be noted that the specific solution of this possible implementation method can refer to the existing solution, and this application will not go into details here.
[0078] S403. The quantum key distribution device encrypts the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key.
[0079] It should be noted that the quantum key distribution device stores a first correspondence between a first device identifier and a first key encryption key, a second correspondence between a second device identifier and a second key encryption key, and a root key.
[0080] The root key can be generated based on QRNG.
[0081] As a possible implementation manner, the quantum key distribution device determines the first key encryption key in the first corresponding relationship according to the first device identifier, encrypts the data key based on the first key encryption key and the root key, and obtains the first encrypted data key.
[0082] It should be noted that the specific description of this possible implementation method can be found in the description of the subsequent parts, and this application will not go into details.
[0083] S404. The quantum key distribution device encrypts the data key based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key.
[0084] The root key is used to decrypt the first key encryption key and the second key encryption key.
[0085] As a possible implementation manner, the quantum key distribution device determines the second key encryption key in the second corresponding relationship according to the second device identifier, encrypts the data key based on the second key encryption key and the root key, and obtains the second encrypted data key.
[0086] It should be noted that the specific description of this possible implementation method can be found in the description of the subsequent parts, and this application will not go into details.
[0087] S405. The quantum key distribution device sends a first response message to the first key requester.
[0088] The first response message includes a first encrypted data key.
[0089] As a possible implementation manner, the quantum key distribution device sends a first response message to the first key requester through a wireless communication network.
[0090] It should be noted that the first key requester stores the first key encryption key corresponding to the first device identifier. After the first key requester obtains the first response message, the first key requester can decrypt the first encrypted data key through the first key encryption key to obtain the data key, and subsequently use the data key to encrypt the data.
[0091] S406. The quantum key distribution device sends a second response message to the second key requesting party.
[0092] The second response message includes a second encrypted data key.
[0093] As a possible implementation method, the quantum key distribution device sends a second response message to the second key requester through the optical fiber communication network.
[0094] It should be noted that the second key requester stores a second key encryption key corresponding to the second device identifier. After the second key requester obtains the second response message, the second key requester can decrypt the second encrypted data key using the second key encryption key to obtain the data key, and subsequently use the data key to encrypt the data.
[0095] Based on this scheme, by obtaining a first request message for requesting the first key demander to obtain the data key and the second key demander to obtain the data key, the encrypted data key is sent to the first key demander and the encrypted data key is sent to the second key demander respectively. Compared with the scheme in the prior art in which the key demander stores the key for a long time, on the one hand, the data key in the scheme of the present application is a quantum key with high security, and on the other hand, the scheme of the present application re-encrypts the data key, so that the possibility of the data key being cracked during the transmission process is greatly reduced. Therefore, the scheme of the present application does not need to worry about the data key being cracked during the transmission process, and can provide the data key to the key demander in real time when the key demander needs the data key. The key demander does not need to store the data key for a long time, thereby improving the security of the key.
[0096] The above is a general description of the solution of the present application, and the solution of the present application will be further described below.
[0097] In one design, Figure 5 A flowchart of another quantum key distribution method provided in an embodiment of the present application is as follows: Figure 5 As shown, S403 provided in the specific implementation of this application specifically includes:
[0098] S501. The quantum key distribution device decrypts the first key encryption key according to the root key to obtain a first re-decryption key.
[0099] As a possible implementation manner, the quantum key distribution device obtains the root key stored in the quantum key distribution device, determines the first key encryption key corresponding to the first device identifier in the first corresponding relationship, decrypts the first key encryption key based on the root key, and obtains a first re-decryption key.
[0100] It should be noted that the specific solution for decryption in this possible implementation can refer to the existing solution, and this application will not go into details.
[0101] S502. The quantum key distribution device encrypts the data key according to the first re-decryption key to obtain a first encrypted data key.
[0102] It should be noted that the specific encryption scheme in this possible implementation can refer to the existing scheme, and this application will not go into details. In one design, Figure 6a A flowchart of another quantum key distribution method provided in an embodiment of the present application is as follows: Figure 6a As shown, S404 provided in the specific implementation of this application specifically includes:
[0103] S601. The quantum key distribution device decrypts the second key encryption key according to the root key to obtain a second re-decryption key.
[0104] As a possible implementation manner, the quantum key distribution device obtains the root key stored in the quantum key distribution device, determines the second key encryption key corresponding to the second device identifier in the second corresponding relationship, decrypts the second key encryption key based on the root key, and obtains a second re-decryption key.
[0105] It should be noted that the specific solution for decryption in this possible implementation can refer to the existing solution, and this application will not go into details.
[0106] S602. The quantum key distribution device encrypts the data key according to the second re-decryption key to obtain a second encrypted data key.
[0107] It should be noted that the specific scheme for encryption in this possible implementation can refer to the existing scheme, and this application will not go into details.
[0108] Figure 6b A schematic diagram of multiple encryption provided for this application, such as Figure 6b As shown, the data key can be used to encrypt data, the re-decryption key can be used to encrypt the data key, and the root key can be used to encrypt the re-decryption key.
[0109] In one design, Figure 7 A flowchart of another quantum key distribution method provided in an embodiment of the present application is as follows: Figure 7 As shown, before S401, the quantum key distribution method provided in the embodiment of the present application further includes:
[0110] S701. The quantum key distribution device obtains a second request message.
[0111] The second request message is used to request the first key requester to obtain the first re-decryption key and the second key requester to obtain the second re-decryption key, and the second request message includes the first device identifier and the second device identifier.
[0112] As a possible implementation, combining Figure 2The quantum key distribution device receives a message from the electronic device 22, the message including the second request information, and the quantum key distribution device obtains the second request information from the message.
[0113] As another possible implementation manner, the quantum key distribution device receives a message from the first key demander, where the message includes the second request information, and the quantum key distribution device obtains the second request information from the message.
[0114] As another possible implementation manner, the quantum key distribution device receives a message from a second key demander, where the message includes second request information, and the quantum key distribution device obtains the second request information from the message.
[0115] S702. The quantum key distribution apparatus generates a first re-decryption key based on QRNG and stores a first correspondence between the first key encryption key and the first device identifier.
[0116] The first key encryption key is a key obtained by encrypting the first re-decryption key with the root key.
[0117] As a possible implementation manner, the quantum key distribution device generates a first initial re-decryption key based on QRNG, processes the first initial re-decryption key to obtain a first re-decryption key, encrypts the first re-decryption key according to the root key, and stores the first corresponding relationship in a storage device of the quantum key distribution device.
[0118] It should be noted that the specific solution of this possible implementation method can refer to the existing solution, and this application will not go into details here.
[0119] S703. The quantum key distribution device generates a second re-decryption key based on QKD and stores a second corresponding relationship between the second key encryption key and the second device identifier.
[0120] The second key encryption key is the second re-decryption key encrypted by the root key.
[0121] As a possible implementation method, the quantum key distribution device generates a second initial re-decryption key based on QKD, processes the second initial re-decryption key to obtain a second re-decryption key, encrypts the second re-decryption key according to the root key, and stores the second corresponding relationship in a storage device of the quantum key distribution device.
[0122] It should be noted that the specific solution of this possible implementation method can refer to the existing solution, and this application will not go into details here.
[0123] S704. The quantum key distribution device sends a third response message to the first key requester.
[0124] The third response message includes the first re-decryption key.
[0125] As a possible implementation method, the quantum key distribution device sends a third response message to the first key requester by means of offline filling.
[0126] Exemplarily, the quantum key distribution device sends a third response message to the first key demander by means of quantum superiority shield.
[0127] S705. The quantum key distribution device sends a fourth response message to the second key requester.
[0128] The fourth response message includes the second re-decryption key.
[0129] As a possible implementation manner, the quantum key distribution device sends a fourth response message to the second key requester through the optical fiber communication network.
[0130] Based on this scheme, by obtaining a second request message for requesting the first key requester to obtain the first key encryption key and the second key requester to obtain the second key encryption key, sending a third response message including the first re-decryption key to the first key requester and sending a fourth response message including the second re-decryption key to the second key requester, the first key requester can obtain the first re-decryption key and the second key requester can obtain the second re-decryption key, so that the first key requester can subsequently decrypt the first encrypted data key and the second key requester can subsequently decrypt the second encrypted data key.
[0131] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the quantum key distribution device executing the quantum key distribution method. In order to achieve the above functions, the quantum key distribution device includes hardware structures and / or software modules corresponding to the execution of each function. It should be easy for those skilled in the art to realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0132] The embodiment of the present application can divide the quantum key distribution device into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic, which is only a logical function division, and there may be other division methods in actual implementation. In addition, the "module" here may refer to a specific application-specific integrated circuit (ASIC), a circuit, a processor and memory that executes one or more software or firmware programs, an integrated logic circuit, and / or other devices that can provide the above functions.
[0133] In the case of functional module division, Figure 8 A schematic diagram of the structure of a quantum key distribution device is shown. Figure 8 As shown, the quantum key distribution device 80 includes a transceiver module 801 and a processing module 802.
[0134] In some embodiments, the quantum key distribution device 80 may also include a storage module ( Figure 8 ), for storing program instructions and data.
[0135] Among them, the transceiver module 801 is used to obtain a first request message; the first request message is used to request the first key demander to obtain a data key and the second key demander to obtain a data key; the data key is used to encrypt data, and the first request message includes the first device identifier of the first key demander and the second device identifier of the second key demander, and the second key demander is a key demander that communicates with the first key demander; the processing module 802 is used to generate a data key based on QRNG in response to the first request message; the processing module 802 is also used to encrypt the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key; the processing module 802 is also used to encrypt the data key based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key; the root key is used to decrypt the first key encryption key and the second key encryption key; the transceiver module 801 is also used to send a first response message to the first key demander; the first response message includes the first encrypted data key; the transceiver module 801 is also used to send a second response message to the second key demander; the second response message includes the second encrypted data key.
[0136] Optionally, the processing module 802 is also used to encrypt the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key, including: decrypting the first key encryption key according to the root key to obtain a first re-decryption key; encrypting the data key according to the first re-decryption key to obtain a first encrypted data key.
[0137] Optionally, the processing module 802 is also used to encrypt the data key based on the second key encryption key and the root key corresponding to the second device identifier to obtain a second encrypted data key, including: decrypting the second key encryption key according to the root key to obtain a second re-decryption key; encrypting the data key according to the second re-decryption key to obtain a second encrypted data key.
[0138] Optionally, the processing module 802 is also used to: obtain a second request message; the second request message is used to request the first key requester to obtain the first re-decryption key and the second key requester to obtain the second re-decryption key, the second request message including the first device identifier and the second device identifier; generate a first re-decryption key based on QRNG and store a first correspondence between the first key encryption key and the first device identifier; the first key encryption key is a key after the first re-decryption key is encrypted by the root key; generate a second re-decryption key based on QKD and store a second correspondence between the second key encryption key and the second device identifier; the second key encryption key is a key after the second re-decryption key is encrypted by the root key; send a third response message to the first key requester, the third response message including the first re-decryption key; send a fourth response message to the second key requester, the fourth response message including the second re-decryption key.
[0139] All relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, and will not be repeated here.
[0140] When the functions of the above functional modules are implemented in the form of hardware, Fig. 9 A schematic diagram of the structure of a quantum key distribution device is shown. Fig. 9 As shown, the quantum key distribution device 90 includes a processor 901, a memory 902 and a bus 903. The processor 901 and the memory 902 may be connected via the bus 903.
[0141] The processor 901 is the control center of the quantum key distribution device 90, which can be a processor or a general term for multiple processing elements. For example, the processor 901 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.
[0142] As an embodiment, the processor 901 may include one or more CPUs, such as Fig. 9 CPU 0 and CPU 1 are shown in .
[0143] The memory 902 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.
[0144] As a possible implementation, the memory 902 may exist independently of the processor 901, and the memory 902 may be connected to the processor 901 via a bus 903 for storing instructions or program codes. When the processor 901 calls and executes the instructions or program codes stored in the memory 902, the quantum key distribution method provided in the embodiment of the present application can be implemented.
[0145] In another possible implementation, the memory 902 may also be integrated with the processor 901 .
[0146] The bus 903 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0147] It should be pointed out that Fig. 9 The structure shown does not constitute a limitation on the quantum key distribution device 90. Fig. 9 In addition to the components shown, the quantum key distribution device 90 may include more or fewer components than shown, or combine certain components, or arrange the components differently.
[0148] As an example, combining Figure 8 The functions implemented by the transceiver module 801 and the processing module 802 in the quantum key distribution device 80 are similar to Fig. 9 The function of processor 901 in is the same.
[0149] Optional, such as Fig. 9 As shown, the quantum key distribution device 90 provided in the embodiment of the present application may further include a communication interface 904.
[0150] The communication interface 904 is used to connect with other devices through a communication network. The communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 904 may include a receiving unit for receiving data and a sending unit for sending data.
[0151] In a possible implementation, in the quantum key distribution device 90 provided in the embodiment of the present application, the communication interface 904 can also be integrated in the processor 901, and the embodiment of the present application does not specifically limit this.
[0152] As a possible product form, the quantum key distribution device of the embodiment of the present application can also be implemented using the following: one or more field programmable gate arrays (FPGA), programmable logic devices (PLD), controllers, state machines, gate logic, discrete hardware components, any other suitable circuits, or any combination of circuits that can perform the various functions described throughout this application.
[0153] Through the description of the above implementation methods, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0154] An embodiment of the present application also provides a computer-readable storage medium on which a computer program or instruction is stored. When the computer program or instruction is executed, the computer executes each step in the method flow shown in the above method embodiment.
[0155] An embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer is caused to execute each step in the method flow shown in the above method embodiment.
[0156] An embodiment of the present application provides a chip system, including: a processor and an interface circuit; the interface circuit is used to receive a computer program or instruction and transmit it to the processor; the processor is used to execute the computer program or instruction so that the chip system executes each step in the method flow shown in the above method embodiment.
[0157] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, and a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any other form of computer-readable storage media in a suitable combination of the above, or numerical values in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in a specific-purpose ASIC. In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0158] Since the quantum key distribution device, computer-readable storage medium, and computer program product provided in this embodiment can be applied to the quantum key distribution method provided in this embodiment, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of this application will not be repeated here.
[0159] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other changes to the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.
[0160] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A quantum key distribution method, characterized in that: The method comprises: Obtain a first request message; the first request message is used to request a first key requester to obtain a data key and a second key requester to obtain the data key; the data key is used to encrypt data, the first request message includes a first device identifier of the first key requester and a second device identifier of the second key requester, and the second key requester is a key requester communicating with the first key requester; In response to the first request message, generating the data key based on a quantum random number generator QRNG; The data key is encrypted based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key; specifically: the first key encryption key is decrypted according to the root key to obtain a first re-decryption key; the data key is encrypting according to the first re-decryption key to obtain the first encrypted data key; The data key is encrypted based on the second key encryption key corresponding to the second device identifier and the root key to obtain a second encrypted data key; the root key is used to decrypt the first key encryption key and the second key encryption key; specifically: the second key encryption key is decrypted according to the root key to obtain a second re-decryption key; the data key is encrypted according to the second re-decryption key to obtain the second encrypted data key; Sending a first response message to the first key requester; the first response message includes the first encrypted data key; Sending a second response message to the second key requester; the second response message includes the second encrypted data key; Obtain a second request message; the second request message is used to request the first key demander to obtain the first re-decryption key and the second key demander to obtain the second re-decryption key, and the second request message includes the first device identifier and the second device identifier; Generate the first re-decryption key based on QRNG and store a first correspondence between the first key encryption key and the first device identifier; the first key encryption key is a key obtained by encrypting the first re-decryption key with the root key; Generate the second re-decryption key based on quantum key distribution QKD and store the second corresponding relationship between the second key encryption key and the second device identifier; the second key encryption key is the key after the second re-decryption key is encrypted by the root key; Sending a third response message to the first key requester, wherein the third response message includes the first re-decryption key; A fourth response message is sent to the second key requester, where the fourth response message includes the second re-decryption key.
2. A quantum key distribution device, characterized in that: The device comprises: a transceiver module and a processing module; The transceiver module is used to obtain a first request message; the first request message is used to request a first key demander to obtain a data key and a second key demander to obtain the data key; the data key is used to encrypt data, the first request message includes a first device identifier of the first key demander and a second device identifier of the second key demander, and the second key demander is a key demander communicating with the first key demander; The processing module is used to generate the data key based on QRNG in response to the first request message; The processing module is further configured to encrypt the data key based on the first key encryption key and the root key corresponding to the first device identifier to obtain a first encrypted data key; the processing module is specifically configured to: decrypt the first key encryption key according to the root key to obtain a first re-decryption key; encrypt the data key according to the first re-decryption key to obtain the first encrypted data key; The processing module is further used to encrypt the data key based on the second key encryption key corresponding to the second device identifier and the root key to obtain a second encrypted data key; the root key is used to decrypt the first key encryption key and the second key encryption key; the processing module is specifically used to: decrypt the second key encryption key according to the root key to obtain a second re-decryption key; encrypt the data key according to the second re-decryption key to obtain the second encrypted data key; The transceiver module is further used to send a first response message to the first key requester; the first response message includes the first encrypted data key; The transceiver module is further used to send a second response message to the second key requester; the second response message includes the second encrypted data key; The processing module is further used for: Obtain a second request message; the second request message is used to request the first key demander to obtain the first re-decryption key and the second key demander to obtain the second re-decryption key, and the second request message includes the first device identifier and the second device identifier; Generate the first re-decryption key based on QRNG and store a first correspondence between the first key encryption key and the first device identifier; the first key encryption key is a key obtained by encrypting the first re-decryption key with the root key; Generate the second re-decryption key based on QKD and store the second corresponding relationship between the second key encryption key and the second device identifier; the second key encryption key is the key after the second re-decryption key is encrypted by the root key; Sending a third response message to the first key requester, wherein the third response message includes the first re-decryption key; A fourth response message is sent to the second key requester, where the fourth response message includes the second re-decryption key.
3. A quantum key distribution device, characterized in that: The quantum key distribution device includes: a processor, the processor is coupled to a memory, the memory is used to store programs or instructions, when the program or instructions are executed by the processor, the device executes the method as claimed in claim 1.
4. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instructions are executed, the computer is caused to perform the method as claimed in claim 1 .