Method, system, device and storage medium for secure communication of data

Abstract

The application provides a data secure communication method, system, device and storage medium. The method comprises the following steps: a first network device acquires a mixed key generated by a plurality of keys and a corresponding mixed key identifier from a key server, and generates a pre-shared key based on the mixed key; the mixed key identifier is sent to a second network device, so that the second network device generates a pre-shared key based on the mixed key identifier; and data secure communication is carried out with the second network device based on the pre-shared key. The application can synchronize the creation of the same pre-shared key by each network device using the mixed key generated by the key server associated with the network device. The mixed key is generated based on some quantum secure algorithms. Each network device carries out data transmission between network devices based on the pre-shared key synchronized and created by each network device, so that the data transmission between network devices can resist quantum computing attacks and improve the security of data transmission.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computers, and particularly relates to a data secure communication method, system, device and storage medium. BACKGROUND

[0002] With the development of quantum computing, on the one hand, people's cognition of computing ability is stimulated. On the other hand, because quantum computing has strong parallel computing ability, it also leads to the advantage of quantum computing in password cracking. Therefore, the existing public key cryptography system is difficult to resist the attack of quantum computing.

[0003] Among them, the MACsec (Media Access Control Security) protocol is usually used in the existing public key cryptography system, which is an IEEE standard protocol, used to establish a secure channel at the data link layer of the network protocol, so as to transmit data through the secure channel. Because the MACsec protocol has strong security and only needs a small amount of additional overhead. Therefore, when data centers communicate, the protocol is usually used to ensure the security of data transmission.

[0004] However, because the calculation amount of the public key cryptography system using the MACsec protocol is much lower than the calculation amount that can be reached by quantum computing, the existing public key cryptography system is easy to be cracked under the attack of quantum computing, thereby existing the security risk of data communication. SUMMARY

[0005] The application provides a data secure communication method, system, device and storage medium, which can solve the problem that the existing public key cryptography system is easy to be cracked by quantum computing in the related art.

[0006] The first aspect embodiment of the application provides a data secure communication method, which is applied to a first network device and includes the following steps.

[0007] Obtaining a mixed key generated by a plurality of keys and a corresponding mixed key identifier from a key server, and generating a pre-shared key based on the mixed key;

[0008] Sending the mixed key identifier to a second network device, so that the second network device generates the pre-shared key based on the mixed key identifier;

[0009] Based on the pre-shared key, the first network device performs data secure communication with the second network device.

[0010] The second aspect embodiment of the application provides a data secure communication method, which is applied to a second network device and includes the following steps.

[0011] receive the mixed key identification sent by the first network device;

[0012] select the mixed key corresponding to the mixed key identification from the key server associated with the second network device, and generate a pre-shared key based on the mixed key;

[0013] perform data security communication with the first network device based on the pre-shared key.

[0014] The third aspect of the present application provides a method for data security communication, which is applied to a key server and includes the following steps:

[0015] receive a key generation instruction, and generate a plurality of keys;

[0016] perform key mixing processing on the plurality of keys to generate a mixed key and a corresponding mixed key identification;

[0017] transmit the mixed key and the corresponding mixed key identification to a first network device, so that the first network device performs data security communication with a second network device based on the mixed key and the corresponding mixed key identification.

[0018] The fourth aspect of the present application provides a system for data security communication, which includes:

[0019] a key server configured to perform key mixing processing on a plurality of keys generated by itself to generate a mixed key and a corresponding mixed key identification, and transmit the mixed key and the corresponding mixed key identification to a first network device;

[0020] the first network device configured to receive the mixed key and the corresponding mixed key identification sent by the key server, generate a pre-shared key based on the mixed key, send the mixed key identification to a second network device, and perform data security communication with the second network device based on the pre-shared key;

[0021] the second network device configured to receive the mixed key identification sent by the first network device, select the mixed key corresponding to the mixed key identification from the key server associated with the second network device, generate a pre-shared key based on the mixed key, and perform data security communication with the first network device based on the pre-shared key.

[0022] The fifth aspect of the present application provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to implement the method of the first aspect.

[0023] The embodiment of the sixth aspect of the present application provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the method of the first aspect.

[0024] The technical solution provided in the embodiment of the present application has at least the following technical effects or advantages:

[0025] By applying the technical solution of the present application, each network device can synchronize to create the same pre-shared key by using the mixed key generated by the key server associated with the network device. The mixed key is generated based on some quantum secure algorithm. Each network device performs data transmission between network devices based on the pre-shared key synchronized and created by each network device, so that the data transmission between network devices can resist quantum computing attacks and improve the security of data transmission.

[0026] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0027] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are intended to illustrate preferred embodiments of the present application and to not be considered limiting of the present application. Moreover, like reference numerals denote like parts throughout the accompanying drawings.

[0028] In the drawings:

[0029] Figure 1 A schematic diagram of a method of data secure communication provided by an embodiment of the present application is shown;

[0030] Figure 2 A schematic diagram of a system architecture of data secure communication provided by an embodiment of the present application is shown;

[0031] Figure 3 A schematic diagram of a process of using a pre-shared key PSK to perform secure processing on transmission data in data secure communication provided by an embodiment of the present application is shown;

[0032] Figure 4 A schematic diagram of the overall process of a method of data secure communication provided by an embodiment of the present application is shown;

[0033] Figure 5 A schematic diagram of the overall process of another method of data secure communication provided by an embodiment of the present application is shown;

[0034] Figure 6Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0035] Figure 7 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0036] Figure 8 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0037] Figure 9 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0038] Figure 10 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0039] Figures 11-13 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0040] Figure 14 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application;

[0041] Figure 15 Fig. 6 shows a flow diagram of another data security communication method according to an embodiment of the present application; DETAILED DESCRIPTION

[0042] Exemplary embodiments of the present application will be described herein below with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the application to those skilled in the art.

[0043] It should be noted that unless otherwise specified, technical or scientific terms used in the present application should be understood as their common meaning to those skilled in the art to which the present application pertains.

[0044] A data security communication method, system, device and storage medium according to an embodiment of the present application will be described below with reference to the accompanying drawings.

[0045] The embodiment of the application provides a data secure communication method, which can comprise a first network device, a second network device and a key server. Wherein, the key server is configured to perform key mixing processing on a plurality of keys generated by itself to generate a mixed key and a corresponding mixed key identifier, and then transmit the mixed key and the corresponding mixed key identifier to the first network device; the first network device is configured to receive the mixed key and the corresponding mixed key identifier sent by the key server, generate a pre-shared key based on the mixed key, and then transmit the mixed key identifier to the second network device, and perform data secure communication with the second network device based on the pre-shared key; the second network device is configured to select the mixed key corresponding to the mixed key identifier from the key server associated with itself after receiving the mixed key identifier sent by the first network device, generate a pre-shared key based on the mixed key, and then perform data secure communication with the first network device based on the pre-shared key.

[0046] Referring to Figure 1 The method is applied to the first network device, and specifically comprises the following steps:

[0047] Step 101: Obtain the mixed key and the corresponding mixed key identifier from the key server, and generate a pre-shared key based on the mixed key.

[0048] In order to solve the problem that the network devices do not have the ability to resist quantum computer attacks in the process of data transmission by using various protocols including the MACsec protocol between the network devices. The embodiment of the application provides a data secure communication method, wherein for the first network device, the mixed key and the corresponding mixed key identifier can be obtained from the key server, and a pre-shared key can be generated based on the mixed key.

[0049] In one way, the first network device and the second network device can be network devices deployed in a data center, for example, can be switches, routers, terminal devices and the like. In an embodiment, the first network device and the second network device can support the MACsec protocol.

[0050] In another way, the key server is a server device for generating keys for the network devices (i.e. the first network device or the second network device) associated with it. Wherein, the mixed key obtained by the plurality of keys generated by the key server is used to realize the generation of the subsequent pre-shared key in the embodiment of the application. Then, the pre-shared key is used as a means to resist quantum computer attacks.

[0051] Further, as Figure 2As shown, in the embodiments of the present application, a plurality of data centers can be included, and each data center is deployed with a network device (i.e., a first network device or a second network device) and a key server associated with the network device.

[0052] In one way, for the mixed key obtained from the key server, the generation manner can be that the key server first creates a plurality of keys and mixes the plurality of keys to obtain the mixed key.

[0053] The plurality of keys can be generated for one key generation algorithm or for a plurality of key generation algorithms.

[0054] As an example, the key server can synchronously generate three tasks for creating keys, which are a QKD task, a PQC_A task, and a PQC_B task.

[0055] The PQC (Post-quantum cryptography) is a quantum-safe cryptography or a quantum-safe cryptography, which is specially used for resisting quantum computers and is an encryption algorithm. The PQC can be an algorithm for asymmetric encryption based on at least one of a format, a code, a multivariate, a hash, a super-singular elliptic curve homology, and the like.

[0056] The QKD (Quantum key distribution) is a system composed of a quantum key distribution device and a quantum key management device, which utilizes quantum mechanics to enable communication parties to generate and share a pair of random and secure keys.

[0057] For further example, the key generated by the PQC_A task is a key a, and a key identifier a' corresponding to the key a. The key generated by the PQC_B task is a key b, and a key identifier b' corresponding to the key b. The key generated by the QKD task is a key c, and a key identifier c' corresponding to the key c.

[0058] Further, the three groups of keys (i.e., the key a, the key b, and the key c) can be mixed by a key mixing manner to obtain a final mixed key and a corresponding mixed key identifier.

[0059] In one way, the key mixing manner can adopt an exclusive-OR operation method or a key derivation operation method. It can be understood that the key servers can synchronously generate a plurality of groups of keys according to needs and cache the plurality of groups of keys.

[0060] It should be noted that the above description of the present application is only illustrative, in actual application, parallel tasks can be created between multiple key servers, and each parallel task can be used to generate a key created by at least one quantum cryptography algorithm. The multiple keys are mixed to obtain a mixed key and a corresponding mixed key identifier.

[0061] In one way, the key server can provide key services to the outside through the interface form of the program response interface (REST API). Therefore, the key server is an out-of-band key exchange mechanism for the first network device A and the second network device B.

[0062] In another way, the first network device A and the second network device B can call the program interface (REST API) through the pre-shared key interface (QPSK_handler) existing in itself, so as to request and obtain a mixed key and a corresponding mixed key identifier from the REST API interface to the key server.

[0063] In one way, the first network device A and the second network device B can add the pre-shared key (PSK) and the corresponding pre-shared key identifier (PSK_ID) based on the mixed key to the key chain (MACsec key chain) in the MACsec protocol.

[0064] Step 102: Send the mixed key identifier to the second network device, so that the second network device generates a pre-shared key based on the mixed key identifier.

[0065] Wherein, the first network device can obtain the pre-shared key PSK by processing the mixed key by using the key derivation function KDF. As an example, for example, the calculation formula can be:

[0066] PSK = KDF (QS_KEY_1, 'QPSK', salt, QPSKlength).

[0067] Wherein, PSK is the pre-shared key, QS_KEY_1 is the mixed key, salt is the variable factor, and KDF is the key derivation function.

[0068] Further, after generating the pre-shared key, the first network device also needs to send the mixed key identifier to the second network device, so that the second network device selects the mixed key corresponding to the mixed key identifier from the key server associated with itself, and the second network device obtains the pre-shared key PSK in the same way as the first network device (that is, the second network device also processes the mixed key by using the key derivation function KDF).

[0069] At this point, the first network device and the second network device have generated the same pre-shared key in their respective local.

[0070] Step 103: Based on the pre-shared key, the first network device performs data security communication with the second network device.

[0071] As shown in the flow chart of the first network device performing data security communication with the second network device using the pre-shared key. Figure 3 As can be seen, the first network device can act as a key server and create a secure association key (SAK) that is shared only with the second network device at the other end of the point-to-point link. The SAK is used to protect all data traffic on the link.

[0072] In one way, when the key server detects that the SAK key has expired, it will also be responsible for recreating and sharing a new SAK based on other pre-shared keys PSK.

[0073] Specifically, the first network device as the key server can first import the pre-shared key PSK into a supporting protocol MKA in the MACsec protocol (i.e. key protocol MACsec MKA).

[0074] The PSK includes a connectivity association key name (CKN) and its own connectivity association root key (CAK).

[0075] That is, after the MKA selects one of the network devices as the encryption communication device, the encryption communication device derives the SAK, ICK, and KEK from the CAK. The ICK key is used to verify the integrity and authenticity of the MKA data packet, and the KEK is used by a key server to encrypt and distribute the SAK to other members for use by MACsec.

[0076] In one way, as shown in the overall architecture diagram of the data security communication method proposed in the present application, the following is explained: Figure 5

[0077] Step 1: Key servers A and B belonging to two data centers need to generate multiple keys based on the same key generation algorithm before the MACsec protocol is executed, so that at a suitable time point in the future, the keys are mixed to obtain the same mixed key and the corresponding mixed key identifier.

[0078] ​In one mode, the mixed key generation mode can be to perform a mixed operation on the plurality of keys using an XOR operation to obtain the mixed key. In another mode, the mixed key can also be obtained by performing a mixed operation on the plurality of keys using a key derivation operation.

[0079] The key server A is associated with a first network device, and the key server B is associated with a second network device.

[0080] The key server A generates a mixed key a and a mixed key identifier a', and the key server B generates a mixed key b and a mixed key identifier b'.

[0081] In one mode, the key server A and the key server B each need to create a plurality of parallel tasks, and each parallel task generates at least one key by executing at least one key generation algorithm. Then, the plurality of keys are mixed.

[0082] It should be noted that the key server A and the key server B need to generate the same number of keys and the same generation mode for each key during the generation of the plurality of keys, so as to ensure that the plurality of keys generated by the two key servers are completely consistent.

[0083] In one mode, the key server A and the key server B can ensure that the plurality of keys generated by the two key servers are completely consistent through synchronous negotiation.

[0084] Step 2, the first network device sends a key request message to the key server A for obtaining the mixed key a and the corresponding mixed key identifier a'.

[0085] In one mode, the first network device can send the key request message to the key server A through a pre-shared key interface QPSK_handler.

[0086] Step 3, the key server A returns the mixed key a and the corresponding mixed key identifier a' to the first network device.

[0087] In one mode, the key server A can return the mixed key and the corresponding mixed key identifier to the first network device through the QPSK_handler.

[0088] In one mode, the first network device can perform a mixed operation on the mixed key a by using a key derivation function, so as to obtain a pre-shared key A.

[0089] Step 4, in order to make the second network device also generate the pre-shared key based on the mixed key a, the first network device needs to transmit the mixed key identifier a' to the second network device, so as to achieve the purpose of synchronizing the pre-shared key A with the second network device.

[0090] Step 5, the second network device requests the mixed key corresponding to the mixed key identifier a' from the local key server B.

[0091] Step 6, after the key server B associated with the second network device returns the mixed key B corresponding to the mixed key identifier a' to the second network device, the second network device also performs mixed processing on the mixed key b based on the key derivation function, thereby obtaining the pre-shared key A.

[0092] It can be understood that, since the mixed key a and the mixed key b are the same. Therefore, the pre-shared keys A generated based on the same mixed key are also completely the same.

[0093] Step 7, the second network device sends a key confirmation message to the first network device, which is used to inform the first network device that the second network device has generated the same pre-shared key A based on the mixed key identifier a'.

[0094] Optionally, in one way, the above steps 2-7 can be repeated one or more times as needed, so as to obtain a sufficient number of pre-shared keys, such as mixed key B, mixed key C, and the like.

[0095] In one way, the first network device can count the number of pre-shared keys currently generated, and when it is determined that the number of pre-shared keys is lower than the preset number, the key request message for obtaining other mixed keys is sent to the key server. To achieve the purpose of repeatedly performing the above steps 2-7 to obtain a sufficient number of pre-shared keys.

[0096] Step 8, the first network device and the second network device respectively store the pre-shared key A obtained by each other into the key chain of each other. Or, the first network device and the second network device respectively store the pre-shared key A obtained by each other into the buffer pool of each other.

[0097] Step 9, the first network device and the second network device negotiate to determine one of the network devices as an encryption communication device. And the encryption communication device creates a session key using the pre-shared key, so as to realize subsequent data security communication with the other network device using the session key.

[0098] Among them, the encryption communication device is the initiating device between the two network devices, which actively creates a session key using the pre-shared key and subsequently uses the session key to perform encrypted data transmission with the other end.

[0099] In one way, the first network device and the second network device can be authenticated and an algorithm group can be selected in the negotiation process, and it is determined which network device on the point-to-point link becomes the encryption communication device.

[0100] By applying the technical solution of the present application, each network device can synchronize to create the same pre-shared key by using the hybrid key generated by the key server associated therewith. The hybrid key is generated based on some quantum secure algorithm. Each network device performs data transmission between network devices based on the pre-shared key synchronized and created by itself, so that the data transmission between network devices can resist quantum computing attacks and improve the security of data transmission.

[0101] In an optional embodiment, the embodiment of the present application can generate a pre-shared key based on a hybrid key, including:

[0102] The hybrid key is processed by using a key derivation function to obtain the pre-shared key.

[0103] In an optional embodiment, after generating the pre-shared key based on the hybrid key, the embodiment of the present application further includes:

[0104] The pre-shared key is stored in a key chain, and the number of pre-shared keys stored in the key chain is counted; or the pre-shared key is stored in a cache pool, and the number of pre-shared keys stored in the cache pool is counted.

[0105] If it is determined that the number of pre-shared keys is lower than a preset number, a key request message for obtaining other hybrid keys is sent to the key server.

[0106] In one way, after the QPSK_handler of the first network device and the second network device obtains the pre-shared key, the embodiment of the present application can select to transmit the pre-shared key to different storage objects (i.e., to store in a MACsec key chain or a buffer pool) according to the result of which key transmission protocol the device supports.

[0107] In another way, as shown in Figure 5 After the QPSK_handler of the first network device and the second network device obtains the pre-shared key, the QPSK_handler can store the QPSK and the QPSK_ID in the local cache pool, so as to facilitate the access of the QPSK callback of the first network device and the second network device.

[0108] Further, the QPSK callback of the first network device and the second network device can create a callback function for calling the pre-shared key PSK provided by the TLS 1.3 protocol, and through the callback function, the pre-shared key can be extracted from the cache pool at a subsequent time point for data transmission in the TLS protocol.

[0109] In order to realize dynamic acquisition of the pre-shared key PSK, the QPSK handler should be able to query the cache pool and, when the amount of keys is insufficient, repeatedly generate new pre-shared keys based on the new mixed key obtained from the key server and supplement them to the cache pool.

[0110] The QPSK callback of the first network device and the second network device should obtain new pre-shared keys PSK from the cache pool each time it is called, and be able to synchronize the pre-shared key identifier PSK ID with the opposite end. In one way, in order to reduce the delay of the TLS protocol, the ID synchronization process can also not be performed, and the consistency of the keys in the cache pool of the two ends is guaranteed by the QPSK handler.

[0111] Further, after the pre-shared key PSK is successfully imported, the MSK is generated in the 'psk_dhe_ke' or 'psk_ke' mode for the TLS protocol. Then, according to the MKA protocol, the MSK will be used to generate the CAK, and the subsequent steps are the same as the first way, and the ICK, SAK, and KEK will be derived from the CAK, and the SAK will be transmitted and distributed to the network device of the other end by the selected key server through the KEK encryption.

[0112] In an optional embodiment, the embodiment of the application can further include, before transmitting data based on the pre-shared key for encryption:

[0113] Receiving the key confirmation message sent by the second network device, the key confirmation message being used to represent that the second network device has generated the pre-shared key based on the mixed key identifier.

[0114] In an optional embodiment, the embodiment of the application can encrypt the data transmitted based on the pre-shared key, and send the encrypted transmission data to the second network device, including:

[0115] Extracting the root key CAK in the pre-shared key; or, generating the MSK based on the pre-shared key, and generating the root key CAK by using the MSK;

[0116] Generating the session key SAK, the verification key ICK, and the encryption key KEK by using the CAK; and performing data security communication with the second network device based on the SAK, the ICK, and the KEK.

[0117] In one way, the first network device A and the second network device B can call the REST API interface through the QPSK_handler existing by itself, so as to request and obtain the mixed key and the corresponding mixed key identification from the REST API interface to the key server. Then the network device increases the pre-shared key PSK and PSK_ID generated by the mixed key into the MACsec key chain by providing the REST API or modifying the rules in the XML configuration file.

[0118] In another way, as shown in Figure 6 The way of generating the CAK is different from the first way, wherein the CAK is calculated from the MSK, and the MSK is generated by the EAP-TLS bidirectional authentication protocol, and the PSK in the EAP-TLS is provided by the out-of-band quantum secure key.

[0119] Referring to Figure 7 , the embodiment of the application provides a data secure communication method. Wherein the method is applied to a second network device, and specifically includes the following steps:

[0120] Step 201: receiving the mixed key identification sent by the first network device.

[0121] Step 202: selecting the mixed key corresponding to the mixed key identification from the key server associated with itself, and generating a pre-shared key based on the mixed key.

[0122] In one way, the second network device can also be a network device deployed in a data center and supporting the MACsec protocol, such as a switch, a router, a terminal device, etc.

[0123] In another way, the key server is a server device for generating a key for the second network device associated with it.

[0124] Step 203: performing data secure communication with the first network device based on the pre-shared key.

[0125] The embodiment of the application provides a data secure communication method, wherein for the second network device, it can also first obtain the mixed key and the corresponding mixed key identification from the key server, and generate a pre-shared key based on the mixed key.

[0126] The first network device and the second network device are different in that, after obtaining the mixed key, the first network device not only needs to generate a pre-shared key by using the mixed key, but also needs to send a mixed key identifier corresponding to the mixed key to the second network device, so that the second network device selects a mixed key corresponding to the mixed key identifier from a key server associated with the second network device, and generates a pre-shared key based on the mixed key

[0127] By applying the technical solution of the present application, each network device can synchronize to create the same pre-shared key by using the mixed key generated by the key server associated with the network device. The mixed key is generated based on some quantum secure algorithm. Each network device performs data transmission between network devices based on the pre-shared key synchronized and created by each network device, so that the data transmission between network devices can resist quantum computing attacks and improve the security of data transmission.

[0128] Referring to Figure 8 The embodiment of the present application provides a data security communication method. The method is applied to a key server and specifically includes the following steps:

[0129] Step 301: Receiving a key generation instruction and generating a plurality of keys.

[0130] Step 302: Performing key mixing processing on the plurality of keys to generate a mixed key and a corresponding mixed key identifier.

[0131] In one way, the key server can generate a plurality of keys based on one or more key generation algorithms in the process of performing key mixing processing on the plurality of keys. And the key mixing processing on the plurality of keys is performed by using an exclusive or operation method or a key derivation operation method to generate a mixed key and a corresponding mixed key identifier.

[0132] As an example, the key server generates a plurality of keys by using a plurality of key generation algorithms, for example, the key server can synchronize to generate three tasks for creating keys, which are to generate one key by using a QKD system composed of a quantum key distribution device and a quantum key management device, and to generate two keys by using a post-quantum cryptography algorithm PQC.

[0133] Specifically, for example, the key generated by the PQC_A task is key a, and a key identifier a' corresponding to the key a. And, the key generated by the PQC_B task is key b, and a key identifier b' corresponding to the key b. And,

[0134] Further, the key generated by the QKD task is key c, and a key identifier c' corresponding to the key c.

[0135] Further, the three groups of keys (i.e., key a, key b, and key c) can be mixed into a final mixed key and a corresponding mixed key identifier through key mixing.

[0136] Step 303: transmitting the mixed key and the corresponding mixed key identifier to the first network device, so that the first network device performs data security communication with the second network device based on the mixed key and the corresponding mixed key identifier.

[0137] In one way, the key server can provide key services for the network devices associated therewith through the interface form of the REST API. Therefore, the key server is a server capable of providing an out-of-band key exchange mechanism for the first network device and the second network device.

[0138] Optionally, the embodiment of the present application can transmit the mixed key and the corresponding mixed key identifier to the first network device, including:

[0139] transmitting the mixed key and the corresponding mixed key identifier to the first network device when the key request message sent by the first network device is received; or

[0140] transmitting the mixed key and the corresponding mixed key identifier to the first network device when it is detected that the current state satisfies a preset trigger condition.

[0141] In one way, the key server can transmit the mixed key and the corresponding mixed key identifier to the corresponding network device only when the key request message (e.g., the number of keys of the network device is insufficient) sent by the network device associated therewith is received.

[0142] In another way, the key server can also transmit the mixed key and the corresponding mixed key identifier to the first network device in response to a condition when it is detected that the state of the key server satisfies a preset trigger condition.

[0143] As an example, the preset trigger condition can be that the number of mixed keys created by itself exceeds a preset number, or that the current time point reaches a certain preset time point. It can also be that the operation performance reaches a certain critical value, and the like. The present application is not limited thereto.

[0144] Optionally, the embodiment of the present application can generate a plurality of keys, including:

[0145] The plurality of keys are generated by using at least one key generation algorithm.

[0146] Optionally, the embodiment of the present application can further include, before the plurality of keys are mixed to generate a mixed key, the following steps:

[0147] sending a key query instruction to the other key servers, the key query instruction being used to learn whether the other key servers have generated the same plurality of keys as the key server itself;

[0148] determining that the other key servers have generated the same plurality of keys as the key server itself.

[0149] It can be understood that if the plurality of keys generated by a key server are different from the plurality of keys generated by other key servers, then the subsequent hybrid keys and pre-shared keys generated thereby are also necessarily different. This also results in the inability to achieve secure data transmission between the plurality of network devices.

[0150] Therefore, in one approach, the key server needs to send, after generating the plurality of keys, a key query instruction to the other key servers, the key query instruction being used to learn whether the other key servers have generated the same plurality of keys as the key server itself, and only after determining, based on a reply message, that the other key servers have generated the same plurality of keys as the key server itself, can the key server perform the step of performing key mixing on the plurality of keys to generate a hybrid key.

[0151] By applying the technical solution of the present application, each network device can utilize the hybrid key generated by the key server associated therewith to synchronously create the same pre-shared key. The hybrid key is generated based on some quantum secure algorithm. Each network device performs data transmission between network devices based on the respective pre-shared key synchronously created thereby, so that the data transmission between network devices can resist attacks by quantum computing and improve the security of data transmission.

[0152] Referring to Figure 9 The embodiments of the present application provide a system for secure data communication. The system includes a key server, a first network device, and a second network device, wherein:

[0153] The key server is configured to perform key mixing on a plurality of keys generated by the key server to generate a hybrid key and a corresponding hybrid key identifier, and to transmit the hybrid key and the corresponding hybrid key identifier to the first network device;

[0154] The first network device is configured to receive the hybrid key and the corresponding hybrid key identifier sent by the key server, to generate a pre-shared key based on the hybrid key, to send the hybrid key identifier to the second network device, and to perform secure data communication with the second network device based on the pre-shared key;

[0155] The second network device is configured to receive the hybrid key identifier sent by the first network device, to select a hybrid key corresponding to the hybrid key identifier from the key server associated with the second network device, to generate a pre-shared key based on the hybrid key, and to perform secure data communication with the first network device based on the pre-shared key.

[0156] As shown in Figure 10 The system for secure data communication of the present application can perform the following steps to realize the method for secure data communication proposed by the present application:

[0157] Step 1, the key server A (associated with the first network device) and the key server B (associated with the second network device) belonging to two data centers respectively create multiple parallel tasks respectively to generate multiple identical keys.

[0158] Step 2, the key server A and the key server B respectively perform key mixing processing on the multiple keys to generate identical mixed keys and corresponding mixed key identifiers.

[0159] Step 3, the first network device sends a key request message for obtaining the mixed key and the corresponding mixed key identifier to the key server A.

[0160] Step 4, the key server A returns the mixed key and the corresponding mixed key identifier to the first network device.

[0161] Step 5, the first network device sends the mixed key identifier to the second network device and generates a pre-shared key based on the mixed key.

[0162] Step 6, the second network device requests the mixed key corresponding to the mixed key identifier from the key server B associated with the local end.

[0163] Step 7, the key server B returns the mixed key corresponding to the mixed key identifier to the second network device.

[0164] Step 8, the second network device sends a key confirmation message to the first network device, which is used to inform the first network device that the second network device has generated the same pre-shared key based on the mixed key identifier.

[0165] Step 9, the first network device and the second network device extract the root key CAK from the pre-shared key; or, based on the pre-shared key, generate a master session key MSK, and use the MSK to generate the root key CAK; use the CAK to generate a session key SAK, a verification key ICK, and an encryption key KEK; based on the SAK, the ICK, and the KEK, perform secure data communication with the second network device.

[0166] By applying the technical solution of the present application, each network device can create the same pre-shared key by using the mixed key generated by the key server associated therewith. The mixed key is generated based on some quantum security algorithm. Each network device performs data transmission between network devices based on the pre-shared key created by each network device, so that the data transmission between network devices can resist quantum computing attacks and improve the security of data transmission.

[0167] The embodiment of the present application also provides a device for data secure communication, which is used to perform the operations performed in the method for data secure communication provided by any of the above embodiments. As shown in the figure, the device is applied to a first network device and comprises: Figure 11

[0168] The first generation module 401 is configured to obtain the mixed key generated by the key server and the corresponding mixed key identifier, and generate a pre-shared key based on the mixed key;

[0169] The first sending module 402 is configured to send the mixed key identifier to a second network device, so that the second network device generates the pre-shared key based on the mixed key identifier;

[0170] The first communication module 403 is configured to perform data secure communication with the second network device based on the pre-shared key.

[0171] In another embodiment of the present application, the first generation module 401 is configured to perform the following steps:

[0172] The mixed key is processed by using a key derivation function to obtain the pre-shared key.

[0173] In another embodiment of the present application, the first generation module 401 is configured to perform the following steps:

[0174] The pre-shared key is stored in a key chain, and the number of pre-shared keys stored in the key chain is counted; or, the pre-shared key is stored in a cache pool, and the number of pre-shared keys stored in the cache pool is counted.

[0175] If it is determined that the number of pre-shared keys is lower than a preset number, a key request message for obtaining other mixed keys is sent to the key server.

[0176] In another embodiment of the present application, the first generation module 401 is configured to perform the following steps:

[0177] ​receive a key confirmation message sent by the second network device, the key confirmation message being used to represent that the second network device has generated the pre-shared key based on the mixed key identifier.

[0178] In another implementation of the present application, the first generating module 401 is configured to perform the following steps:

[0179] extract a root key CAK from the pre-shared key; or, generate a master session key MSK based on the pre-shared key, and generate the root key CAK by using the MSK;

[0180] generate a session key SAK, an integrity key ICK, and an encryption key KEK by using the CAK;

[0181] perform data security communication with the second network device based on the SAK, the ICK, and the KEK.

[0182] The embodiments of the present application further provide a data security communication device, which is used to perform the operations performed in the data security communication method provided by any of the above embodiments. As shown in Figure 12 the device is applied to a second network device and includes:

[0183] The second sending module 404 is configured to receive a mixed key identifier sent by a first network device.

[0184] The second generating module 405 is configured to select a mixed key corresponding to the mixed key identifier from a key server associated with itself, and generate a pre-shared key based on the mixed key.

[0185] The second communication module 406 is configured to perform data security communication with the first network device based on the pre-shared key.

[0186] In another implementation of the present application, the second generating module 405 is configured to perform the following steps:

[0187] send a key confirmation message to the first network device, the key confirmation message being used to represent that the second network device has generated the pre-shared key based on the mixed key identifier.

[0188] The embodiments of the present application further provide a data security communication device, which is used to perform the operations performed in the data security communication method provided by any of the above embodiments. As shown in Figure 13 the device is applied to a key server and includes:

[0189] The third generating module 407 is configured to receive a key generation instruction and generate a plurality of keys.

[0190] The fourth generating module 408 is configured to perform key mixing on the plurality of keys to generate a mixed key and a corresponding mixed key identifier;

[0191] The third communication module 409 is configured to transmit the mixed key and the corresponding mixed key identifier to the first network device, so that the first network device performs data security communication with the second network device based on the mixed key and the corresponding mixed key identifier.

[0192] In another embodiment of the present application, the third generating module 407 is configured to perform the following steps:

[0193] transmit the mixed key and the corresponding mixed key identifier to the first network device upon receiving the key request message sent by the first network device; or

[0194] transmit the mixed key and the corresponding mixed key identifier to the first network device upon detecting that the current state satisfies a preset triggering condition.

[0195] In another embodiment of the present application, the third generating module 407 is configured to perform the following steps:

[0196] generate the plurality of keys by using at least one key generation algorithm.

[0197] In another embodiment of the present application, the third generating module 407 is configured to perform the following steps:

[0198] send a key query instruction to other key servers, the key query instruction being used to learn whether the other key servers have generated the plurality of keys identical to itself;

[0199] determine that the other key servers have generated the plurality of keys identical to itself.

[0200] The embodiments of the present application also provide an electronic device for executing the above-mentioned data security communication method. Please refer to Figure 14 which shows a schematic diagram of an electronic device provided by some embodiments of the present application. As shown in Figure 14 The electronic device 3 comprises a processor 500, a memory 501, a bus 502 and a communication interface 503, the processor 500, the communication interface 503 and the memory 501 are connected through the bus 502; the memory 501 stores a computer program which can be run on the processor 500, and the processor 500 runs the computer program to execute the data security communication method provided by any of the preceding embodiments of the present application.

[0201] The memory 501 can include a high-speed random access memory (RAM: Random Access Memory) and can also include a non-volatile memory such as at least one disk memory. The communication connection between the apparatus network element and at least one other network element is realized through at least one communication interface 503 (which can be wired or wireless), and the Internet, a wide area network, a local network, a metropolitan area network, etc. can be used.

[0202] The bus 502 can be an ISA bus, a PCI bus, an EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 501 is used to store programs, and the processor 500 executes the programs after receiving execution instructions. The data security communication method disclosed in any of the embodiments of the present application can be applied to the processor 500 or implemented by the processor 500.

[0203] The processor 500 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 500. The processor 500 described above can be a general-purpose processor, including a processor (CPU: Central Processing Unit), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready-to-program gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. Each method, step and logic block disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium in the art. The storage medium is located in the memory 501, and the processor 500 reads the information in the memory 501 and combines the hardware to complete the steps of the above method.

[0204] The electronic device provided by the embodiments of the present application and the data security communication method provided by the embodiments of the present application have the same beneficial effects as the method they adopt, run or implement.

[0205] The embodiments of the present application also provide a computer readable storage medium corresponding to the data security communication method provided by the preceding embodiments. Please refer toFigure 15 The computer readable storage medium shown in the figure is an optical disc 60, on which a computer program (i.e. a program product) is stored, which, when run by a processor, will execute the method for data security communication provided by any of the preceding embodiments.

[0206] It should be noted that examples of the computer readable storage medium can also include, but are not limited to, a phase change memory (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read only memory (ROM), an electrically erasable programmable read only memory (EEPROM), a flash memory, or other optical, magnetic storage medium, which will not be listed one by one here.

[0207] The computer readable storage medium provided by the above embodiments of the present application is based on the same inventive concept as the method for data security communication provided by the embodiments of the present application, and has the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0208] It should be noted that:

[0209] In the specification provided herein, a large number of specific details are described. However, it can be understood that the embodiments of the present application can be practiced without these specific details. In some examples, well-known structures and techniques are not shown in detail in order not to obscure the understanding of the present specification.

[0210] Similarly, it should be understood that, in order to simplify the present application and help understand one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, various features of the present application are sometimes grouped together in a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed application requires more features than those explicitly claimed in each claim. Rather, the inventive aspects are defined by the claims below, as reflected in the claims. Therefore, the claims following the detailed description are hereby expressly incorporated into the detailed description, in which each claim itself is a separate embodiment of the present application.

[0211] In addition, those skilled in the art can understand that although some embodiments described herein include certain features included in other embodiments rather than other features, the combination of features of different embodiments means that it is within the scope of the present application and forms different embodiments. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

[0212] The above description is only the preferred embodiment of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of secure communication of data, characterized by, Applied to a first network device, comprising: Obtaining a mixed key generated by a plurality of keys and a corresponding mixed key identifier from a key server, and generating a pre-shared key based on the mixed key; Sending the mixed key identifier to a second network device to enable the second network device to generate the pre-shared key based on the mixed key identifier; Based on the pre-shared key, data security communication is carried out with the second network device; Wherein, the second network device generates the pre-shared key based on the mixed key identifier, comprising: the second network device selects the mixed key corresponding to the mixed key identifier from the key server associated with itself, and generates the pre-shared key based on the mixed key.

2. The method of claim 1, wherein, The pre-shared key is generated based on the mixed key, comprising: The mixed key is processed by using a key derivation function to obtain the pre-shared key.

3. The method of claim 1, wherein, After the pre-shared key is generated based on the mixed key, it further comprises: The pre-shared key is stored in the key chain, and the number of pre-shared keys stored in the key chain is counted; or, the pre-shared key is stored in the cache pool, and the number of pre-shared keys stored in the cache pool is counted; If it is determined that the number of pre-shared keys is less than the preset number, a key request message for obtaining other mixed keys is sent to the key server.

4. The method of claim 1, wherein, Before the data security communication with the second network device based on the pre-shared key, it further comprises: Receiving the key confirmation message sent by the second network device, the key confirmation message is used to represent that the second network device has generated the pre-shared key based on the mixed key identifier.

5. The method of claim 1, wherein, Based on the pre-shared key, data security communication is carried out with the second network device, comprising: Extracting the root key CAK in the pre-shared key; or, generating the master session key MSK based on the pre-shared key, and generating the root key CAK by using the MSK; Using the CAK to generate the session key SAK, the check key ICK and the encryption key KEK; Based on the SAK, the ICK and the KEK, data security communication is carried out with the second network device.

6. A method of secure communication of data, characterized by Applied to a second network device, comprising: Receiving the mixed key identifier sent by the first network device; Selecting the mixed key corresponding to the mixed key identifier from the key server associated with itself, and generating the pre-shared key based on the mixed key; Based on the pre-shared key, data security communication is carried out with the first network device.

7. The method of claim 6, wherein, After the pre-shared key is generated based on the mixed key, it further comprises: Sending a key confirmation message to the first network device, the key confirmation message is used to represent that the second network device has generated the pre-shared key based on the mixed key identifier.

8. A method of secure communication of data, characterized by, Applied to a key server, comprising: Receiving a key generation instruction, generating a plurality of keys; The plurality of keys are subjected to key mixing processing to generate a mixed key and a corresponding mixed key identifier; transmit the mixed key and the corresponding mixed key identifier to the first network device, so that the first network device generates a pre-shared key based on the mixed key, and sends the mixed key identifier to the second network device, so that the second network device generates the pre-shared key based on the mixed key identifier; The second network device generates the pre-shared key based on the mixed key identifier, including: the second network device selects a mixed key corresponding to the mixed key identifier from a key server associated with itself, and generates a pre-shared key based on the mixed key.

9. The method of claim 8, wherein, The transmitting the mixed key and the corresponding mixed key identifier to the first network device includes: When the first network device sends a key request message, the mixed key and the corresponding mixed key identifier are transmitted to the first network device; or When it is detected that the current state meets a preset trigger condition, the mixed key and the corresponding mixed key identifier are transmitted to the first network device.

10. The method of claim 8, wherein, The generating a plurality of keys includes: The plurality of keys are generated by using at least one key generation algorithm.

11. The method of claim 8, wherein, After the plurality of keys are generated, the method further includes: sending a key query instruction to other key servers, the key query instruction being used to learn whether the other key servers have generated the plurality of keys same as itself; determining that the other key servers have generated the plurality of keys same as itself; performing key mixing processing on the plurality of keys to generate the mixed key.

12. A system for secure communication of data, characterized by It includes: A key server is configured to perform key mixing processing on a plurality of keys generated by itself to generate a mixed key and a corresponding mixed key identifier, and transmit the mixed key and the corresponding mixed key identifier to a first network device; The first network device is configured to receive the mixed key and the corresponding mixed key identifier sent by the key server, generate a pre-shared key based on the mixed key, send the mixed key identifier to a second network device, and perform data security communication with the second network device based on the pre-shared key; The second network device is configured to receive the mixed key identifier sent by the first network device, select a mixed key corresponding to the mixed key identifier from a key server associated with itself, generate a pre-shared key based on the mixed key, and perform data security communication with the first network device based on the pre-shared key.

13. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor runs the computer program to implement the method of any one of 1-11.

14. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of 1-11.

Images