Group chat encryption method, message sending and receiving device and system based on quantum key

Abstract

The present invention discloses a group chat encryption method based on quantum key, a message transceiver device and a system, including: applying for a temporary symmetric key from a quantum cryptography management service system as an encryption key to encrypt the plaintext information to be sent into a message ciphertext; assembling the message ciphertext into ciphertext information according to the message protocol and broadcasting it for the receiver to decrypt; performing a KDF ratchet operation in the same message generation, when a group member sends a new message, performing a hash operation using the most recent temporary symmetric key and ciphertext information to generate a temporary symmetric key required for the current message transmission; determining the increase in the number of message generations based on the time window and the number of messages in the time window, and repeating the above steps. The present invention has forward security and backward security, and adopts an end-to-end message encryption method to protect the message data security and ensure the message data security.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic security applications, and in particular to a group chat encryption method based on quantum keys, a message sending and receiving device, and a system. Background Art

[0002] With the development of Internet technology, a large amount of data is transmitted in the network. At the same time, network attacks are becoming increasingly severe, including identity authentication issues of data senders and receivers, content theft during data transmission and storage, and possible information tampering during data transmission. Therefore, data privacy protection has become one of the important factors that technicians need to consider. The data security technologies used include the use of TLS protocol in channel encryption and end-to-end encryption technology in source encryption.

[0003] At present, the use of end-to-end encryption protocols to protect data security in one-to-one chats has become relatively mature. However, for group messages in instant messaging scenarios, the use of an end-to-end approach requires each member in the group to establish an end-to-end encryption channel with all other members in the group to encrypt group messages. This approach will bring about the problem of a large number of group keys and high complexity of key management; and the conventional method of one key per group is not secure enough, and the data security of instant messaging group chats cannot be guaranteed.

[0004] In the related art, the Chinese invention patent application document with publication number CN111478911A records an instant messaging encryption method using a lightweight key exchange algorithm, including steps S1: before the communicating parties establish a call, the calling party obtains the upload key information of the receiving party from the server, and negotiates a primary symmetric key through the uploaded key information; S2: the calling party uses the primary symmetric key to perform a communication encryption ratchet operation; S3: the calling party uses the primary information encryption key to encrypt the information, and sends it to the receiving party together with the calling party's key information; S4: after the receiving party receives the information, it also performs a communication encryption ratchet operation to obtain a primary symmetric key and a primary information encryption key, and uses the primary information encryption key to decrypt the information to complete the first communication; S5: in the subsequent Nth communication, both parties perform a communication encryption ratchet operation with the (N-1)th level symmetric key to obtain the Nth level symmetric key and the (N-1)th level information encryption key, and both parties use the (N-1)th level information encryption key to encrypt and decrypt the information to complete N communications. However, this scheme only uses (N-1)-level symmetric keys for communication encryption ratchet operations, which is not secure enough.

[0005] The Chinese invention patent application document with publication number CN114401151A records a group message encryption method, device, equipment and storage medium, which includes: receiving a master key ciphertext and a validity period sent by a master client, the master key ciphertext is generated based on a random master key and a set attribute policy; decrypting the master key ciphertext based on the authentication parameters associated with the attribute policy to obtain the random master key, and when the current timestamp meets the validity period, calculating a one-time encryption key based on the random master key; encrypting and assembling message data based on the one-time encryption key to obtain ciphertext information and then broadcasting it. However, in this scheme, if the set time interval is large and there are too many messages in a generation, decrypting the master key once can decrypt many messages, which does not meet backward security. Summary of the invention

[0006] The technical problem to be solved by the present invention is how to ensure the data security of instant messaging group chat.

[0007] The present invention solves the above technical problems through the following technical means:

[0008] The present invention proposes a group chat encryption method based on quantum key. After the group is established, the method comprises the following steps:

[0009] S10, when the sender sends a message for the first time in the current message generation, it applies to the quantum cryptography management service system for a temporary symmetric key as an encryption key, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0010] S20, assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0011] S30, KDF ratchet operation within the same message generation, when a group member sends a new message for the Nth time, a hash operation is performed using the (N-1)th temporary symmetric key and the (N-1)th plaintext information to generate the temporary symmetric key required for sending the message for the Nth time, N≥2;

[0012] S40. Based on the time window and the number of messages in the time window, determine the message generation increase, and repeat steps S10 to S30.

[0013] The present invention adopts an improved KDF ratchet algorithm to provide FS (forward security), and adopts a customized generational algorithm based on time windows and message numbers combined with the true randomness of quantum true random keys to provide PCS (backward security); and adopts an end-to-end message encryption method to protect message data security. Messages are transmitted and stored in ciphertext, and the encryption key is a quantum true random key generated by a quantum cryptography management service system. Even if the message is intercepted, the attacker can only obtain the ciphertext but cannot obtain the information, thereby ensuring the security of the message data.

[0014] Furthermore, in step S10, the sender applies for a temporary symmetric key as an encryption key from the quantum cryptography management service system, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext, including:

[0015] Send a first key application to the quantum cryptography management service system, the first key application carrying information including group ID, message algebra, password sequence i and key KA with key sequence i i The SM3 summary, the key KA i The key pre-filled into the sender's built-in security chip;

[0016] Receive the first encryption key ciphertext and the cipher sequence m returned by the quantum cryptography management service system, wherein the first encryption key ciphertext is the injection key KA using the cipher sequence m m The temporary symmetric key K is encrypted, where the temporary symmetric key K is a random key generated by a quantum random number generator, the injection key is a quantum key stored in a quantum exchange cipher machine, and the key KA i With the injection key KA m is a symmetric key;

[0017] Use the injection key KA with key sequence m m Decrypting the first encryption key ciphertext to obtain the temporary symmetric key K as the encryption key;

[0018] The encryption key is used to symmetrically encrypt the plaintext information to be sent to obtain the message ciphertext.

[0019] Further, in the step S20, the format of the message protocol is: ?CSP:GEN001:xxx, wherein ?CSP represents an encryption key, GEN001 represents a message algebra of a group, and xxx represents a message ciphertext.

[0020] Furthermore, when the ciphertext information generates fragments, the method further includes:

[0021] The format of the message protocol used to assemble the subsequent message ciphertext is: ? CSP|GEN001:xxx.

[0022] Furthermore, in step S40, determining the message generation increase based on the time window and the number of messages in the time window includes:

[0023] Determine whether the number of messages in the time window reaches a preset maximum number of messages;

[0024] If yes, the message generation number is increased by 1, and the time window and message count are reset;

[0025] If not, then when the time window expires, determine whether there is a message in the message generation;

[0026] If so, the message generation number is increased by 1, otherwise the message generation number is increased by 0, and then the time window and message count are reset.

[0027] Furthermore, before step S10, the method further includes:

[0028] Group members authorize the instant messaging app by authenticating their face or fingerprint and log in to the instant messaging app;

[0029] The group members respectively use the injection keys in their respective built-in security chips to perform entity authentication with the quantum cryptography management service system using the GB / T 15843.2 standard based on symmetric keys.

[0030] Furthermore, after the receiving party receives the ciphertext information, the method further includes:

[0031] The receiving party sends a second key application to the quantum cryptography management service system, and the second key application carries information including group ID, message algebra, cipher sequence j, and key KB with cipher sequence j. j The SM3 digest, where the key KB j The key pre-filled into the receiver's built-in security chip;

[0032] Receive the second encryption key ciphertext and the cipher sequence n returned by the quantum cryptography management service system, wherein the second encryption key ciphertext is the injection key KB using the cipher sequence n n The encryption key K is encrypted to obtain the encryption key K, wherein the encryption key K is the key corresponding to the group ID and the message algebra, and the injection key KB n The quantum key stored in the quantum exchange cipher machine is filled with the key KB n With key KB j is a symmetric key;

[0033] Use the injection key KB corresponding to the cipher sequence n n The second encryption key ciphertext is decrypted to obtain the encryption key K and the ciphertext information is decrypted to obtain the message plaintext.

[0034] Furthermore, after the receiver obtains the plain text message0 for the first time, the method further includes:

[0035] The receiver uses the encryption key K and the message plaintext message0 to perform a hash operation, generates a primary temporary symmetric key based on the KDF, uses the primary temporary symmetric key to encrypt the message plaintext message1, and then sends it to the group;

[0036] The sender uses the encryption key K and the message plaintext message0 to perform a hash operation to obtain the primary temporary symmetric key, and uses the primary temporary symmetric key to decrypt the message plaintext message1 to obtain the plaintext of message1.

[0037] In addition, the present invention also proposes a message sending and receiving device, the device comprising:

[0038] A key application module is used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0039] A ciphertext broadcast module, used for assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0040] The KDF ratchet module is used for the KDF ratchet operation within the same message generation. When a group member sends a new message, the most recent temporary symmetric key and ciphertext information are used for hash operation to generate the temporary symmetric key required for the current message.

[0041] The message algebra stepping module is used to determine the message algebra increase based on the time window and the number of messages in the time window, and execute the key application module.

[0042] In addition, the present invention also proposes a group chat encryption system based on quantum keys, the system comprising: an instant messaging system, a quantum cryptography management service system and a plurality of message transceiver devices, each of the message transceiver devices having a built-in security chip, the security chip being respectively connected to the quantum cryptography management service system, and each of the message transceiver devices being connected via the instant messaging system, the quantum cryptography management service system being connected to a quantum random number generator via a quantum exchange cipher machine, wherein:

[0043] The quantum random number generator is used to generate a quantum key;

[0044] The quantum exchange cryptographic machine is used to receive and store the quantum key sent by the quantum random number generator;

[0045] The quantum cryptography management service system is used to authenticate the identity of each of the message transceiver devices and call the quantum key in the quantum exchange cryptographic machine to provide a quantum key for each of the security chips;

[0046] The instant messaging system is used to provide message sending and receiving services for each of the message sending and receiving devices;

[0047] The message sending and receiving device comprises:

[0048] A key application module is used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0049] A ciphertext broadcast module, used for assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0050] The KDF ratchet module is used for the KDF ratchet operation within the same message generation. When a group member sends a new message, the most recent temporary symmetric key and ciphertext information are used for hash operation to generate the temporary symmetric key required for the current message.

[0051] The message algebra stepping module is used to determine the message algebra increase based on the time window and the number of messages in the time window, and execute the key application module.

[0052] The advantages of the present invention are:

[0053] (1) The present invention adopts an improved KDF ratchet algorithm to provide FS (forward security), and adopts a customized generational algorithm based on time window and message number combined with the true randomness of quantum true random key to provide PCS (backward security); and adopts an end-to-end message encryption method to protect the security of message data. The message is transmitted and stored in ciphertext. The encryption key is the quantum true random key generated by the quantum cryptography management service system. Even if the message is intercepted, the attacker can only obtain the ciphertext but not the information, thereby ensuring the security of the message data.

[0054] (2) The entire life cycle of the temporary symmetric key is transmitted in key ciphertext, which is decrypted by the pre-charged quantum key to obtain the key plaintext. The charge key of the sender and receiver is protected by an encryption chip, ensuring the security of the key.

[0055] (3) Reduce the complexity of group encryption: Group members do not need to store the public key of each member, and encrypted messages are sent using a custom protocol. Compared with traditional methods, this saves the interactive process of sending key signatures to each member separately; Improve encryption and decryption efficiency: Quantum symmetric encryption is used to improve encryption and decryption efficiency. Compared with traditional group encryption that mainly generates shared keys based on DH and ECDH, asymmetric encryption methods such as RSA and ECC can save more computing power; No need for third-party issuance and authentication of digital certificates: Provide a certificate-free authentication method to reduce the participation of third parties: Use an entity authentication protocol based on symmetric encryption to perform entity authentication on both users, without the need for a third party to issue certificates, reduce the number of participants in the process, and reduce the risks of three-party agreements.

[0056] (4) Easy to implement, highly versatile, and scalable: Quantum security chips are a feasible technology, and security authentication based on quantum symmetric keys is also a feasible technology. Temporary symmetric keys used to encrypt messages can be generated using quantum random numbers. The technology is mature and highly secure. There is very little modification to the instant messaging system itself, and security is mainly improved by adding a quantum key service system. It has strong versatility and can be integrated into the quantum security service platform, providing external functional interfaces and good scalability.

[0057] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 is a flow chart of a group chat encryption method based on quantum keys proposed in the first embodiment of the present invention;

[0059] Figure 2 is a schematic diagram of the subdivided steps of step S10 in the first embodiment of the present invention;

[0060] Figure 3 It is a schematic flow chart of the subdivided steps of the decryption process of the receiving party in the first embodiment of the present invention;

[0061] Figure 4 is a schematic diagram of the KDF ratchet process in the first embodiment of the present invention;

[0062] Figure 5 is a schematic diagram of the subdivided steps of step S40 in the first embodiment of the present invention;

[0063] Figure 6 This is a schematic diagram of the entity identity authentication process in the first embodiment of the present invention;

[0064] Figure 7 is a structural diagram of a message sending and receiving device proposed in a second embodiment of the present invention;

[0065] Figure 8 It is a schematic diagram of the structure of a group chat encryption system based on quantum keys proposed in the third embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] like Figure 1 As shown, the first embodiment of the present invention proposes a group chat encryption method based on quantum key. After the group is established, the method includes the following steps:

[0068] S10, when the sender sends a message for the first time in the current message generation, it applies to the quantum cryptography management service system for a temporary symmetric key as an encryption key, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0069] It should be noted that the quantum cryptography switch is connected to a quantum random number generator, which is used to generate quantum keys. The quantum cryptography switch receives and stores the quantum keys issued by the quantum random number generator. The quantum cryptography management service system is directly connected to the quantum cryptography switch to provide encryption keys.

[0070] S20, assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0071] It should be noted that there is no need to store the public key of each member between group members. Encrypted messages are sent using a custom protocol. Compared with the traditional method, this saves the interactive process of sending key signatures to each member individually.

[0072] S30, performing a KDF ratchet operation within the same message generation, when a group member sends a new message for the Nth time, a hash operation is performed using the (N-1)th temporary symmetric key and the (N-1)th plaintext information to generate a temporary symmetric key required for sending the message for the Nth time, where N≥2;

[0073] S40. Based on the time window and the number of messages in the time window, determine the message generation increase, and repeat steps S10 to S30.

[0074] The embodiment of the present invention adopts an improved ratchet algorithm based on a key derivation function (KDF) to provide FS (forward security), and adopts a customized generation algorithm based on a time window and the number of messages combined with the true randomness of a quantum true random key to provide PCS (backward security); and adopts an end-to-end message encryption method to protect the security of message data. The message is transmitted and stored in ciphertext, and the encryption key is a quantum true random key generated by a quantum cryptography management service system. Even if the message is intercepted, the attacker can only obtain the ciphertext but cannot obtain the information, thereby ensuring the security of the message data.

[0075] In addition, this embodiment uses the temporary symmetric key of (N-1) times in this message generation + the plaintext hash of (N-1) messages for ratcheting, which is equivalent to using the quantum key as the salt. Compared with the traditional ratchet operation using only (N-1) levels of symmetric keys for communication encryption, it increases security; and in addition to the time interval, this embodiment also sets a limit on the number of messages, avoiding the problem that if the set time interval is large and there are too many messages in the generation, decrypting the master key once can decrypt many messages, and backward security is not met.

[0076] In one embodiment, if Figure 2 As shown, the step S10: the sender applies for a temporary symmetric key as an encryption key from the quantum cryptography management service system, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext, specifically including the following steps:

[0077] S11, sending a first key application to the quantum cryptography management service system, the first key application carrying information including group ID, message algebra, cryptographic sequence i and key KA with key sequence i i The SM3 summary, the key KA i The key pre-filled into the sender's built-in security chip;

[0078] It should be noted that the built-in security chip of the sender is a feasible technology with mature technology and high security. The encryption key needs to use the quantum charging key to apply for the quantum cryptography management service system KMS to obtain the group key, which is equivalent to adding an extra layer of identity authentication and improving security.

[0079] Specifically, after receiving the first key application, the quantum cryptography management service system verifies whether the key SM3 summary of sequence i in the quantum cryptography management service system is equal to the input parameter. If they are equal, the quantum random number generator is used to generate a secure random temporary symmetric key K. The quantum cryptography management service system finds the injection key KA with the cryptographic sequence m through the quantum security key stored in the quantum exchange cipher machine. m , using the injection key KA mThe plaintext information of the temporary symmetric key K is encrypted to generate an encrypted first encryption key ciphertext KEK, and the quantum cryptography management service system sends the first encryption key ciphertext KEK and the cryptographic sequence m to the sender.

[0080] S12, receiving the first encryption key ciphertext and the cipher sequence m returned by the quantum cryptography management service system, wherein the first encryption key ciphertext is the injection key KA using the cipher sequence m m The temporary symmetric key K is encrypted, where the temporary symmetric key K is a random key generated by a quantum random number generator, the injection key is a quantum key stored in a quantum exchange cipher machine, and the key KA i With the injection key KA m is a symmetric key;

[0081] It should be noted that the charging key stored in the security chip and the charging key stored in the quantum cryptographic switch are symmetric keys. The use of quantum symmetric keys can prevent security threats brought by future quantum computers and quantum algorithms. The use of quantum symmetric encryption can improve the efficiency of encryption and decryption. Compared with traditional group encryption based on DH and ECDH to generate shared keys, asymmetric encryption methods such as RSA and ECC can save more computing power.

[0082] S13, using the injection key KA with key sequence m m Decrypting the first encryption key ciphertext to obtain the temporary symmetric key K as the encryption key;

[0083] S14, using the encryption key to symmetrically encrypt the plaintext information P to be sent, to obtain the message ciphertext C=E K (P).

[0084] It should be noted that the entire life cycle of the temporary symmetric key is transmitted in the form of key ciphertext, and the key plaintext is obtained by decrypting the pre-charged quantum key. The charge key of the sender and receiver is protected by an encryption chip to ensure the security of the key; and the use of quantum symmetric encryption saves more computing power.

[0085] In one embodiment, in step S20, the format of the message protocol is: ?CSP:GEN001:xxx, where ?CSP represents an encryption key, GEN001 represents a message algebra of a group, and xxx represents a message ciphertext.

[0086] It should be noted that in this embodiment, the public key of each member does not need to be stored between group members, and the encrypted messages are sent using a custom protocol. Compared with the traditional method, this saves the interaction process of sending key signatures to each member separately, and reduces the interaction cost of sending key signatures multiple times.

[0087] In one embodiment, when the ciphertext information generates fragments, the method further includes:

[0088] The format of the message protocol used to assemble the subsequent message ciphertext is: ? CSP|GEN001:xxx, where | represents a connector and : represents a separator.

[0089] It should be noted that if the length of the message ciphertext is too long, fragmentation will be generated, and the subsequent message format is? CSP|GEN001:xxx.

[0090] This embodiment solves the problem of too long ciphertext messages by fragmenting. If the subsequent fragments do not carry the "?CSP|GEN001" message header, the receiver will not know the message generation, or will treat it as a new message for ratcheting, causing confusion.

[0091] In one embodiment, if Figure 3 As shown, after the receiving party receives the ciphertext information, the method further includes:

[0092] The receiving party sends a second key application to the quantum cryptography management service system, and the second key application carries information including group ID, message algebra, cipher sequence j, and key KB with cipher sequence j. j The SM3 digest, where the key KB j The key pre-filled into the receiver's built-in security chip;

[0093] It should be noted that the quantum cryptography management service system queries the quantum key corresponding to the ID of the receiver's built-in security chip stored in the system, selects the key corresponding to the cryptographic sequence j to calculate the SM3 digest and input reference pair to verify the validity, and queries the temporary symmetric key K corresponding to the group ID and message algebra after the verification. The quantum cryptography management service system finds the injection key KB of the cryptographic sequence n through the quantum security key stored in the quantum exchange cipher machine. n , using the injection key KB n The plaintext of the temporary symmetric key K is encrypted to obtain the second encryption key ciphertext KEK′, and the quantum cryptography management service system returns the second encryption key ciphertext KEK′ and the cryptographic sequence n to the recipient.

[0094] Receive the second encryption key ciphertext and the cipher sequence n returned by the quantum cryptography management service system, wherein the second encryption key ciphertext is the injection key KB using the cipher sequence n n The encryption key K is encrypted to obtain the encryption key K, wherein the encryption key K is the key corresponding to the group ID and the message algebra, and the injection key KB n The quantum key stored in the quantum exchange cipher machine is filled with the key KB n With key KB jis a symmetric key;

[0095] Use the injection key KB corresponding to the cipher sequence n n The second encryption key ciphertext is decrypted to obtain the encryption key K and the ciphertext information C is decrypted to obtain the message plaintext P.

[0096] It should be noted that if Figure 4 As shown, the KDF ratchet operation within the same message generation, when group members communicate, specifically includes the following steps:

[0097] (1) When the sender sends a message for the first time, it uses the current message algebra to apply for the temporary symmetric key K obtained from the quantum cryptography management service to encrypt the plaintext message message0, and the group member applies for the temporary symmetric key K obtained from the quantum cryptography management service to decrypt the plaintext message message0;

[0098] (2) The receiver uses the temporary symmetric key K and the plaintext message message0 to perform a hash operation, and generates a temporary symmetric key key1 based on the KDF. It then uses the temporary symmetric key key1 to encrypt the plaintext message message1 and sends it to the group.

[0099] (3) The sender uses the temporary symmetric key K and the plaintext message message0 to perform a hash operation to obtain the temporary symmetric key key1, and uses the temporary symmetric key key1 to decrypt the plaintext message message1;

[0100] (4) The sender uses the temporary symmetric key key1 and the plaintext message message2 to perform a hash operation, generates a temporary symmetric key key2 based on the KDF, encrypts the plaintext message message2 with the temporary symmetric key key2, and sends it to the group;

[0101] (5) The sender uses the temporary symmetric key key2 and the plaintext message message3 to perform a hash operation, generates a temporary symmetric key key3 based on the KDF, uses the temporary symmetric key key3 to encrypt the plaintext message message3, and sends it to the group.

[0102] The temporary symmetric key used in the KDF ratchet operation in this embodiment can only be obtained after the terminal uses the charging key to authenticate with the KMS; and the group key in the generation acts as a salt in the subsequent ratchet process, thereby improving security.

[0103] In one embodiment, if Figure 5 As shown, the step S40: determining the message generation increase based on the time window and the number of messages in the time window, specifically includes the following steps:

[0104] S41, determining whether the number of messages in the time window reaches a preset maximum number of messages, if yes, executing step S42, if no, executing step S43;

[0105] S42, the message generation number is increased by 1, and the time window and message count are reset;

[0106] S43, determine whether the time window has been reached, if yes, execute step S41, if no, execute step S44;

[0107] S44, determine whether there is a message in the message generation, if yes, execute step S42, if no, execute step S45;

[0108] S45. The message generation number is increased by 0.

[0109] It should be noted that, for example, if the time window is set to 10 minutes and the maximum number of messages is 1000, if the number of messages within 10 minutes is greater than 1000, the message generation is increased by 1, or the message generation is increased by 1 if it exceeds 10 minutes; for offline messages, they are retained for a maximum of 24 hours.

[0110] This embodiment adopts a customized generation algorithm based on time window and message number combined with the true randomness of quantum random numbers to provide PCS (backward security). By combining the time interval and the message generation count, it avoids the problem that if the set time interval is large and there are too many messages in the generation, the master key can be decrypted once, and the backward security is not met. In addition, the randomness of quantum is provable, which is stronger than the randomness of other random numbers and has higher security.

[0111] In one embodiment, if Figure 6 As shown, before step S10, the method further includes performing identity authentication of the entity, and the specific process is as follows:

[0112] S1. Group members authorize the instant messaging application by authenticating their face or fingerprint and log in to the instant messaging application;

[0113] S2. Group members respectively use the injection keys in their own built-in security chips to perform entity authentication with the quantum cryptography management service system based on symmetric keys using the GB / T 15843.2 standard.

[0114] It should be noted that group members use quantum security chips for identity authentication. At the same time, the client of the instant messaging system on the message sending and receiving device needs to perform MFA two-factor authentication of face or fingerprint to ensure the authenticity of the identity.

[0115] Quantum security chips are a feasible existing technology, and the security authentication based on quantum symmetric keys in this embodiment is also a feasible technology with mature technology and high security.

[0116] It should be noted that the end-to-end message encryption method is used to protect the security of message data. The message is transmitted and stored in ciphertext, and the encryption key is the quantum true random key generated by the quantum cryptography management service system. Even if the message is intercepted, the attacker can only get the ciphertext but not the information, thus ensuring data security.

[0117] Therefore, the group chat encryption method based on quantum key proposed in this embodiment has the following advantages:

[0118] (1) Improve the data security of instant messaging group chats

[0119] Combination of forward security and backward security: The strategy for generating temporary symmetric keys is based on quantum key distribution technology. Based on the three principles of uncertainty, measurement collapse, and non-cloning in quantum mechanics, it provides absolute security that cannot be eavesdropped or cracked by calculation. The terminal needs to use the pre-charged key to obtain the temporary symmetric key from the KMS. The generation of this temporary symmetric key is also based on the quantum random number generated by the quantum random number generator, providing ultimate security. Considering FS (forward security) and PCS (backward security), the improved KDF ratchet algorithm is used to provide FS (forward security), and a customized generational algorithm based on time windows and message numbers combined with the true randomness of quantum random numbers is used to provide PCS (backward security).

[0120] Security of message data: End-to-end message encryption is used to protect the security of message data. Messages are transmitted and stored in ciphertext, and the encryption key is the quantum true random key generated by the quantum cryptography management service system. Even if the message is intercepted, the attacker can only get the ciphertext but not the information, thus ensuring the security of the message data.

[0121] Key security: The key is transmitted in ciphertext throughout its entire life cycle, and the key plaintext is obtained by decrypting the pre-charged quantum key. The charged key is protected by an encryption chip to ensure the security of the key.

[0122] Guard against security threats brought by future quantum computers and quantum algorithms: for example, guard against the problem of public key cryptography algorithms based on the problem of large factorization being cracked: using quantum symmetric keys, it is impossible to crack them through large factorization; guard against security threats brought by future quantum computers: use quantum secure cryptography for encrypted transmission, the transmission process is theoretically completely safe and reliable; guard against threats to existing cryptographic systems from quantum algorithms that may appear in the future: use quantum secure cryptography for encrypted transmission, the quantum secure key is a true random number generated by a quantum random number generator, which cannot be cracked by an algorithm.

[0123] (2) Reduce the complexity of group encryption, solve the problem of high complexity of key management and low encryption processing efficiency caused by a large number of keys, and improve ease of use.

[0124] Reduce the complexity of group encryption: Group members do not need to store each member's public key. Encrypted messages are sent using a custom protocol. Compared with traditional methods, this saves the interaction process of sending key signatures to each member separately.

[0125] Improve encryption and decryption efficiency: Use quantum symmetric encryption to improve encryption and decryption efficiency. Compared with traditional group encryption that mainly uses DH and ECDH to generate shared keys, asymmetric encryption methods such as RSA and ECC can save more computing power.

[0126] No need for third-party issuance and authentication of digital certificates: Use an entity authentication protocol based on symmetric cryptography to perform entity authentication for both users. There is no need for a third party to issue certificates, which reduces the number of parties involved in the process and reduces the risks of three-party agreements.

[0127] (3) Easy to implement, versatile, and scalable

[0128] The development technology is easy to implement: quantum security chips are feasible and existing technologies, and security authentication based on quantum symmetric keys is also a feasible technology. The temporary symmetric keys used to encrypt messages can be generated using quantum random numbers. The technology is mature and highly secure.

[0129] Strong versatility and good scalability: There is very little modification to the instant messaging system itself, and security is mainly improved by adding a quantum key service system. It has strong versatility and can be integrated into the quantum security service platform, providing functional interfaces to the outside world and good scalability.

[0130] (4) Excellent economic benefits

[0131] Save computing power: Use quantum symmetric encryption to save more computing power.

[0132] Reduced interaction: Customized protocol format reduces the interaction cost of sending key signatures multiple times.

[0133] Low transformation cost: The transformation can be carried out on the existing system, with almost no transformation on the platform side. The application side only needs to be connected, and the transformation cost is low.

[0134] In addition, if Figure 7 As shown, the second embodiment of the present invention provides a message sending and receiving device, the device comprising:

[0135] The key application module 10 is used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system when sending a message for the first time in the current message generation, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0136] A ciphertext broadcast module 20, configured to assemble the message ciphertext into ciphertext information according to a message protocol and then broadcast it for decryption by a receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0137] The KDF ratchet module 30 is used for the KDF ratchet operation within the same message generation. When a group member sends a new message for the Nth time, the temporary symmetric key of the (N-1)th time and the plaintext information of the (N-1)th time are used for hash operation to generate the temporary symmetric key required for the current message sending.

[0138] The message generation stepping module 40 is used to determine the message generation increase based on the time window and the number of messages in the time window, and execute the key application module.

[0139] The embodiment of the present invention adopts an improved ratchet algorithm based on a key derivation function (KDF) to provide FS (forward security), and adopts a customized generation algorithm based on a time window and the number of messages combined with the true randomness of a quantum true random key to provide PCS (backward security); and adopts an end-to-end message encryption method to protect the security of message data. The message is transmitted and stored in ciphertext, and the encryption key is a quantum true random key generated by a quantum cryptography management service system. Even if the message is intercepted, the attacker can only obtain the ciphertext but cannot obtain the information, thereby ensuring the security of the message data.

[0140] In one embodiment, the key application module 10 includes:

[0141] A key application sending unit is used to send a first key application to the quantum cryptography management service system, wherein the first key application carries information including a group ID, a message algebra, a cryptographic sequence i, and a key KA with a key sequence i. i The SM3 summary, the key KA i The key pre-filled into the sender's built-in security chip;

[0142] Specifically, after receiving the first key application, the quantum cryptography management service system verifies whether the key SM3 summary of sequence i in the quantum cryptography management service system is equal to the input parameter. If they are equal, the quantum random number generator is used to generate a secure random temporary symmetric key K. The quantum cryptography management service system finds the injection key KA with the cryptographic sequence m through the quantum security key stored in the quantum exchange cipher machine. m , using the injection key KA m The plaintext information of the temporary symmetric key K is encrypted to generate an encrypted first encryption key ciphertext KEK, and the quantum cryptography management service system sends the first encryption key ciphertext KEK and the cryptographic sequence m to the sender.

[0143] A key information receiving unit, used to receive the first encryption key ciphertext and the cipher sequence m returned by the quantum cryptography management service system, wherein the first encryption key ciphertext is the injection key KA using the cipher sequence m m The temporary symmetric key K is encrypted, where the temporary symmetric key K is a random key generated by a quantum random number generator, the injection key is a quantum key stored in a quantum exchange cipher machine, and the key KA i With the injection key KA m is a symmetric key;

[0144] Key decryption unit, used to use the injection key KA with key sequence m m Decrypting the first encryption key ciphertext to obtain the temporary symmetric key K as the encryption key;

[0145] A plaintext encryption unit, used to use the encryption key to symmetrically encrypt the plaintext information P to be sent to obtain the message ciphertext C=E K (P).

[0146] It should be noted that the entire life cycle of the temporary symmetric key is transmitted in the form of key ciphertext, and the key plaintext is obtained by decrypting the pre-charged quantum key. The charge key of the sender and receiver is protected by an encryption chip to ensure the security of the key; and the use of quantum symmetric encryption saves more computing power.

[0147] In one embodiment, the format of the message protocol adopted by the ciphertext broadcast module 20 is: ?CSP:GEN001:xxx, where ?CSP represents the encryption key, GEN001 represents the message algebra of the group, and xxx represents the message ciphertext.

[0148] It should be noted that in this embodiment, the public key of each member does not need to be stored between group members, and the encrypted messages are sent using a custom protocol. Compared with the traditional method, this saves the interaction process of sending key signatures to each member separately, and reduces the interaction cost of sending key signatures multiple times.

[0149] In one embodiment, the message transceiving device further includes a ciphertext decryption unit, which, when serving as a receiver, includes:

[0150] The key application sending unit is further used to send a second key application to the quantum cryptography management service system in the receiving direction, wherein the second key application carries information including a group ID, a message algebra, a cipher sequence j, and a key KB with a cipher sequence j. j The SM3 digest, where the key KB j The key pre-filled into the receiver's built-in security chip;

[0151] It should be noted that the quantum cryptography management service system queries the quantum key corresponding to the ID of the receiver's built-in security chip stored in the system, selects the key corresponding to the cryptographic sequence j to calculate the SM3 digest and input reference pair to verify the validity, and queries the temporary symmetric key K corresponding to the group ID and message algebra after the verification. The quantum cryptography management service system finds the injection key KB of the cryptographic sequence n through the quantum security key stored in the quantum exchange cipher machine. n , using the injection key KB n The plaintext of the temporary symmetric key K is encrypted to obtain the second encryption key ciphertext KEK′, and the quantum cryptography management service system returns the second encryption key ciphertext KEK′ and the cryptographic sequence n to the recipient.

[0152] The key information receiving unit is also used to receive the second encryption key ciphertext and the cipher sequence n returned by the quantum cryptography management service system, wherein the second encryption key ciphertext is the injection key KB using the cipher sequence n. n The encryption key K is encrypted to obtain the encryption key K, wherein the encryption key K is the key corresponding to the group ID and the message algebra, and the injection key KB n The quantum key stored in the quantum exchange cipher machine is filled with the key KB n With key KB j is a symmetric key;

[0153] The ciphertext decryption unit is used to use the injection key KB corresponding to the cipher sequence n n The second encryption key ciphertext is decrypted to obtain the encryption key K and the ciphertext information C is decrypted to obtain the message plaintext P.

[0154] After the receiver obtains the plain text message0 for the first time, the method further includes:

[0155] The receiver uses the encryption key K and the message plaintext message0 to perform a hash operation, generates a primary temporary symmetric key based on the KDF, uses the primary temporary symmetric key to encrypt the message plaintext message1, and then sends it to the group;

[0156] The sender uses the encryption key K and the message plaintext message0 to perform a hash operation to obtain the primary temporary symmetric key, and uses the primary temporary symmetric key to decrypt the message plaintext message1 to obtain the plaintext of message1.

[0157] In one embodiment, the KDF ratchet operation process is performed as follows:

[0158] When the sender sends a message for the first time, it uses the current message algebra to apply for the temporary symmetric key K obtained from the quantum cryptography management service to encrypt the plaintext message message0, and the group member applies for the temporary symmetric key K obtained from the quantum cryptography management service to decrypt the plaintext message message0;

[0159] The receiver uses the temporary symmetric key K and the plaintext message message0 to perform a hash operation, generates a temporary symmetric key key1 based on the KDF, encrypts the plaintext message message1 with the temporary symmetric key key1, and sends it to the group.

[0160] The sender uses the temporary symmetric key K and the plaintext message message0 to perform a hash operation to obtain the temporary symmetric key key1, and uses the temporary symmetric key key1 to decrypt the plaintext message message1.

[0161] The sender uses the temporary symmetric key key1 and the plaintext message message2 to perform a hash operation, generates a temporary symmetric key key2 based on the KDF, encrypts the plaintext message message2 with the temporary symmetric key key2, and sends it to the group;

[0162] The sender uses the temporary symmetric key key2 and the plaintext message message3 to perform a hash operation, generates a temporary symmetric key key3 based on the KDF, uses the temporary symmetric key key3 to encrypt the plaintext message message3, and then sends it to the group.

[0163] In one embodiment, the message algebra stepping module 40 is specifically configured to perform the following steps:

[0164] Determine whether it is greater than the maximum number of messages in the set generation. If it is greater than the maximum number of messages, the message generation is increased by 1, and the message count and time window are reset. If it does not exceed the maximum number of messages, determine again whether the time window has been reached. If the time window has been reached, determine again whether there is a message in the band. If there is a message, the message generation is increased by 1, otherwise the message generation is increased by 0, and the message count and time window are reset.

[0165] In one embodiment, the message sending and receiving device further includes an entity authentication module, which is used to perform the following steps:

[0166] Group members authorize the instant messaging app by authenticating their face or fingerprint and log in to the instant messaging app;

[0167] The group members respectively use the injection keys in their respective built-in security chips to perform entity authentication with the quantum cryptography management service system using the GB / T 15843.2 standard based on symmetric keys.

[0168] It should be noted that other embodiments of the message receiving and sending device of the present invention or implementation methods thereof can refer to the above-mentioned method embodiment 1, which will not be repeated here.

[0169] In addition, if Figure 8 As shown, the third embodiment of the present invention also proposes a group chat encryption system based on quantum key, the system includes: an instant messaging system 3, a quantum cryptography management service system 2 and a plurality of message transceiver devices 1, each of the message transceiver devices 1 has a built-in security chip 50, the security chip 50 is respectively connected to the quantum cryptography management service system 2, and each of the message transceiver devices 1 is connected via the instant messaging system 3, the quantum cryptography management service system 2 is connected to the quantum random number generator 5 via a quantum exchange cipher machine 4, wherein:

[0170] The quantum random number generator 5 is used to generate a quantum key;

[0171] The quantum exchange cryptographic machine 4 is used to receive and store the quantum key sent by the quantum random number generator;

[0172] The quantum cryptography management service system 2 is used to authenticate the identity of each of the message transceiver devices and call the quantum key in the quantum exchange cryptographic machine to provide a quantum key for each of the security chips;

[0173] The instant messaging system 3 is used to provide message sending and receiving services for each of the message sending and receiving devices;

[0174] The message sending and receiving device 1 comprises:

[0175] The key application module 10 is used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system when sending a message for the first time in the current message generation, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext;

[0176] A ciphertext broadcast module 20, configured to assemble the message ciphertext into ciphertext information according to a message protocol and then broadcast it for decryption by a receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext;

[0177] The KDF ratchet module 30 is used for the KDF ratchet operation within the same message generation. When a group member sends a new message for the Nth time, the temporary symmetric key of the (N-1)th time and the plaintext information of the (N-1)th time are used for hash operation to generate the temporary symmetric key required for the current message sending.

[0178] The message generation stepping module 40 is used to determine the message generation increase based on the time window and the number of messages in the time window, and execute the key application module.

[0179] The embodiment of the present invention adopts an improved ratchet algorithm based on a key derivation function (KDF) to provide FS (forward security), and adopts a customized generation algorithm based on a time window and the number of messages combined with the true randomness of a quantum true random key to provide PCS (backward security); and adopts an end-to-end message encryption method to protect the security of message data. The message is transmitted and stored in ciphertext, and the encryption key is a quantum true random key generated by a quantum cryptography management service system. Even if the message is intercepted, the attacker can only obtain the ciphertext but cannot obtain the information, thereby ensuring the security of the message data.

[0180] It should be noted that the security chip includes but is not limited to SIM cards or USB flash drives. The security key in the security chip is pre-built in. The security chip is pre-charged in advance through a quantum key charging machine when the card is issued. The security chips used have preset quantum passwords, that is, the principle is: the security chip is initialized before use (pre-charged password), and the security chip is charged with quantum security keys through a quantum password charging machine. The key charged to each security chip and the key preset in the quantum exchange cryptographic machine are symmetric keys (i.e., one-to-one corresponding keys). Each security chip has its own ID number, and each quantum key has its own serial number. You only need to provide the quantum security chip number and the quantum key serial number to find the corresponding key in the quantum exchange cryptographic machine.

[0181] A message sending and receiving device is used for sending and receiving messages. The security chip is built-in or externally connected to the message sending and receiving device. The message sending and receiving device includes but is not limited to mobile phones, fixed devices such as computers, etc. Users need to bind to the security chip in advance, and only bound users can use the message sending and receiving device with the security chip built-in.

[0182] It should be noted that the output of the quantum cryptographic switch is connected to a quantum key charging machine 6 for charging the quantum key charging machine with quantum keys.

[0183] Furthermore, the workflow of the quantum key-based group chat encryption system in this embodiment is as follows:

[0184] (1) Group members use quantum security chips for identity authentication, and the IM system client on the messaging device needs to perform MFA two-factor authentication using face or fingerprint.

[0185] (2) The first message sent after the group is established is identified as the first generation. The encryption key of the first message is the temporary symmetric key K applied by the sender to the quantum cryptography management service system using the charging key in its own quantum security chip. The temporary symmetric key K is generated by the quantum exchange cipher machine calling the quantum random number. The temporary symmetric key plaintext K is encrypted by the charging key of the quantum security chip and returned to the sender together with the charging key number. The sender calls its own quantum security chip to decrypt the temporary symmetric key ciphertext (KEK) into the temporary symmetric key plaintext K. Then the sender uses the temporary symmetric key K to encrypt the plaintext information P to be sent into the message ciphertext (C=E K (P)), and finally assemble the ciphertext information according to the custom message protocol and broadcast it. The protocol format is? CSP:GEN001:xxx,? CSP: indicates the encrypted message; GEN001: indicates the message generation of the group; xxx: indicates the ciphertext of the message; if the message is too long and fragmented, the subsequent message format is? CSP|GEN001:xxx.

[0186] (3) The receiver decrypts the message. The receiver needs to carry the group, the message code and the charging key in its own quantum encryption chip to apply for a temporary symmetric key K from the quantum cryptography management service system. The quantum cryptography management service system calls the quantum exchange cipher machine to encrypt the temporary symmetric key plaintext K with the charging key of the receiver's quantum security chip (KEK′) and returns it together with the charging key number. The receiver calls the K′ with the corresponding number in its own quantum security chip to decrypt the temporary symmetric key ciphertext (KEK′) into the temporary symmetric key plaintext K, and then uses the temporary symmetric key to decrypt the message ciphertext C into the plaintext P.

[0187] (4) In the same message generation, when a group member sends a new message, the temporary encryption key used is the most recent temporary encryption key K n-1 Hash K with the message content n At the same time, the IM system uses message queues to ensure the sequence of asynchronous messages.

[0188] (5) The stepping condition of the message generation is based on the time window and the number of messages. If the number of messages in the time window reaches the pre-configured maximum number of messages, the message generation is incremented by 1, and the time window and message count are reset at the same time. If the time window expires, the message generation is incremented by 1, and the time window and message count are reset at the same time. If there is no new message in the new time window, the message generation is incremented by 0. After the message generation is incremented by 1, the encryption and decryption process of the message repeats steps (2) to (5).

[0189] It should be noted that other embodiments of the message receiving and sending device of the present invention or implementation methods thereof may refer to the above-mentioned embodiment 2, which will not be repeated here.

[0190] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0191] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0192] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0193] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0194] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A group chat encryption method based on quantum key, characterized in that: After the group is established, the method includes the following steps: S10, when the sender sends a message for the first time in the current message generation, it applies to the quantum cryptography management service system for a temporary symmetric key as an encryption key, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext; S20, assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext; S30, performing a KDF ratchet operation within the same message generation, when a group member sends a new message for the Nth time, a hash operation is performed using the (N-1)th temporary symmetric key and the (N-1)th plaintext information to generate a temporary symmetric key required for sending the message for the Nth time, where N≥2; S40. Based on the time window and the number of messages in the time window, determine the message generation increase, and repeat steps S10 to S30.

2. The group chat encryption method based on quantum key according to claim 1, characterized in that: In step S10, the sender applies for a temporary symmetric key as an encryption key from the quantum cryptography management service system, and uses the encryption key to encrypt the plaintext information to be sent into a message ciphertext, including: Send a first key application to the quantum cryptography management service system, the first key application carrying information including group ID, message algebra, password sequence i and key KA with key sequence i i The SM3 summary, the key KA i The key pre-filled into the sender's built-in security chip; Receive the first encryption key ciphertext and the cipher sequence m returned by the quantum cryptography management service system, wherein the first encryption key ciphertext is the injection key KA using the cipher sequence m m The temporary symmetric key K is encrypted, where the temporary symmetric key K is a random key generated by a quantum random number generator, the injection key is a quantum key stored in a quantum exchange cipher machine, and the key KA i With the injection key KA m is a symmetric key; Use the injection key KA with key sequence m m Decrypting the first encryption key ciphertext to obtain the temporary symmetric key K as the encryption key; The encryption key is used to symmetrically encrypt the plaintext information to be sent to obtain the message ciphertext.

3. The group chat encryption method based on quantum key according to claim 1, characterized in that: In the step S20, the format of the message protocol is: ?CSP:GEN001:xxx, where ?CSP represents the encryption key, GEN001 represents the message algebra of the group, and xxx represents the message ciphertext.

4. The group chat encryption method based on quantum key according to claim 3, characterized in that: When the ciphertext information generates fragments, the method further includes: The format of the message protocol used to assemble the subsequent message ciphertext is: ? CSP|GEN001:xxx.

5. The group chat encryption method based on quantum key according to claim 1, characterized in that: In step S40, determining the message generation increase based on the time window and the number of messages in the time window includes: Determine whether the number of messages in the time window reaches a preset maximum number of messages; If yes, the message generation number is increased by 1, and the time window and message count are reset; If not, then when the time window expires, determine whether there is a message in the message generation; If so, the message generation number is increased by 1, otherwise the message generation number is increased by 0, and then the time window and message count are reset.

6. The group chat encryption method based on quantum key according to claim 1, characterized in that: Before step S10, the method further includes: Group members authorize the instant messaging app by authenticating their face or fingerprint and log in to the instant messaging app; The group members respectively use the injection keys in their respective built-in security chips to perform entity authentication with the quantum cryptography management service system based on symmetric keys using the GB / T15843.2 standard.

7. The group chat encryption method based on quantum key according to claim 1, characterized in that: After the receiving party receives the ciphertext information, the method further includes: The receiving party sends a second key application to the quantum cryptography management service system, and the second key application carries information including group ID, message algebra, cipher sequence j, and key KB with cipher sequence j. j The SM3 digest, where the key KB j The key pre-filled into the receiver's built-in security chip; Receive the second encryption key ciphertext and the cipher sequence n returned by the quantum cryptography management service system, wherein the second encryption key ciphertext is the injection key KB using the cipher sequence n n The encryption key K is encrypted to obtain the encryption key K, wherein the encryption key K is the key corresponding to the group ID and the message algebra, and the injection key KB n The quantum key stored in the quantum exchange cipher machine is filled with the key KB n With key KB j is a symmetric key; Use the injection key KB corresponding to the cipher sequence n n The second encryption key ciphertext is decrypted to obtain the encryption key K and the ciphertext information is decrypted to obtain the message plaintext.

8. The group chat encryption method based on quantum key according to claim 7, characterized in that: After the receiver obtains the plain text message0 for the first time, the method further includes: The receiver uses the encryption key K and the message plaintext message0 to perform a hash operation, generates a primary temporary symmetric key based on the KDF, uses the primary temporary symmetric key to encrypt the message plaintext message1, and then sends it to the group; The sender uses the encryption key K and the message plaintext message0 to perform a hash operation to obtain the primary temporary symmetric key, and uses the primary temporary symmetric key to decrypt the message plaintext message1 to obtain the plaintext of message1.

9. A message sending and receiving device, characterized in that: The device comprises: A key application module, used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system when sending a message for the first time in the current message generation, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext; A ciphertext broadcast module, used for assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext; The KDF ratchet module is used for the KDF ratchet operation within the same message generation. When a group member sends a new message for the Nth time, it uses the (N-1)th temporary symmetric key and the (N-1)th plaintext information to perform a hash operation to generate the temporary symmetric key required for the current message sending. The message algebra stepping module is used to determine the message algebra increase based on the time window and the number of messages in the time window, and execute the key application module.

10. A group chat encryption system based on quantum key, characterized in that: The system includes: an instant messaging system, a quantum cryptography management service system and a plurality of message transceiver devices, each of which has a built-in security chip, each of which is connected to the quantum cryptography management service system, and each of which is connected via the instant messaging system, and the quantum cryptography management service system is connected to a quantum random number generator via a quantum exchange cipher machine, wherein: The quantum random number generator is used to generate a quantum key; The quantum exchange cryptographic machine is used to receive and store the quantum key sent by the quantum random number generator; The quantum cryptography management service system is used to authenticate the identity of each of the message transceiver devices and call the quantum key in the quantum exchange cryptographic machine to provide a quantum key for each of the security chips; The instant messaging system is used to provide message sending and receiving services for each of the message sending and receiving devices; The message sending and receiving device comprises: A key application module, used to apply for a temporary symmetric key as an encryption key from the quantum cryptography management service system when sending a message for the first time in the current message generation, and use the encryption key to encrypt the plaintext information to be sent into a message ciphertext; A ciphertext broadcast module, used for assembling the message ciphertext into ciphertext information according to the message protocol and then broadcasting it for decryption by the receiving party, wherein the message ciphertext includes the encryption key, the message algebra of the group and the message ciphertext; The KDF ratchet module is used for the KDF ratchet operation within the same message generation. When a group member sends a new message for the Nth time, it uses the (N-1)th temporary symmetric key and the (N-1)th plaintext information to perform a hash operation to generate the temporary symmetric key required for the current message sending. The message algebra stepping module is used to determine the message algebra increase based on the time window and the number of messages in the time window, and execute the key application module.

Images