Quantum key based encryption and decryption system

Abstract

The application provides a quantum key-based encryption and decryption system, which is arranged on a computer device requiring encryption and decryption functions, and comprises a quantum key application module, a quantum key storage module, an encryption module and a decryption module. The application comprehensively applies quantum communication technology and white box algorithm technology to provide a safe key for the encryption and decryption system, and also hides the key in a memory database, so that the key does not need to be considered when the encryption and decryption system is used, which can guarantee the safety of the key and data and simplify the use of the encryption and decryption system.

Description

Technical Field

[0001] This invention relates to the field of quantum communication, and more specifically to a quantum key-based encryption and decryption system. Background Technology

[0002] Most existing encryption and decryption systems require specifying a key or using a classic random number internally as the encryption key when encrypting data, and then encrypting the data using an encryption algorithm. The key is usually stored locally as a file, and the corresponding key or key identifier is required to decrypt the plaintext.

[0003] Existing technologies, whether using open-source random number generator software or random number generators conforming to the NIST standard, produce classical random numbers. These are not truly random, are predictable, and therefore insecure. Using classical random numbers as keys naturally introduces security vulnerabilities.

[0004] Current technologies typically store keys in segments in client-side files or in dynamic libraries. However, since the client or dynamic library is publicly accessible, attackers can still crack the key using white-box attacks and other methods, given enough time. Existing technologies require specifying a corresponding key or key identifier to decrypt the plaintext, which not only risks exposing the key but also increases system complexity. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a quantum key-based encryption / decryption system. This system is deployed on a computer device requiring encryption / decryption functionality. The system acquires quantum keys using a quantum key distribution device and provides integrated access via a dynamic or static library. The system includes a quantum key application module, a quantum key storage module, an encryption module, and a decryption module. The system periodically retrieves quantum keys from the quantum key distribution device by calling the interface provided by the quantum key distribution device through the key application module. The key storage module binds the encryption key of the encryption / decryption system to the computer device, then scrambles and encrypts the encryption key using a white-box algorithm before storing it in a memory database. The encryption module encrypts the data. During encryption, the user does not need to provide the encryption key; they only need to provide the plaintext data to be encrypted and the selected encryption algorithm to the system. The system automatically retrieves the encryption key from the memory database and applies the encryption algorithm to encrypt the data. The decryption module decrypts the encrypted ciphertext data. During decryption, the user does not need to provide the encryption key; they only need to provide the ciphertext data to be encrypted to the system. The decryption module automatically matches the corresponding encryption key and encryption algorithm to decrypt the data.

[0006] In one implementation, the key request module requests and obtains two quantum keys each time, denoted as qkey0 and qkey1 respectively, and the quantum keys obtained each time are random; one of the obtained quantum keys, qkey0, is used by the key storage module as the root key for the white-box algorithm, and the other, qkey1, is used by the encryption module and the decryption module as the encryption key.

[0007] In one implementation, the key storage module performs a hash operation on the machine code of the computer device, i.e., Hm = SM3(mac), where mac is the machine code, and then concatenates and binds Hm and qkey1 according to a specified format, i.e., qkey1' = Hm + qkey1, where "+" indicates concatenation.

[0008] In one implementation, a white-box key qkey0” is calculated using qkey0 as the root key of the white-box algorithm, and qkey1” is encrypted and protected using the white-box algorithm, where qkey1” = E”qkey0(qkey1’).

[0009] In one implementation, a key identifier is appended to the key and encapsulated: Qkey1” = key identifier + qkey0” + qkey1”, and Qkey1” is saved to the memory database.

[0010] In one implementation, after receiving the plaintext data to be encrypted and the specified encryption algorithm, the encryption / decryption system finds Qkey1” in the memory database and parses out the key identifier, qkey0”, and qkey1” according to the concatenation format.

[0011] In one implementation, qkey0” is used as the key for the white-box algorithm to decrypt qkey1”, resulting in qkey1': D”qkey0”(qkey1”)=qkey1', and qkey1' is parsed to obtain the quantum key qkey1.

[0012] In one implementation, qkey1 is used as the password key, and the plaintext data data is encrypted using the corresponding encryption algorithm to obtain ciphertext data data': data' = Eqkey1(data).

[0013] In one implementation, the ciphertext data is encapsulated as follows: Data' = key identifier + algorithm identifier + data', where "+" indicates concatenation, and Data' is the final encrypted ciphertext data; the decryption module matches the corresponding key with the key identifier and matches the corresponding encryption algorithm with the decryption identifier.

[0014] In one implementation, after receiving the encrypted ciphertext Data', the encryption / decryption system parses the ciphertext Data' according to the concatenation format, and separates it into a key identifier, an algorithm identifier, and data'; it then finds the corresponding Qkey1" in the memory database using the key identifier and separates it into qkey0" and qkey1".

[0015] In one implementation, qkey0” is used as the key for the white-box algorithm to decrypt qkey1”, resulting in qkey1': D”qkey0”(qkey1”)=qkey1', and qkey1' is parsed to separate Hm and the quantum key qkey1.

[0016] In one implementation, the encryption / decryption system obtains the machine code of the computer device and performs a hash operation, comparing the hash value with Hm. If the two values ​​are not equal, it indicates that the machine code is inconsistent and the key and machine device do not match. In this case, the encryption / decryption system will not decrypt the data and will return an error message. If the two values ​​are equal, it indicates that the machine code is consistent. Then, the corresponding encryption algorithm is found according to the algorithm identifier, and the data data' is decrypted using qkey1 as the key: Dqkey1(data') = data, to obtain the final plaintext data data.

[0017] Quantum states possess "intrinsic randomness," a property inherent to microscopic particles. Quantum key devices utilize this intrinsic randomness to generate truly random numbers, i.e., quantum keys. This invention uses quantum keys generated by a quantum key device as the keys for an encryption / decryption system. Quantum keys are based on quantum mechanics; the no-cloning principle and Heisenberg uncertainty principle in quantum mechanics not only guarantee the security of quantum keys but also solve the pseudo-randomness problem of classical keys.

[0018] This invention integrates quantum communication technology and white-box algorithm technology to provide a secure key for the encryption and decryption system. At the same time, the key is scrambled and hidden in the memory database, so that the key does not need to be considered when using the encryption and decryption system. This not only ensures the security of the key and data, but also simplifies the use of the encryption and decryption system.

[0019] This invention uses quantum keys instead of traditional keys. Quantum keys have the property of being truly random, which enables cryptographic algorithms to achieve the effect of "one-time pad". Quantum keys are more secure than traditional keys.

[0020] The security of encrypted key storage has always been a critical issue in fields such as network security. Storing sensitive key information directly in device memory is vulnerable to physical cracking or side-channel attacks by attackers. This invention uses a white-box encryption algorithm to obfuscate and encrypt the key, thus resisting white-box cryptographic attacks and preventing attackers from obtaining key data by reading device memory. This invention utilizes quantum communication technology to replace traditional keys with quantum keys, combined with cryptographic algorithms for data encryption protection, effectively resisting black-box attacks.

[0021] In this invention, the key is hidden during both encrypting plaintext data and decrypting ciphertext data. The key is invisible and imperceptible to outsiders, greatly improving key security and system usability. This invention effectively protects the key by hiding it from the outside world, while simultaneously making data encryption and decryption more convenient.

[0022] In this invention, the quantum encryption key is bound to the computer device where QEDS is located. This means that data encrypted on this device can only be decrypted on this device, thus enhancing data security. This ensures that data encrypted with QEDS can only be decrypted on the local device.

[0023] The following is a list of definitions for abbreviations, English terms, and key terms used in this invention:

[0024] Key: The critical information or parameters that control the operation of cryptographic algorithms.

[0025] Quantum communication technology: As an important branch of quantum information science, quantum communication is a communication technology that uses quantum states as information carriers to exchange information.

[0026] Quantum key devices: Devices that generate quantum keys or quantum random numbers, such as quantum random number generators.

[0027] Quantum random number generator: A device that generates truly random numbers based on the fundamental principles of quantum mechanics.

[0028] QKD devices: Devices based on the fundamental principles of quantum mechanics that ensure that two communicating parties can generate an identical string of random numbers that cannot be obtained by an attacker, which can then be used as a shared key.

[0029] QEDS: A quantum key-based encryption and decryption system that provides integration and docking in the form of dynamic or static libraries.

[0030] QKRD: Quantum Key Device.

[0031] SM3(data): Encapsulates the method of the Chinese national cryptographic SM3 algorithm. `data` is the data that needs to be processed using the SM3 algorithm. Eqkey(data): Encapsulates the encryption method of the encryption algorithm, indicating that the plaintext data `data` is encrypted using the encryption algorithm with `qkey` as the key.

[0032] Dqkey(data): Encapsulates the decryption method of the encryption algorithm, indicating that the data data is decrypted using the decryption method corresponding to the encryption algorithm with qkey as the key.

[0033] E"qkey(data): A white-box encryption method that encapsulates a white-box encryption algorithm, indicating that data is encrypted using a white-box encryption algorithm with qkey as the key.

[0034] D"qkey(data): Encapsulates the white-box decryption method of the white-box encryption algorithm, indicating that the data data is decrypted using the decryption method corresponding to the white-box encryption algorithm with qkey as the key. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a schematic diagram of the quantum key storage structure of the present invention;

[0037] Figure 2 This is a system architecture diagram of the quantum key-based encryption and decryption system of this invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the technical solutions in this application, the present invention will be further described below with reference to embodiments. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application. The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0039] In one embodiment, such as Figure 2 As shown, a quantum key distribution system (QEDS) relies on a quantum key distribution device (QKRD) to obtain quantum keys, and provides integration and docking in the form of a dynamic library or a static library. QEDS mainly consists of four functional modules: a quantum key application module, a quantum key storage module, an encryption module, and a decryption module.

[0040] In one embodiment, QEDS periodically calls the interface provided by QKRD through the quantum key request module to obtain quantum keys from QKRD. Each time, two quantum keys are obtained, denoted as qkey0 and qkey1 respectively. The obtained quantum keys are random each time, giving the entire system a "one-time pad" effect. One of the obtained quantum keys (qkey0) is used by the storage module as the root key for the white-box algorithm, and the other (qkey1) is used as the encryption key by the encryption and decryption modules.

[0041] In one embodiment, such as Figure 1 As shown, the key storage module binds the QEDS encryption key to the device, and then stores the encryption key in an in-memory database after scrambling and encrypting it using a white-box algorithm. The key storage module's workflow is as follows:

[0042] 1. After the key application module obtains the quantum key (qkey0 and qkey1), the key storage module will perform a hash operation on the machine code of the device where QEDS is located, i.e., Hm = SM3 (mac), and then concatenate and bind Hm and qkey1 in the specified format, i.e., qkey1' = Hm + qkey1 (the plus sign indicates concatenation, the same below).

[0043] 2. Calculate the white-box key qkey0” using qkey0 as the root key of the white-box algorithm, and encrypt and protect qkey1' using the white-box algorithm, qkey1" = E"qkey0(qkey1').

[0044] 3. Attach a key identifier to the key and encapsulate it: Qkey1” = key identifier + qkey0” + qkey1”, and save Qkey1” to the memory database. The key identifier serves to hide the key; during decryption, the corresponding key can be matched through the key identifier.

[0045] The machine code is hashed to prevent its exposure. Even if Hm is accidentally exposed, attackers cannot reverse engineer the machine code. Concatenating the machine code and key in a specified format during binding also protects the key and data. Without knowing the encapsulation format, even if attackers obtain the data, it will appear as a random string of characters, increasing the difficulty of cracking the code.

[0046] Accessing the in-memory database requires a password, and this password is stored in QEDS memory, effectively binding the password to QEDS. This makes the in-memory database dependent on QEDS, which is more secure than storing it in a file. The root key of the white-box cryptographic algorithm is a dynamic, one-time pad quantum key; even if one white-box key is accidentally exposed, an attacker cannot decipher the other white-box algorithm keys. QEDS encryption keys are bound to the computer device, ensuring that data encrypted with QEDS can only be decrypted on the local device. Even if the in-memory database is copied to another device, it cannot be re-encrypted using the QEDS decryption algorithm.

[0047] The encryption module encrypts the data. Users can choose to use international symmetric encryption algorithms (AES, DES, etc.) or Chinese national symmetric encryption algorithms (SM4, etc.). However, to improve system simplicity and security, users do not need to provide an encryption key during encryption. They only need to provide the plaintext data to be encrypted and the selected encryption algorithm to QEDS. QEDS will automatically retrieve the quantum key from its memory database and apply the encryption algorithm to encrypt the data. The workflow of the QEDS encryption module is as follows:

[0048] 1. After receiving the plaintext data to be encrypted and the specified encryption algorithm, QEDS finds "Qkey1" in the memory database and parses out the key identifier, "qkey0", and "qkey1" according to the concatenation format.

[0049] 2. Decrypt qkey1” using qkey0” as the key for the white-box algorithm to obtain qkey1': D”qkey0”(qkey1”)=qkey1'.

[0050] 3. Parse qkey1' to obtain the quantum key qkey1.

[0051] 4. Using qkey1 as the password key, encrypt the plaintext data data using the corresponding encryption algorithm to obtain the ciphertext data data': data' = Eqkey1(data).

[0052] 5. Encapsulate ciphertext data': Data' = key identifier + algorithm identifier + data'. The key identifier hides the key, and the algorithm identifier hides the encryption algorithm. The decryption module can match the corresponding key through the key identifier and the corresponding encryption algorithm through the algorithm identifier.

[0053] 6.'Data' is the final encrypted ciphertext data.

[0054] In one implementation, the decryption module decrypts the encrypted ciphertext data. To improve system simplicity and security, users do not need to provide the encryption key during decryption; they only need to provide the ciphertext to be encrypted to QEDS. The decryption module automatically matches the corresponding key and encryption algorithm for decryption. The QEDS decryption module's data decryption workflow is as follows:

[0055] 1. After receiving the encrypted ciphertext Data', QEDS will parse the ciphertext Data' according to the concatenation format and separate it into key identifier, algorithm identifier, and data'.

[0056] 2. Locate the corresponding Qkey1 in the memory database using the key identifier and split it into qkey0 and qkey1.

[0057] 3. Decrypt qkey1” using qkey0” as the key for the white-box algorithm to obtain qkey1': D”qkey0”(qkey1”)=qkey1'.

[0058] 4. Parse qkey1' and separate Hm and the quantum key qkey1.

[0059] 5. QEDS obtains the machine code of the local device and performs a hash operation, comparing the hash value with Hm. If the two values ​​are not equal, it means the machine code is inconsistent, the key and the machine device do not match, and QEDS will not decrypt the data and will return an error message; if the two values ​​are equal, it means the machine code is consistent, and the corresponding encryption algorithm is found according to the algorithm identifier, and the data data' is decrypted using qkey1 as the key: Dqkey1(data') = data, obtaining the final plaintext data data.

[0060] It will be readily understood by those skilled in the art that the aforementioned advantageous methods can be freely combined and superimposed without conflict.

[0061] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention. The above are merely preferred embodiments of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the protection scope of the present invention.

Claims

1. A quantum key-based encryption and decryption system, characterized in that, The encryption / decryption system is deployed on computer equipment that needs to implement encryption / decryption functions; the encryption / decryption system relies on a quantum key distribution device to obtain quantum keys, and provides integrated access in the form of a dynamic library or a static library; the encryption / decryption system includes a quantum key application module, a quantum key storage module, an encryption module, and a decryption module; The encryption / decryption system periodically calls the interface provided by the quantum key device through the quantum key application module to obtain quantum keys from the quantum key device; The quantum key storage module binds the encryption key of the encryption and decryption system to the computer device, and then stores the encryption key in a memory database after scrambling and encrypting it using a white-box algorithm. The encryption module encrypts the data. During encryption, the user does not need to pass in the encryption key. The user only needs to pass the plaintext data to be encrypted and the selected encryption algorithm to the encryption and decryption system. The encryption and decryption system will automatically obtain the encryption key from the memory database and apply the encryption algorithm to encrypt the data. The decryption module decrypts the encrypted ciphertext data. During decryption, the user does not need to input the encryption key; they only need to transmit the ciphertext data to be decrypted to the encryption / decryption system. The decryption module will automatically match the corresponding encryption key and encryption algorithm to decrypt the data. The quantum key application module will apply for and obtain two quantum keys each time, denoted as qkey0 and qkey1 respectively. The quantum keys obtained each time are random. One of the obtained quantum keys, qkey0, is used by the quantum key storage module as the root key for the white-box algorithm, and the other qkey1 is used by the encryption module and the decryption module as the encryption key. The quantum key storage module performs a hash operation on the machine code of the computer device, i.e., Hm=SM3(mac), where mac is the machine code. Then, it concatenates and binds Hm and qkey1 according to a specified format, i.e., qkey1'=Hm+qkey1, where "+" indicates concatenation. Calculate the white-box key qkey0'' using qkey0 as the root key of the white-box algorithm, and encrypt and protect qkey1' using the white-box algorithm, qkey1"=E"qkey0(qkey1'); Attach a key identifier to the key and encapsulate it: Qkey1'' = key identifier + qkey0'' + qkey1", and save Qkey1'' to the in-memory database.

2. The encryption / decryption system according to claim 1, characterized in that, After receiving the plaintext data to be encrypted (data) and the specified encryption algorithm, the encryption / decryption system finds Qkey1'' in the memory database and parses out the key identifier, qkey0'', and qkey1" according to the concatenation format.

3. The encryption / decryption system according to claim 2, characterized in that, Using qkey0'' as the key for the white-box algorithm, decrypt qkey1'' to obtain qkey1': D''qkey0''(qkey1'') = qkey1', and parse qkey1' to obtain the quantum key qkey1.

4. The encryption / decryption system according to claim 3, characterized in that, Using qkey1 as the encryption key, encrypt the plaintext data data using the corresponding encryption algorithm to obtain the ciphertext data data': data'=Eqkey1(data).

5. The encryption / decryption system according to claim 4, characterized in that, Encapsulate ciphertext data': Data' = key identifier + algorithm identifier + data', where "+" indicates concatenation, and Data' is the final encrypted ciphertext data; the decryption module can match the corresponding key through the key identifier and the corresponding encryption algorithm through the algorithm identifier.

6. The encryption / decryption system according to claim 5, characterized in that, After receiving the encrypted ciphertext Data', the encryption / decryption system parses the ciphertext Data' according to the concatenation format, and separates it into a key identifier, an algorithm identifier, and data'; it then uses the key identifier to find the corresponding Qkey1'' in the memory database and separates it into qkey0'' and qkey1''.

7. The encryption / decryption system according to claim 6, characterized in that, Using qkey0'' as the key for the white-box algorithm, decrypt qkey1'' to obtain qkey1': D''qkey0''(qkey1'') = qkey1'. Parse qkey1' and separate Hm and the quantum key qkey1.

8. The encryption / decryption system according to claim 7, characterized in that, The encryption / decryption system obtains the machine code of the computer device and performs a hash operation, comparing the hash value with Hm. If the two values ​​are not equal, it indicates that the machine code is inconsistent and the key and machine device do not match. The encryption / decryption system will not decrypt the data and will return an error message. If the two values ​​are equal, it indicates that the machine code is consistent. The system then finds the corresponding encryption algorithm based on the algorithm identifier and uses qkey1 as the key to perform a decryption operation on the data data': Dqkey1(data') = data, obtaining the final plaintext data data.

Images