A quantum replenishment key integrity protection method and device

Abstract

The application discloses a quantum filling key integrity protection method and device, belongs to the technical field of quantum communication, and relates to a quantum random number generator, a quantum exchange cipher machine, a key management system and a quantum key filling machine. The quantum random number generator utilizes quantum effect to generate a random number source of true random numbers; the quantum exchange cipher machine receives quantum keys sent by the quantum random number generator and is used for providing key services; the quantum exchange cipher machine pre-stores keys, the corresponding keys are pre-generated keys of the quantum random number generator and are stored in the quantum exchange cipher machine, and the keys in the security chip are symmetric keys; the key management system is responsible for creating and managing the keys; the quantum key filling machine is used for filling quantum keys and is connected with the output end of the quantum exchange cipher machine; and the security chip is connected on the quantum key filling machine and is used for storing the keys provided by the quantum key filling machine; and the characteristics of the Merkle tree are utilized to efficiently verify whether the filled keys are tampered.

Description

Technical Field

[0001] This invention belongs to the field of quantum communication technology, specifically a method and device for protecting the integrity of quantum key filling. Background Technology

[0002] Currently, a key filling machine is typically connected directly to a key management system or cryptographic machine to securely fill keys into a secure chip or a dedicated carrier. For example, in related technologies, invention patent application CN114095167A discloses a quantum key filling method for a communication terminal. This method establishes a connection between the filling terminal, a quantum random number generator, a key exchange machine, and a cryptographic service platform. It utilizes a key exchange machine instead of a quantum key distribution device, generating quantum keys based on quantum random numbers and using these quantum keys to generate key pairs for filling. The invention patent application with publication number CN113824556A discloses a method and system for protecting the operating system of a quantum key injector. The implementation steps include: (1) Initialization stage: a set of quantum key injector system installers is customized and combined with a security cryptographic module to generate an S-verification value for verifying the legality of the quantum key injector operating system and store it in the security cryptographic module; (2) System installation stage: the operating system to be installed is obtained through the quantum key injector system installer, and the verification value of the security cryptographic module is called to verify the operating system to be installed. If the verification passes, the installation is allowed; otherwise, the installation is prevented; (3) System operation stage: the quantum key injector is started, and the core injector program of the quantum key injector calls the verification value of the security cryptographic module to verify the installed operating system. If the verification passes, the system runs normally; otherwise, the system stops running.

[0003] However, these technologies only consider the trusted authentication of the key-gathering terminal during the key-gathering stage of its lifecycle. The integrity of the key throughout its lifecycle—including usage (verification), cancellation, loss reporting, and re-gathering—is generally protected by the overall hash of the key. However, since key-gathering volumes are typically in the hundreds of thousands, calculating the overall hash is inefficient; any change requires a complete hash calculation. Furthermore, server-side verification of key-gathering also requires significant disk I / O to query the key. Summary of the Invention

[0004] To address the problems existing in the above-mentioned solutions, this invention provides a method and apparatus for protecting the integrity of quantum key filling. The objectives of this invention are:

[0005] 1. Protect the confidentiality of the filling key;

[0006] 2. Protect the integrity of the filling key and prevent tampering;

[0007] 3. Reduce the problem of low processing efficiency in key filling verification and improve verification efficiency.

[0008] The objective of this invention can be achieved through the following technical solutions:

[0009] A quantum key integrity protection device, comprising:

[0010] Quantum random number generator: A random number source that uses quantum effects to generate truly random numbers;

[0011] Quantum exchange cryptography machine: Receives quantum keys from a quantum random number generator to provide key services;

[0012] The quantum exchange cryptography machine pre-stores a key, which is a key pre-generated by a quantum random number generator and stored in the quantum exchange cryptography machine. This key is a symmetric key with the key in the security chip.

[0013] Key Management System (KMS): Responsible for creating and managing keys;

[0014] Quantum key filling machine: used for filling quantum keys; connected to the output of a quantum exchange cipher;

[0015] Security chip (SE): Connected to the quantum key injector, it is used to store the key provided by the quantum key injector.

[0016] A method for protecting the integrity of quantum key filling, comprising the following steps:

[0017] Step 1: The quantum key injection machine's security chip requests a key from the key management system;

[0018] Step 2: The quantum key exchange machine generates the key filling key and sends it to the quantum key filling machine in the form of a digital envelope;

[0019] Step 3: The quantum key injection machine decrypts the digital envelope and imports the KEK into the secure chip using the injection key ciphertext;

[0020] Step 4: Use KEK to decrypt the ciphertext of the injection key within the security chip, calculate the plaintext hash value, and build a Merkle tree (MT).

[0021] Step 5: The key management system establishes the same Merkle tree (MT), with the leaf nodes storing the LMK-encrypted injection key ciphertext.

[0022] The specific steps for step one are as follows:

[0023] S11: After the security chip is installed on the filling machine, read the unique identifier of the security chip;

[0024] S12: The filling machine calls the security chip to generate a public-private key pair;

[0025] S13: The filling machine uses the unique identifier and public key of the security chip to apply for a filling key from the key management platform;

[0026] S14: The key management platform calls the quantum exchange cryptography to generate the encryption key KEK corresponding to the security chip, and saves the information of the security chip to the database.

[0027] Step two includes methods for handling large-scale key filling:

[0028] S21: A basic unit is 4K keys, and a fragment is M basic units. The fragments are identified by consecutive numbers.

[0029] S22: The data in the i-th slice is encrypted with Kai, KEK, slice number, and KEK-encrypted injection key ciphertext, and then encrypted with the public key of the security chip, and sent to the quantum key injection machine in the form of a digital envelope; the Kai is randomly generated by the quantum exchange cryptography machine.

[0030] S23: The quantum key injector uses the private key of the security chip to decrypt and obtain Kai. By decrypting Kai, it obtains the encrypted KEK, the fragment sequence number, and the ciphertext of the injecting key encrypted with KEK. After all fragments are received, they are concatenated into a complete ciphertext of the injecting key according to the sequence number.

[0031] It also includes a method for verifying the integrity of the filling key.

[0032] The methods for verifying the integrity of the filling key include:

[0033] SS1: The filling key ciphertext is stored in the security chip and key management system in the form of a Merkle tree (MT).

[0034] SS2: The mobile terminal obtains the key identifier keyId, version number, key serial number i, and top hash of the key charged in the security chip, and carries the key identifier keyId, version number, key serial number offset, and top hash to the key management system to apply for a session key;

[0035] SS3; The key management system verifies whether the Top Hash is consistent with the local Top Hash and verifies whether the data has been tampered with.

[0036] SS4: The key management system calls the quantum exchange cryptographic machine to generate a session key. Based on keyId, version, and i, it finds and calculates the corresponding recharge key ciphertext, calls the quantum exchange cryptographic machine to decrypt it into plaintext Ki, and uses the recharge key plaintext Ki to encrypt the session key and return it to the mobile terminal. At the same time, it sets the corresponding recharge key locally to invalid and updates TopHash.

[0037] SS5: After receiving the session key, the mobile terminal calls the security chip to decrypt and obtain the session key, then destroys or invalidates the charging key Ki, and updates the Top Hash.

[0038] The Top Hash update in SS4 includes:

[0039] SS41: Before a basic unit of 4K keys is exhausted, the structure of the Merkle tree (MT) is not changed. Instead, the injection key at the corresponding position is set to 0000000000000000, and then the hash of the leaf node is updated.

[0040] SS42: Assuming the node is A, after setting it to 0, the hash value of node A is... Get the hash value Hb of the leaf node B at the left / right position of the charging key, calculate b and update the hash of the parent node, and calculate the hash value of the parent node from bottom to top until the Top Hash;

[0041] SS43: The updated Top Hash synchronously updates the Top Hash in the key structure, and simultaneously increments the current sequence number i by 1;

[0042] SS44: The Key Management System (KMS) fills the node with a key of 0 in the same way and updates the Top Hash;

[0043] SS45: When the 4K basic unit of charging key is exhausted, a subtree deletion operation of Merkle tree (MT) is performed. The plaintext hash calculation is performed inside the security chip. After the subtree is deleted, the storage space is released, and the current sequence number i is set to 1.

[0044] SS46: When refilling the same security chip, the version number is incremented by 1, and a new Merkle tree MT is created to reduce the structural transformation operations of the Merkle tree MT.

[0045] SS47: Caches the injection key of a basic unit and its corresponding Merkle tree (MT) structure, caches the sibling node hash of the basic unit subtree on the cache chain, the parent hash, and so on up to the Top Hash;

[0046] SS48: Updates to the Top Hash can be performed asynchronously, and then merged to reduce the actual number of I / O operations.

[0047] Compared with the prior art, the beneficial effects of the present invention are:

[0048] 1. Confidentiality protection of the filling key:

[0049] The charging key is stored in encrypted form in both the key management platform and the security chip, and the encryption keys on both sides are different. Both are protected by encryption hardware, which meets the requirements of national cryptographic standards for key management and ensures the confidentiality of the charging key.

[0050] 2. Integrity protection of the filling key:

[0051] This method leverages the properties of Merkle trees (MT) to efficiently verify whether the injection key has been tampered with.

[0052] 3. Improve verification efficiency by reducing the low processing efficiency of key filling verification:

[0053] In actual use, it is not necessary to query the leaf nodes of the Merkle tree (MT). It is only necessary to verify whether the Top Hash is consistent to determine whether the injection key has been tampered with. By using caching, asynchronous updates, batch updates, and other methods, the number of I / O operations is reduced and performance is improved. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart of the method of the present invention;

[0056] Figure 2 This is a schematic diagram of the Merkle tree MT structure of the present invention. Detailed Implementation

[0057] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0058] like Figures 1 to 2 As shown, a quantum key integrity protection device includes:

[0059] Quantum random number generator: A random number source that uses quantum effects to generate truly random numbers;

[0060] Quantum exchange cryptography machine: Receives quantum keys from a quantum random number generator to provide key services. The quantum exchange cryptography machine has a key pre-stored inside. This key is a key pre-generated by the quantum random number generator and stored inside the quantum exchange cryptography machine. It is a symmetric key with the key in the security chip.

[0061] Key Management System (KMS): Responsible for creating and managing keys, protecting the confidentiality, integrity and availability of keys, and meeting the key management needs of applications and businesses.

[0062] The quantum key filling machine is connected to the output of the quantum exchange cryptography machine and is used to fill quantum keys;

[0063] Security chip (SE): Connected to the quantum key injector, it is responsible for storing the key provided by the quantum key injector.

[0064] Merkle Tree (MT): A Merkle Tree (MT) is a hash tree in which each leaf node is labeled with the cryptographic hash value of a data block, and each non-leaf node is labeled with the cryptographic hash values ​​of its child nodes. For example... Figure 2 This is a simplified structural diagram of a Merkle tree (MT).

[0065] The L1-L4 bottom layer stores the original injection key ciphertext data, which is the data contained in the leaf nodes;

[0066] HashL1-HashL4 layers: leaf nodes, which are obtained by performing hash operations on the original data to get the corresponding hash value;

[0067] Hash0 and Hash1 layers: These are the intermediate nodes, which are the hash values ​​of leaf nodes 0-0, 0-1 and leaf nodes 1-0, 1-1, respectively.

[0068] Top Hash layer: also known as the Merkle tree root (MT root), is the root node obtained by hashing the data of the intermediate nodes.

[0069] As can be seen from the structure of Merkle Trees (MT), if any original transaction data is modified, the hash value of the leaf node will change, and ultimately the hash value of the root node will change. Therefore, when determining whether the data pointed to by two Merkle Trees (MT) are exactly the same, it is not necessary to compare every leaf node; only the hash stored in the root node needs to be compared to determine whether the data has been tampered with. In addition, updating the data of the leaf nodes only requires calculating the hash value of each node on the link at each level, without having to calculate it all at once.

[0070] A method for protecting the integrity of quantum key filling, comprising the following steps:

[0071] Step 1 (S1): Install the security chip onto the quantum key injector and initiate a key injection request to the key management system through the trusted data channel between the quantum key injector and the key management system. The key management system calls the quantum exchange cryptography to generate the key encryption key KEK corresponding to the security chip.

[0072] Step 2 (S2): The quantum key exchange cryptography machine uses a quantum random number generator to generate a charge key plaintext, calculates the plaintext hash, and then uses the encryption key KEK symmetric encryption (SM4) to charge the key plaintext. At the same time, it uses the charge machine's public key to encrypt KEK and sends it to the quantum key charge machine in the form of a digital envelope.

[0073] Step 3 (S3): The quantum key injector decrypts the KEK with the private key and imports the KEK and the injecting key ciphertext into the secure chip;

[0074] Step 4 (S4): The plaintext of the charging key is obtained by decrypting it with KEK in the security chip. At the same time, the plaintext hash value of the charging key is calculated, and a Merkle tree (MT) is built. The leaf nodes still store the KEK-encrypted ciphertext of the charging key.

[0075] Step 5 (S5): At the same time, the key management system establishes the same Merkle tree MT, but the leaf nodes store the ciphertext of the injection key after being encrypted by the local master key LMK (encryption hardware protection) of the quantum exchange cryptographic machine.

[0076] The specific steps for step one are as follows:

[0077] S11: After the security chip is installed on the filling machine, read the unique identifier of the security chip, such as: media number, serial number;

[0078] S12: The filling machine calls the security chip to generate an ECC (SM2) public / private key pair;

[0079] S13: The filling machine uses the unique identifier and public key of the security chip to apply for a filling key from the key management platform;

[0080] S14: The key management platform calls the quantum exchange cryptography to generate the key encryption key KEK corresponding to the security chip, and saves the unique identifier of the security chip, public key, KEK and other information to the database.

[0081] Step two addresses the issue of large-scale key injection, which can be resolved using the following steps:

[0082] S21: Using 4K (4096) keys as a basic unit, and M (configurable, e.g., 100) basic units as a slice, the slices are identified by consecutive numbers, and the slices can be generated in parallel;

[0083] S22: The data in the i-th slice is encrypted with Kai (quantum exchange cryptography random generation) KEK, slice number and KEK encrypted filling key ciphertext, Kai is encrypted with the public key of the security chip and sent to the filling machine in the form of a digital envelope;

[0084] S23: The filling machine uses the private key of the security chip to decrypt and obtain Kai. Then, it uses Kai to decrypt and obtain the encrypted KEK, the fragment sequence number, and the filling key ciphertext encrypted with KEK. After all fragments are received, they are concatenated into a complete filling key ciphertext according to the sequence number.

[0085] The key structure for filling in step four is as follows:

[0086]

[0087] The present invention also provides a method for verifying the integrity of a filling key, comprising the following steps:

[0088] Step 1 (SS1): The key ciphertext (LMK encryption of the encryption machine) is filled and stored in the form of MT in the security chip (SE) and key management system (KMS);

[0089] Step 2 (SS2): The mobile terminal obtains the key identifier keyId, version number, key serial number i, and top hash from the security chip (SE), and carries the key identifier keyId, version number, key serial number offset, and top hash to the key management system (KMS) to apply for a session key;

[0090] Step 3 (SS3); The Key Management System (KMS) first verifies whether the Top Hash is consistent with the local Top Hash to check whether the data has been tampered with;

[0091] Step 4 (SS4): The Key Management System (KMS) calls the quantum exchange cryptographic machine to generate a session key, then finds and calculates the corresponding recharge key ciphertext based on keyId, version, and i, calls the quantum exchange cryptographic machine to decrypt it into plaintext Ki, and uses the recharge key plaintext Ki to encrypt the session key, returns it to the mobile terminal, and at the same time sets the corresponding local recharge key to invalid and updates the Top Hash.

[0092] Step 5 (SS5): After receiving the session key, the mobile terminal calls the security chip to decrypt and obtain the session key, then destroys or invalidates the charging key Ki, and updates the Top Hash.

[0093] Step SS4, updating the Top Hash, includes:

[0094] SS41: Before the key of a basic unit 4K (4096) is exhausted (i<4095), the structure of the Merkle tree MT is not changed, but the filling key at the corresponding position is set to 0000000000000000, and then the Hash of the leaf node is updated.

[0095] SS42: Assuming the node is A, after setting it to 0, the hash value of node A is... Get the hash value Hb of the leaf node B at the left / right position of the charging key, calculate b and update the hash of the parent node, and calculate the hash value of the parent node from bottom to top until the Top Hash;

[0096] SS43: The updated Top Hash synchronously updates the Top Hash in the key structure, and simultaneously increments the current sequence number i by 1;

[0097] SS44: The Key Management System (KMS) fills the node with a key of 0 in the same way and updates the Top Hash;

[0098] SS45: When the basic unit 4K (4096) of the injection key is exhausted (i≥4095), a subtree deletion operation of the Merkle tree MT is performed. All plaintext hash calculations are performed inside the security chip. After the subtree is deleted, the storage space is released, and the current sequence number i is set to 1.

[0099] SS46: When refilling the same security chip, the version number is incremented by 1, and a new Merkle tree MT is created to reduce the structural transformation operations of the Merkle tree MT.

[0100] SS47: To reduce disk I / O, a basic unit of injection key and its corresponding Merkle tree (MT) structure can be cached, along with the sibling node hash, parent hash, and so on up to the top hash of the basic unit subtree in the chain.

[0101] SS48: For high-concurrency scenarios, the operation of updating the Top Hash can be performed asynchronously, and then the updates can be merged to reduce the actual number of I / O operations.

[0102] In this invention, the injection keys of the leaf nodes of the Merkle tree MT in the security chip and the key management platform are stored in ciphertext. The keys of the two are different and are protected by encryption hardware. At the same time, the Merkle tree MT uses plaintext hash for easy verification between the two sides. When creating or deleting nodes in the Merkle tree MT, the calculation of plaintext hash occurs inside the security chip, which protects the security of the injection key.

[0103] The Merkle tree (MT) structure is used to protect the integrity of the injection key and prevent tampering.

[0104] In actual use, it is not necessary to query the leaf nodes of the Merkle tree (MT). It is only necessary to verify whether the Top Hash is consistent to determine whether the injection key has been tampered with. By using caching, asynchronous updates, batch updates, and other methods, the number of I / O operations is reduced and performance is improved.

[0105] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A quantum key integrity protection device, characterized in that, include: Quantum random number generator: A random number source that uses quantum effects to generate truly random numbers; Quantum exchange cryptography machine: Receives quantum keys from a quantum random number generator to provide key services; The quantum exchange cryptography machine pre-stores a key, which is a key pre-generated by a quantum random number generator and stored in the quantum exchange cryptography machine. This key is a symmetric key with the key in the security chip. Key management system: responsible for creating and managing keys; Quantum key filling machine: used for filling quantum keys; Connect to the output of the quantum exchange cryptography machine; Security chip: Connected to the quantum key injector, used to store the key provided by the quantum key injector; The quantum charging key integrity protection device is used to execute a quantum charging key integrity protection method, the specific steps of which include: Step 1: The quantum key injection machine's security chip requests a key from the key management system; Step 2: The quantum key exchange machine generates the key filling key and sends it to the quantum key filling machine in the form of a digital envelope; Step 3: The quantum key injection machine decrypts the digital envelope and imports the KEK and injection key ciphertext into the secure chip; Step 4: Use KEK to decrypt the ciphertext of the injection key within the security chip, calculate the plaintext hash value, and build a Merkle tree (MT). Step 5: The key management system establishes the same Merkle tree (MT), with the leaf nodes storing the LMK-encrypted injection key ciphertext; It is also used to perform a key integrity verification method, which includes: SS1: The filling key ciphertext is stored in the security chip and key management system in the form of a Merkle tree (MT). SS2: The mobile terminal obtains the key identifier keyId, version number, key serial number i, and top hash of the key charged in the security chip, and carries the key identifier keyId, version number, key serial number offset, and top hash to the key management system to apply for a session key; SS3; The key management system verifies whether the Top Hash is consistent with the local Top Hash and verifies whether the data has been tampered with. SS4: The key management system calls the quantum exchange cryptographic machine to generate a session key. Based on keyId, version, and i, it finds and calculates the corresponding recharge key ciphertext, calls the quantum exchange cryptographic machine to decrypt it into plaintext Ki, and uses the recharge key plaintext Ki to encrypt the session key and return it to the mobile terminal. At the same time, it sets the corresponding recharge key locally to invalid and updates the Top Hash. SS5: After receiving the session key, the mobile terminal calls the security chip to decrypt and obtain the session key, then destroys or invalidates the charging key Ki, and updates the Top Hash.

2. The quantum key integrity protection device according to claim 1, characterized in that, The specific steps for step one are as follows: S11: After the security chip is installed on the filling machine, read the unique identifier of the security chip; S12: The filling machine calls the security chip to generate a public-private key pair; S13: The filling machine uses the unique identifier and public key of the security chip to apply for a filling key from the key management platform; S14: The key management platform calls the quantum exchange cryptography machine and generates the key encryption key KEK corresponding to the security chip, and saves the information of the security chip to the database.

3. The quantum key integrity protection device according to claim 1, characterized in that, Step two includes methods for handling large-scale key filling: S21: A basic unit is 4K keys, and a fragment is M basic units. The fragments are identified by consecutive numbers. S22: The data in the i-th slice is encrypted with Kai, KEK, slice number, and KEK-encrypted injection key ciphertext, and then encrypted with the public key of the security chip, and sent to the quantum key injection machine in the form of a digital envelope; the Kai is randomly generated by the quantum exchange cryptography machine. S23: The quantum key injector uses the private key of the security chip to decrypt and obtain Kai. By decrypting Kai, it obtains the encrypted KEK, the fragment sequence number, and the ciphertext of the injecting key encrypted with KEK. After all fragments are received, they are concatenated into a complete ciphertext of the injecting key according to the sequence number.

4. The quantum key integrity protection device according to claim 1, characterized in that, The Top Hash update in SS4 includes: SS41: Before a basic unit of 4K keys is exhausted, the structure of the Merkle tree (MT) is not changed. Instead, the injection key at the corresponding position is set to 0000000000000000, and then the hash of the leaf node is updated. SS42: Assuming the node is A, after setting it to 0, the hash value of node A is... Get the hash value Hb of the leaf node B at the left / right position of the charging key, calculate b and update the hash of the parent node, and calculate the hash value of the parent node from bottom to top until TopHash; SS43: The updated Top Hash synchronously updates the Top Hash in the key structure, and simultaneously increments the current sequence number i by 1; SS44: The Key Management System (KMS) fills the node with a key of 0 and updates the Top Hash in the same way; SS45: When the 4K basic unit of charging key is exhausted, a subtree deletion operation of Merkle tree (MT) is performed. The plaintext hash calculation is performed inside the security chip. After the subtree is deleted, the storage space is released, and the current sequence number i is set to 1. SS46: When refilling the same security chip, the version number is incremented by 1, and a new Merkle tree MT is created to reduce the structural transformation operations of the Merkle tree MT. SS47: Caches the injection key of a basic unit and its corresponding Merkle tree (MT) structure, caches the sibling node hash of the basic unit subtree on the cache chain, the parent hash, and so on up to the Top Hash; SS48: Updates to the Top Hash can be performed asynchronously, and then merged to reduce the actual number of I / O operations.

Images