A method and system for processing root key file requests

Abstract

The present invention discloses a method and system for processing root key file requests. The root key file request processing method of the present application encrypts the device ID and target key identifier in the message when sending a key request message. After receiving the key request message, the key distribution end first obtains the decryption key according to the index, then decrypts the encrypted content in the key request message, and further authenticates the device ID obtained by decryption before returning the corresponding root key response message. Since the information is encrypted throughout the entire communication process and the encrypted keys are all in the hands of the communicators, the security of the communication is greatly improved. The root key file request processing system of the present application mainly includes a terminal, a key relay end and a key distribution server. The information in the key request message is generated by terminal encryption, and the key relay end does not store the key used to encrypt the key request message, thereby reducing the possibility of key leakage.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for processing a root key file request. Background Art

[0002] Information technology plays an increasingly important role in the national economy. It has become a powerful driving force for economic development and social progress, and a key indicator of a country's comprehensive national strength and international competitiveness. The emergence and widespread use of large-scale information application systems such as e-commerce, e-government, cloud computing, the Internet of Things, and big data processing have placed new and higher demands on information security. Information security is no longer limited to the static protection of information, but requires the protection and defense of the entire information system.

[0003] To meet the growing demands for information and network security, quantum security devices have emerged as a technology that uses quantum cryptography to ensure information security. These devices utilize quantum properties and principles to perform a range of encryption techniques, including key generation, plaintext obfuscation and encryption, ciphertext restoration and decryption, ciphertext communication, and anti-eavesdropping. Not only do they address the transmission issues of one-time pads, but quantum encryption keys are randomly generated during communication, making them impenetrable to eavesdropping and cracking, significantly improving overall security.

[0004] During communication, quantum security devices transmit encrypted data over traditional networks and the quantum key used to encrypt data through a key relay network. This quantum key transmission requires the key relay to relay the quantum key used by the sender to the receiver. To improve security, only the key index is transmitted during this relay process, not the actual key. Therefore, in the key relay network, the key relay and the sender must synchronize the same root key. However, currently, when a key relay requests the root key from the key distributor, the message content is transmitted in plaintext, which poses a security risk of information leakage when the key relay requests the root key file. Summary of the Invention

[0005] In order to solve the above problem, the present invention discloses a method for processing a root key file request.

[0006] This application provides a method for processing a root key file request, the method comprising:

[0007] Receiving a key request message from a key relay terminal, the key request message including a key file index, first encrypted information, and second encrypted information, wherein the encrypted content of the first encrypted information includes a device ID, and the encrypted content of the second encrypted information includes a target key identifier;

[0008] matching the root key generation record according to the key file index in the key request message and the first encrypted information; when the root key generation record matches successfully, obtaining a decryption key according to the root key generation record to decrypt the first encrypted information and the second encrypted information to obtain the device ID and the target key identifier; if the decrypted device ID matches the information in the root key generation record, generating a root key response message indicating a successful request, and carrying file location information of the root key file corresponding to the target key identifier in the root key response message; otherwise, sending a root key response message indicating a failed request to the key relay terminal;

[0009] When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal.

[0010] In the above solution, the method for the key relay terminal to generate a key request message includes:

[0011] An access command message is received from a terminal, and the key request message is generated according to the key file index, the first encryption information, and the second encryption information in the access command message.

[0012] In the above solution, the encryption method of the first encrypted information and the second encrypted information includes:

[0013] Receiving a first key extension parameter from a key distribution terminal, and obtaining a second key extension parameter according to preset parameter data;

[0014] concatenating the first key extension parameter and the second key extension parameter to obtain an initial key, and then expanding the initial key to form an expanded key according to a preset key expansion algorithm;

[0015] The extended key is split into two encryption keys according to a preset rule; one of the two encryption keys is selected to encrypt the device ID to obtain a first encrypted message, and the other of the two encryption keys is used to encrypt the target key identifier to obtain a second encrypted message.

[0016] In the above solution, the length of the extended key is consistent with the total length of the device ID and the target key identifier.

[0017] In the above solution, the method for selecting the encryption key of the device ID and the target key identifier includes:

[0018] Obtaining attribute information of a root key to be downloaded, obtaining a group random number based on the attribute information, and determining the parity of the group random number;

[0019] If the group random number is an odd number, the first key is selected to encrypt the device ID and the second key is selected to encrypt the target key identifier; otherwise, the second key is selected to encrypt the device ID and the first key is selected to encrypt the target key identifier.

[0020] In the above solution, the method for decrypting the first encrypted information and the second encrypted information includes:

[0021] Obtaining a group random number from the root key generation record, and determining the parity of the group random number;

[0022] If the group random number is an odd number, the first encrypted information is decrypted using the first key, and the second encrypted information is decrypted using the second key; otherwise, the first encrypted information is decrypted using the second key, and the second encrypted information is decrypted using the first key.

[0023] In the above solution, the method for generating the target key identifier includes:

[0024] The terminal performs a hash check on the root key file. If the check succeeds, the terminal generates an index corresponding to the successfully checked root key file, which is used as the target key identifier.

[0025] The present application also provides a root key file request processing system, the system comprising:

[0026] The terminal is configured to perform a hash check on the pre-injected root key file, generate a target key identifier corresponding to the root key file after the check passes, obtain a device ID and a key file index based on preset parameter data, and generate an access command message; wherein the access command message includes the key file index, first encrypted information, and second encrypted information, the encrypted content of the first encrypted information including the device ID, and the encrypted content of the second encrypted information including the target key identifier;

[0027] a key relay terminal, configured to receive an access command message from a terminal, generate a root key request message according to the access command message, send the root key request message to a key distribution server, and download a root key file from the key distribution server according to a root key response message from the key distribution server;

[0028] A key distribution server is configured to receive a root key request message and match a root key generation record based on a key file index in the key request message and the first encrypted information; when the root key generation record matches, obtain a decryption key based on the key generation record to decrypt the first encrypted information and the second encrypted information to obtain a device ID and a target key identifier; if the decrypted device ID matches the information in the root key generation record, generate a root key response message indicating a successful request, and carry file location information of a root key file corresponding to the target key identifier in the root key response message; otherwise, send a root key response message to the key relay terminal indicating a failed request;

[0029] When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal.

[0030] In the above solution, the key distribution server includes an encryption and decryption module, which is used to decrypt the encrypted content in the root key request message.

[0031] In the above scheme, the encryption and decryption module is also used to splice the first key extension parameter and the second key extension parameter to form an initial random number, then expand the initial key to form an extended key according to a preset key expansion algorithm, and split the first key in the extended key into a first key and a second key according to a preset rule.

[0032] In the above solution, the key distribution server further includes a query module, which is used to search and determine the root key generation record based on the key file index and the encrypted device ID.

[0033] The root key file request processing method of the present application encrypts the device ID and target key identifier in the message when sending a key request message to form encrypted information. After receiving the key request message, the key distribution end first obtains the decryption key according to the index, and then decrypts the encrypted content in the key request message, and further authenticates it according to the decrypted device ID, and then returns the corresponding root key response message; because the information is encrypted throughout the communication process and the encrypted keys are all in the hands of the communicators, the security of the communication is greatly improved; the root key file request processing system of the present application mainly includes a terminal, a key relay end and a key distribution server, the information in the key request message is generated by terminal encryption, and the key relay end does not store the key used to encrypt the key request message, which reduces the possibility of key leakage and is more conducive to improving its security. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Flowchart of a method for processing a root key file request in an embodiment of the present application;

[0035] Figure 2 This is a timing diagram of the root key file request processing method in Example 2 of the present application;

[0036] Figure 3 This is a flow chart of a method for generating a first key and a second key in Example 2 of the present application;

[0037] Figure 4 Flowchart of a method for obtaining a decryption key for decrypting first encrypted information and second encrypted information in Example 2 of the present application;

[0038] Figure 5 This is a structural diagram of the key distribution server in an embodiment of the present application. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of this application without making any creative efforts are within the scope of protection of this application.

[0040] Example 1: See Figure 1-5 A method for processing root key file requests is applied to a key relay network of a quantum security device. The key relay network is used for relaying quantum keys and generally includes a quantum security terminal, a key relay terminal, and a key distribution server. The key distribution server is used to generate a key file for pre-injection in the quantum security terminal. After the quantum security terminal is connected to the key relay terminal, the key relay terminal needs to request a key file from the key distribution server. The requested key file is the same as the key file pre-injected in the quantum security terminal. During the key relay process, only an index indicating the key to be relayed is transmitted between the quantum security terminal and the key relay terminal. The key relay terminal searches for the key that the quantum security terminal needs to relay based on the index. The quantum security terminal in this embodiment mainly refers to a terminal that encrypts and decrypts data using a quantum random number generator (QRNG).

[0041] The method comprises:

[0042] Receive a key request message from a key relay terminal, the key request message including a key file index, first encryption information, and second encryption information, wherein the encrypted content of the first encryption information includes a device ID, and the encrypted content of the second encryption information includes a target key identifier; the key file index is used to indicate the index relationship of the key file generated by the key distribution server, and the key distribution server receives the key file index and searches for the key file generated by it according to the key file index; key files generally include multiple groups, and each group of key files may include multiple separate root key files; after accessing the key relay terminal, the quantum security terminal will perform a hash check on each separate root key file in each group of key files pre-injected therein, and generate an index corresponding to the successfully verified root key file, i.e., the target key identifier; the key requested by the key relay terminal is the root key file successfully verified by the quantum security terminal;

[0043] The quantum security terminal stores the key file index and device ID corresponding to the pre-injected key file. The device ID is used to indicate the unique attribute code of the device.

[0044] The first encrypted information and the second encrypted information are obtained by the quantum security terminal encryption device ID and the target key identifier. The key file index, the first encrypted information and the second encrypted information are sent to the key relay terminal via the quantum security terminal. The key relay terminal constructs a key request message based on the key file index, the first encrypted information and the second encrypted information.

[0045] The key distribution server matches the root key generation record according to the key file index in the key request message and the first encrypted information; when the root key generation record is successfully matched, the decryption key is obtained according to the root key generation record to decrypt the first encrypted information and the second encrypted information to obtain the device ID and the target key identifier; if the decrypted device ID matches the information in the root key generation record, a root key response message is generated to indicate that the request is successful, and the file location information of the root key file corresponding to the target key identifier is carried in the root key response message; otherwise, a root key response message is sent to the key relay end to indicate that the request failed; the key distribution server matches the root key generation record according to the first encrypted information, and on the other hand, verifies whether the decrypted device ID matches the information in the root key generation record, thereby forming a dual authentication with higher reliability and better security;

[0046] The root key generation record contains the attribute information related to the key file generated by the key distribution server. This attribute information mainly includes the device ID corresponding to the generated key file, the encrypted device ID, the key file index, the key file storage location information, and the key parameters used to encrypt or decrypt messages. The encrypted device ID is used to directly match the first encrypted information when a key request is made. The key distribution server does not need to decrypt it and then search and match the relevant records, which is more convenient and faster. At the same time, because the matching is done on the encrypted information, even if obtained by outsiders, it is difficult to know the true content of the encryption, which also improves security.

[0047] When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal, which means that the key distribution server has not found the correct root key generation record and thus cannot provide key download service for the key relay terminal.

[0048] The method for the key relay terminal to generate a key request message includes:

[0049] An access command message is received from a quantum security terminal, and the key request message is generated according to the key file index, the first encryption information, and the second encryption information in the access command message.

[0050] The method for the quantum security terminal to generate the first encrypted information and the second encrypted information includes:

[0051] Receive the first key extension parameter from the key distribution server and obtain the second key extension parameter according to the preset parameter data; when the quantum security terminal accesses the key relay terminal, it will send an access request message to the key relay terminal; the key relay terminal receives the access request message and selects the corresponding key distribution server according to the preset configuration. The key distribution server authenticates the quantum security terminal according to the device ID and other information in the access request message, and returns the first key extension parameter to the quantum security terminal after the authentication is passed; the second key extension parameter is pre-injected in the corresponding parameter data when the quantum security terminal leaves the factory;

[0052] The first key extension parameter and the second key extension parameter are concatenated to obtain an initial key, and the initial key is then expanded according to a preset key expansion algorithm to form an extended key. The first key extension parameter and the second key extension parameter are both random numbers, and when concatenating, the two are concatenated end to end according to consecutive bits to form the initial key. The key expansion algorithm can use an existing algorithm such as AES or SM3, which is not specifically limited here. When expanding, the length of the extended key can be consistent with the total length of the device ID and the target key identifier.

[0053] The extended key is split into two encryption keys according to a preset rule; one of the two encryption keys is selected to encrypt the device ID to obtain a first encrypted message, and the other of the two encryption keys is used to encrypt the target key identifier to obtain a second encrypted message. Specifically, the extended key can be split into encryption keys of corresponding lengths according to the lengths of the device ID and the target key identifier according to consecutive bits;

[0054] The specific method for selecting the encryption key of the device ID and the target key identifier includes:

[0055] Obtaining attribute information of the root key to be downloaded, obtaining a group random number based on the attribute information, and determining the parity of the group random number; the attribute information is included in the parameter data of the quantum security terminal, and the group random number is synchronously generated by the key distribution server based on the device ID and the serial number of each group key file when generating each group key file; the group random number is imported into the quantum security terminal when it leaves the factory, and the group random number is also recorded in the root key generation record of the key distribution server;

[0056] If the group random number is an odd number, the first key is selected to encrypt the device ID and the second key is selected to encrypt the target key identifier; otherwise, the second key is selected to encrypt the device ID and the first key is selected to encrypt the target key identifier.

[0057] The method for the key distribution server to decrypt the first encrypted information and the second encrypted information includes:

[0058] Obtaining a group random number from the root key generation record, and determining the parity of the group random number;

[0059] If the group random number is an odd number, the first encrypted information is decrypted using the first key, and the second encrypted information is decrypted using the second key; otherwise, the first encrypted information is decrypted using the second key, and the second encrypted information is decrypted using the first key.

[0060] When sending a key request message, the above method encrypts both the device ID and the target key identifier in the message to form encrypted information. After receiving the key request message, the key distribution terminal first obtains the decryption key based on the index, then decrypts the encrypted content in the key request message, and further authenticates the device ID based on the decrypted device ID before returning the corresponding root key response message. In this process, on the one hand, since the information is encrypted throughout the communication process, on the other hand, the encrypted key requires obtaining the first key extension parameter and the second key extension parameter, combined with a preset key extension algorithm to generate. Even if the first key extension parameter in the quantum security terminal is leaked, the outside world cannot know the correct encryption key and thus cannot decrypt the content of the information. At the same time, when determining the specific encryption key, the key needs to be selected according to the parity of the group random number. Due to the uncertainty of the random number, the selection of the encryption key is also in a state of constant change. The eavesdropper needs to obtain all parameters and methods to correctly decrypt, which undoubtedly increases the difficulty of cracking. The encrypted key is fully controlled by the communicator throughout the entire process, so the security of the communication is greatly improved.

[0061] The present application also provides a root key file request processing system, the system comprising:

[0062] The terminal, i.e., a quantum security terminal, is configured to perform a hash check on the pre-injected root key file, generate a target key identifier corresponding to the root key file after the check passes, obtain a device ID and a key file index based on preset parameter data, and generate an access command message; wherein the access command message includes the key file index, first encrypted information, and second encrypted information, wherein the encrypted content of the first encrypted information includes the device ID, and the encrypted content of the second encrypted information includes the target key identifier;

[0063] a key relay terminal, configured to receive an access command message from a terminal, generate a root key request message according to the access command message, send the root key request message to a key distribution server, and download a root key file from the key distribution server according to a root key response message from the key distribution server;

[0064] See also Figure 5, a key distribution server is configured to receive a root key request message, and match a root key generation record according to the key file index in the key request message and the first encrypted information; when the root key generation record is successfully matched, obtain a decryption key according to the key generation record to decrypt the first encrypted information and the second encrypted information to obtain a device ID and a target key identifier; if the decrypted device ID matches the information in the root key generation record, generate a root key response message indicating a successful request, and carry file location information of the root key file corresponding to the target key identifier in the root key response message; otherwise, send a root key response message indicating a failed request to the key relay terminal;

[0065] When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal.

[0066] The key distribution server includes an encryption and decryption module 302, which is used to decrypt the encrypted content in the root key request message.

[0067] The encryption and decryption module 302 is also used to splice the first key extension parameter and the second key extension parameter to form an initial random number, then expand the initial key to form an extended key according to a preset key expansion algorithm, and split the first key in the extended key into a first key and a second key according to a preset rule.

[0068] At the same time, the key distribution server further includes a query module 303, which is used to search and determine the root key generation record according to the key file index and the encrypted device ID.

[0069] In addition, the key distribution server further includes a receiving module 301 for receiving messages and a sending module 304 for sending messages.

[0070] In the above scheme, when the quantum security terminal generates the access command message, it needs to rely on the first key expansion parameter from the key distribution server, and then combine it with its own second key expansion parameter to obtain the encryption key used to encrypt the device ID and the target key identifier;

[0071] Example 2: A root key file request processing system, the system comprising: a quantum security terminal, a key relay terminal, and a key distribution server;

[0072] Among them, the quantum security terminal is pre-injected with a root key when it leaves the factory. The root key is generated by the key distribution server based on the interface configuration or imported device information.

[0073] When generating the root key: the key distribution server generates root key information for the device based on the imported device information. The root key information includes the root key file and the generation record corresponding to the root key.

[0074] The root key generated by the key distribution server is one or more root key groups. Each root key group is identified by its generation number using a group ID. At the same time, a corresponding group selection random number Rg is generated for each root key group based on the device ID and group ID.

[0075] In one possible example, the group selected random number Rg is a true random number generated by a true random number generator to ensure its randomness, non-repeatability, and uniqueness, and to avoid duplication when a large number of root key groups are allocated; the randomness of the group selected random number Rg also makes it difficult to predict;

[0076] Each root key group may include multiple root key files, the number of which is determined by the file size granularity. Root key files are numbered starting from 1 and the file sequence is 1…n. In this embodiment, the number of root key files in each root key group is even. Files with odd numbers are used as upstream root keys, and files with even numbers are used as downstream root keys. After each root key file is generated, its corresponding hash value ho is calculated.

[0077] The key distribution server generates a corresponding generation record for the root key group based on the device ID;

[0078] The build record includes:

[0079] The key distribution server generates a first key extension parameter and a second key extension parameter according to a preset length;

[0080] And the device ID ciphertext information Ir obtained by encrypting the device ID.

[0081] The key distribution server simultaneously establishes a generation record table and a file record table, wherein the generation record table is based on the generation record when the above-mentioned root key file is generated, and the file record table is used to find the location file from the generation record table. The two tables are associated through the association index R, which is a one-to-many relationship.

[0082] When the root key is exported: the root key group and its corresponding root key parameter data are exported from the key distribution server, where the root key parameter data includes: the device ID (denoted as DID) corresponding to the root key group, the type identifier, and the authentication information corresponding to the root key group; the authentication information includes: the index corresponding to the root key group (denoted as root key index I1) and the second key extension parameter; the type identifier is used to indicate the encryption key extension algorithm and the decryption key extension algorithm;

[0083] When exporting the root key: the exported file uses the DID as the directory and the group ID as the subdirectory;

[0084] The root key files in each exported root key group carry the hash value ho corresponding to the file. In addition, the file header of each root key file also carries corresponding attribute information, including the file type, group ID, total number of files, number of type files, type file sequence number, and group selection random number Rg corresponding to the root key file. This attribute information is not encrypted.

[0085] From the above root key generation and derivation process, it can be seen that the root key group pre-injected in the quantum security terminal includes multiple root key files; at the same time, the file header of each individual root key file carries the attribute information corresponding to the file, which includes the file type, group ID, total number of files, number of type files, type file sequence number, and group selection random number Rg corresponding to the root key file; each root key file in the root key group has a file number, where the file with an odd number is used as the uplink root key of the quantum security terminal, and the file with an even number is used as the downlink root key of the quantum security terminal;

[0086] At the same time, the quantum security terminal also stores the root key parameter data corresponding to each root key group. The root key parameter data includes: the device ID (denoted as DID) corresponding to the root key, the type identifier, and the authentication information corresponding to each root key group file; the authentication information includes: the root key index I1 corresponding to the root key group and the second key expansion parameter; the type identifier is used to indicate the key expansion algorithm and the decryption key expansion algorithm;

[0087] See also Figure 2 The specific process of the key relay requesting the key includes:

[0088] 101. The quantum security terminal generates an access request message and sends it to the key relay terminal. The access request message carries the device ID.

[0089] 102. The key relay receives the access request message, searches for and determines the corresponding key distribution server according to a preset configuration, generates an authentication request message, and then sends the authentication request message to the key distribution server. The authentication request message carries the device ID.

[0090] 103. The key distribution server receives the authentication request message, performs identity authentication on the quantum security terminal according to the device ID in the authentication request message, and generates an authentication response message indicating successful authentication when the identity authentication is legal, and carries the first key extension parameter in the authentication response message;

[0091] When authentication fails, generating an authentication response message indicating the authentication failure;

[0092] 104. The key distribution server returns the authentication response message to the key relay terminal;

[0093] 105. The key relay terminal forwards the authentication response message to the quantum security terminal;

[0094] 106. The quantum security terminal receives an authentication response message. If the authentication response message indicates that the authentication is successful, a first key and a second key are generated according to a preset key expansion algorithm. The method for generating the first key and the second key includes:

[0095] S1, concatenate the first key extension parameter and the second key extension parameter to form an initial key;

[0096] S2, obtaining the encryption key expansion algorithm from the type identifier of the root key parameter data;

[0097] S3, based on a preset encryption key expansion algorithm and the length of the file to be encrypted, expanding the initial key to form an extended key corresponding to the file to be encrypted; using the first half of the extended key as the first key and the second half of the extended key as the second key according to consecutive bits;

[0098] S4, obtaining a group random number Rg from the attribute information in the file header of the root key file, and determining the parity of the group random number Rg;

[0099] If the group random number Rg is an odd number, the first key is selected to encrypt the device ID and the second key is selected to encrypt the target key identifier; otherwise, the second key is selected to encrypt the device ID and the first key is selected to encrypt the target key identifier; thereby obtaining the first encrypted information and the second encrypted information;

[0100] At the same time, according to the hash value ho carried in each root key plaintext file, each root key plaintext file is hash-verified to generate the index corresponding to the root key plaintext file with successful verification, which is recorded as the target key identifier I2;

[0101] In one possible example, a 256-bit extended key K is obtained by expansion. If the group random number Rg is an odd number, the first 128 bits of the extended key K are used as the first key, and the last 128 bits are used as the second key. The device ID is encrypted with the first key to obtain the first encrypted information, and the target key identifier I2 is encrypted with the second key to obtain the second encrypted information.

[0102] At the same time, an access command message is generated, which carries the root key index I1, the first encryption information and the second encryption information; and the access command message is sent to the key relay terminal.

[0103] 107. The key relay receives the access command message, generates a root key request message according to the access command message, and carries the root key index I1, the first encryption information, and the second encryption information in the message;

[0104] 109. The key relay terminal sends a root key request message to the key distribution server;

[0105] 110. The key distribution server receives the root key request message and matches the root key generation record with the root key index I1 in the message and the encrypted device ID. If the match is successful, the key distribution server obtains a decryption key based on the generation record, decrypts the encrypted content in the root key request message to obtain the device ID and the target key identifier I2, compares the decrypted device ID with the device ID recorded in the generation record, and if the two match, generates a root key response message indicating success. The message also carries the root key file location information corresponding to the target key identifier I2. If the verification fails, the key distribution server sends a root key response message indicating failure to the base station.

[0106] Compare the encrypted device ID with the encrypted device ID ciphertext information Ir obtained by encrypting the device ID in the record generated by the root key server for identity authentication, avoiding the exposure of the device ID plaintext during the message transmission process, thereby further improving the security of the authentication process;

[0107] The method for obtaining the key for decrypting the first encrypted information and the second encrypted information includes:

[0108] S11, obtaining a first key extension parameter and a second key extension parameter from a root key generation record, and concatenating the first key extension parameter and the second key extension parameter to form an initial key;

[0109] S12, obtaining an expansion algorithm for the decryption key from the root key generation record;

[0110] S13, based on a preset decryption key expansion algorithm and the length of the file to be decrypted, the initial key is expanded to form an extended key corresponding to the file to be decrypted; the first half of the extended key is used as the first key, and the second half of the extended key is used as the second key according to consecutive bits;

[0111] S14, obtaining a group random number Rg from the attribute information in the file header of the root key file, and determining the parity of the group random number Rg;

[0112] If the group random number Rg is an odd number, the device ID is decrypted using the first key and the target key identifier is decrypted using the second key; otherwise, the device ID is decrypted using the second key and the target key identifier is decrypted using the first key; thereby obtaining the device ID and the target key identifier I2;

[0113] If the match fails, a root key response message indicating the failure is directly returned to the base station;

[0114] When matching the root key generation record, the encrypted device ID must match the encrypted device ID Ir in the generation record. Identity authentication is performed by comparing the encrypted device ID with the encrypted device ID Ir obtained by encrypting the device ID in the root key server generation record. This prevents the plaintext device ID from being exposed during message transmission, thereby further improving the security of the authentication process.

[0115] The key to the quantum security terminal's ability to correctly encrypt files depends on the second key expansion parameters from the key distribution server. Therefore, only legitimate devices that have passed identity authentication, with the correct first key expansion parameters, second key expansion parameters, key expansion algorithm, and key selection method, can correctly encrypt files. And because only the first key expansion parameters are retained in the quantum security terminal, even if they are leaked, it is difficult for outsiders to obtain the complete encryption and decryption keys, thus improving overall security.

[0116] 111. The key distribution server sends a root key response message to the key relay terminal;

[0117] 112. The key relay receives the root key response message. If the root key response message indicates success, the key relay downloads the corresponding root key file from the key distribution server based on the file location information in the root key response message. After successfully performing a hash check on the downloaded root key file, the key relay sends an access completion message to the quantum security terminal to indicate successful access. If all hash checks of the downloaded root key files fail, the key relay sends an access completion message to the quantum security terminal to indicate access failure.

[0118] During verification, hash verification can be performed on each root key plaintext file based on the hash value A carried in each root key plaintext file until all root key plaintext files are verified, and the root key plaintext files that have successfully been verified are recorded.

[0119] The hash value A used to further verify the correctness of each root key plaintext file obtained after decryption is generated by the key distribution server and the key distribution terminal when the key file is pre-injected into the quantum security device. The key plaintext files are carried in the root key plaintext file and encrypted together, ensuring its security and making it difficult to be tampered with. The correctness of each root key plaintext file obtained after decryption is guaranteed by further verifying the hash value A.

[0120] If the root key response message indicates a failure, a message indicating an access failure is sent to the quantum security terminal.

[0121] In this embodiment, when a key request message is sent, the device ID and the target key identifier in the message are encrypted to form encrypted information. After receiving the key request message, the key distribution end first obtains the decryption key according to the index, then decrypts the encrypted content in the key request message, and further authenticates the device ID obtained by decryption before returning the corresponding root key response message. Since the information is encrypted throughout the entire communication process and the encrypted keys are all in the hands of the communicators, the security of the communication is greatly improved. The root key file request processing system of the present application mainly includes a terminal, a key relay terminal and a key distribution server. The information in the key request message is generated by terminal encryption, and the key relay terminal does not store the key used to encrypt the key request message, which reduces the possibility of key leakage and is more conducive to improving its security.

[0122] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for processing a root key file request, characterized in that: The method comprises: Receiving a key request message from a key relay terminal, the key request message including a key file index, first encrypted information, and second encrypted information, wherein the encrypted content of the first encrypted information includes a device ID, and the encrypted content of the second encrypted information includes a target key identifier; matching the root key generation record according to the key file index in the key request message and the first encrypted information; when the root key generation record matches successfully, obtaining a decryption key according to the root key generation record to decrypt the first encrypted information and the second encrypted information to obtain the device ID and the target key identifier; if the decrypted device ID matches the information in the root key generation record, generating a root key response message indicating a successful request, and carrying file location information of the root key file corresponding to the target key identifier in the root key response message; otherwise, sending a root key response message indicating a failed request to the key relay terminal; When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal.

2. The method for processing a root key file request according to claim 1, wherein: The method for the key relay terminal to generate a key request message includes: An access command message is received from a terminal, and the key request message is generated according to the key file index, the first encryption information, and the second encryption information in the access command message.

3. The method for processing a root key file request according to claim 1, wherein: The encryption method of the first encrypted information and the second encrypted information includes: Receiving a first key extension parameter from a key distribution terminal, and obtaining a second key extension parameter according to preset parameter data; concatenating the first key extension parameter and the second key extension parameter to obtain an initial key, and then expanding the initial key to form an expanded key according to a preset key expansion algorithm; The extended key is split into two encryption keys according to a preset rule; one of the two encryption keys is selected to encrypt the device ID to obtain a first encrypted message, and the other of the two encryption keys is used to encrypt the target key identifier to obtain a second encrypted message.

4. The method for processing a root key file request according to claim 3, wherein: The length of the extended key is consistent with the total length of the device ID and the target key identifier.

5. The method for processing a root key file request according to claim 4, wherein: The method for selecting the encryption key of the device ID and the target key identifier includes: Obtaining attribute information of a root key to be downloaded, obtaining a group random number based on the attribute information, and determining the parity of the group random number; If the group random number is an odd number, the first key is selected to encrypt the device ID and the second key is selected to encrypt the target key identifier; otherwise, the second key is selected to encrypt the device ID and the first key is selected to encrypt the target key identifier.

6. The method for processing a root key file request according to claim 5, wherein: The method for decrypting the first encrypted information and the second encrypted information includes: Obtaining a group random number from the root key generation record, and determining the parity of the group random number; If the group random number is an odd number, the first encrypted information is decrypted using the first key, and the second encrypted information is decrypted using the second key; otherwise, the first encrypted information is decrypted using the second key, and the second encrypted information is decrypted using the first key.

7. The method for processing a root key file request according to claim 2, wherein: The method for generating the target key identifier includes: The terminal performs a hash check on the root key file. If the check succeeds, the terminal generates an index corresponding to the successfully checked root key file and uses the index as the target key identifier.

8. A root key file request processing system, characterized in that: The system comprises: The terminal is configured to perform a hash check on the pre-injected root key file, generate a target key identifier corresponding to the root key file after the check passes, obtain a device ID and a key file index based on preset parameter data, and generate an access command message; wherein the access command message includes the key file index, first encrypted information, and second encrypted information, the encrypted content of the first encrypted information including the device ID, and the encrypted content of the second encrypted information including the target key identifier; a key relay terminal, configured to receive an access command message from a terminal, generate a root key request message according to the access command message, send the root key request message to a key distribution server, and download a root key file from the key distribution server according to a root key response message from the key distribution server; A key distribution server is configured to receive a root key request message and match a root key generation record based on a key file index in the key request message and the first encrypted information; when the root key generation record matches, obtain a decryption key based on the key generation record to decrypt the first encrypted information and the second encrypted information to obtain a device ID and a target key identifier; if the decrypted device ID matches the information in the root key generation record, generate a root key response message indicating a successful request, and carry file location information of a root key file corresponding to the target key identifier in the root key response message; otherwise, send a root key response message to the key relay terminal indicating a failed request; When the root key generation record fails to match, a root key response failure message is sent to the key relay terminal.

9. The root key file request processing system according to claim 8, characterized in that: The key distribution server includes an encryption and decryption module, which is used to decrypt the encrypted content in the root key request message.

10. The root key file request processing system according to claim 9, characterized in that: The encryption and decryption module is also used to splice the first key extension parameter and the second key extension parameter to form an initial random number, then expand the initial key to form an extended key according to a preset key expansion algorithm, and split the first key in the extended key into a first key and a second key according to a preset rule.

11. The root key file request processing system according to claim 9, characterized in that: The key distribution server further includes a query module, which is used to search and determine the root key generation record according to the key file index and the encrypted device ID.

Images