Method and system for encrypted messaging

Abstract

A method and system for encrypted messaging is provided, wherein the system comprises a first client device (10), a second client device (11) and a quantum key device (12) comprising a quantum random number generator (12d). The method comprises: generating, by the quantum random number generator (12d), a first quantum random signal; generating a first master key that is symmetric from the first quantum random signal; generating a first encrypted package that encrypts a first pairing key of a plurality of pairing keys that are symmetric and assigned to the first client device (10) and the second client device (11); generating a second encrypted package that encrypts the first pairing key; decrypting the first encrypted package to provide the first pairing key in the first client device (10) and decrypting the second encrypted package to provide the first pairing key in the second client device (11); and establishing a first encrypted connection between the first client device (10) and the second client device (11).

Description

Technical Field

[0001] This disclosure relates to a method and system for encrypted message transmission. Background Technology

[0002] Current methods for secure communication between different data processing devices typically utilize asymmetric encryption keys. These methods are generally not resistant to attacks using quantum computing resources (quantum hacking). There is a need for methods that also allow for secure communication in light of potential quantum-based attacks. Summary of the Invention

[0003] The purpose of this disclosure is to provide a method and system with improved technology for securely transmitting messages between data processing devices.

[0004] To address this problem, a method and system for transmitting encrypted messages according to the independent claims are provided.

[0005] According to one aspect, a method for transmitting encrypted messages in a system is provided, the system including a first client device, a second client device, and a quantum key device including a quantum random number generator. The method includes generating a first quantum random signal by the quantum random number generator; generating a symmetric first master key by the quantum key device based on the first quantum random signal; transmitting the first master key to the first client device and storing the first master key in an encrypted first client container in the first client device; generating a first encrypted packet by the quantum key device using the first master key to encrypt a first pairing key from a plurality of symmetric pairing keys assigned to the first client device and the second client device; generating a second encrypted packet by the quantum key device using a second master key to encrypt the first pairing key, and transmitting the first encrypted packet to the first client device and the second encrypted packet to the second client device; providing the first pairing key in the first client device by decrypting the first encrypted packet using the first master key, and providing the first pairing key in the second client device by decrypting the second encrypted packet using the second master key; and establishing a first encrypted connection between the first client device and the second client device using the first pairing key.

[0006] According to another aspect, a system for encrypted message transmission is provided, the system comprising a first client device, a second client device, and a quantum key device having a quantum random number generator, and configured to perform the following operations: generating a first quantum random signal by the quantum random number generator; generating a symmetric first master key by the quantum key device based on the first quantum random signal; transmitting the first master key to the first client device and storing the first master key in an encrypted first client container in the first client device; generating a first encrypted packet by the quantum key device using the first master key to encrypt a first pairing key from a plurality of pairing keys assigned to the first client device and the second client device; generating a second encrypted packet by the quantum key device using a second master key to encrypt the first pairing key, and transmitting the first encrypted packet to the first client device and the second encrypted packet to the second client device; providing the first pairing key in the first client device by decrypting the first encrypted packet using the first master key, and providing the first pairing key in the second client device by decrypting the second encrypted packet using the second master key; and establishing a first encrypted connection between the first client device and the second client device using the first pairing key.

[0007] Using the provided method and system, the improved randomness of quantum random number generators can be leveraged to generate symmetric master keys and symmetric pairing keys for encrypted communication between data processing devices. Quantum random number generators can provide a degree of "real" randomness, particularly distinguishing themselves from the outputs of classical random number generators (especially pseudo-random number generators). Such keys may be significantly more resistant to attacks based on randomness flaws. The method and system further allow for the efficient storage, distribution, and control of these quantum-generated symmetric keys. Therefore, encrypted message transmission between data processing devices can be provided in an improved manner.

[0008] Establishing the first encrypted connection may include generating a first encrypted message using the first pairing key in one of the first client device and the second client device, and transmitting the first encrypted message to the other of the first client device and the second client device. It may be further provided that no master key (neither the first master key nor the second master key) can be used to establish the first encrypted connection. It may be provided that the first master key and the master key can only be used for encrypted communication between the first client device and the quantum key device or between the second client device and the quantum key device.

[0009] Establishing the first encrypted connection may include authenticating the first client device and / or the second client device using the first pairing key.

[0010] Authenticating the first client device may include at least one of the following: generating a first authentication code in the first client device using the first pairing key based on a first authentication message; transmitting a second message and the first authentication code from the first client device to the second client device; generating a second authentication code in the second client device using the first pairing key based on the second message; and comparing the first authentication code with the second authentication code in the second client device.

[0011] Authenticating the first client device may further include determining the first client device as authenticated in the second client device if the first authentication code and the second authentication code are consistent.

[0012] Authenticating the second client device may include at least one of the following: generating a third authentication code in the second client device using the first pairing key based on a second authentication message; transmitting the second authentication message and the third authentication code from the second client device to the first client device; generating a fourth authentication code in the first client device using the first pairing key based on the second authentication message; and comparing the third authentication code with the fourth authentication code in the first client device.

[0013] Authenticating the second client device may further include determining the second client device as authenticated in the first client device if the third and fourth authentication codes match. Authenticating the first and / or second client devices may allow for non-denial of the source of exchanged messages.

[0014] At least one (preferably each) of the first authentication code, the second authentication code, the third authentication code, and the fourth authentication code can be generated using a cryptographic hash function. The cryptographic hash function can be, for example, one of MD5, SHA-1, SHA-2, SHA-3, and RIPEMD, or any other suitable cryptographic hash function.

[0015] Generating the first authentication code and generating the second authentication code may each include the message hash of generating the first authentication message and / or the pairing key hash of generating the first pairing key.

[0016] At least one (preferably each) of the first authentication code, the second authentication code, the third authentication code, and the fourth authentication code may also be generated using a block cipher algorithm, such as one of OMAC (one-key message authentication code) and CCM (counterwith cipher block chaining message authentication code).

[0017] At least one (preferably each) of the first authentication code, the second authentication code, the third authentication code, and the fourth authentication code can be generated using a message authentication code algorithm (e.g., Poly1305). Using a symmetric key for generating the message authentication code may result in a speed improvement compared to asymmetric encryption (e.g., for PKCS).

[0018] The method may further include, preferably, removing the first pairing key from the first client device and / or the second client device in response to terminating the first encrypted connection. The method may also include, preferably, removing the first pairing key from the quantum key device in response to transmitting the first encrypted packet to the first client device and the second encrypted packet to the second client device.

[0019] The method may include at least one of the following: generating a second quantum random signal by the quantum random number generator; generating a second master key by the quantum key device based on the second quantum random signal; and transmitting the second master key to the second client device and storing the second master key in the second client device, preferably in an encrypted second client container in the second client device.

[0020] The method may further include decrypting the encrypted first client container by the first client device, preferably in response to verifying a first client container password. The method may further include decrypting the second client container by the second client device, preferably in response to verifying a second client container password. The first client container password and / or the second client container password may have been supplied to the first client device by a user. The first client container password and / or the second client container password may also be stored on separate memory pages of the first / second client device's memory.

[0021] The method may include storing the first master key in the quantum key device and / or storing the second master key in the quantum key device. Storing the first master key in the quantum key device may include storing the first master key and / or the second master key in an encrypted key device container within the quantum key device.

[0022] The method may include storing the first pairing key in at least one of the first client device, the second client device, and the quantum key device, particularly in at least one of the first client device container, the second client device container, and the key device container.

[0023] The first master key may be stored in the first client device container and / or the key device container in the form of a first master key portion preferably having a fixed bit size. The second master key may be stored in the second client device container and / or the key device container in the form of a second master key portion preferably having a fixed bit size. For example, each master key portion may include between 128 bits and 2048 bits, preferably 256 bits. The first / second master key may, for example, include four to eight (preferably six) first / second master key portions. In principle, the longer the key length used, the greater the resistance to potential quantum computer attacks.

[0024] The key device container can be encrypted and / or decrypted using a key device container password. The first client container can be encrypted and / or decrypted using a first client device container password. The second client container can be encrypted and / or decrypted using a second client device container password.

[0025] The first / second encryption packet can be generated using only a first / second transmission subset of the first / second master key portion, the subset comprising four of the first / second master key portions.

[0026] The method may include authenticating the quantum key device to the first client device using the first master key and / or authenticating the quantum key device to the second client device using the second master key, preferably using a first authentication subset of the first master key portion and a second authentication subset of the second master key portion, respectively. The first / second authentication subset may, for example, include two of the first / second master key portions. The first delivery subset and the first authentication subset may be disjoint. The second delivery subset and the second authentication subset may be disjoint. Therefore, individual portions of the master key can be used for individual method steps, such as key delivery and authentication, thus increasing security. Authenticating the quantum key device may include using a key device (message) authentication code generated using the first and / or second authentication subsets.

[0027] At least one of the first client container, the second client container, and the key device container can be encrypted via AES, particularly via AES-AEAD-256. At least one of the first master key, the second master key, and the plurality of paired keys can be obtained, for example, via pbkdf2 from the corresponding one of the key device container password, the first client device container password, and the second client device container password.

[0028] The quantum random number generator can be configured to continuously provide quantum random signals, thus continuously providing random numbers (e.g., as a continuous bit string). The quantum random number generator can be controlled to start / stop, for example, by the quantum key distribution device providing quantum random signals.

[0029] The first encrypted packet and / or the second encrypted packet can be encrypted using at least one block cipher operation mode. The at least one block cipher operation mode can be one of Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Authentication Encryption with Additional Data (AEAD).

[0030] Using ECB can, for example, include using a 256-bit master key for each 256-bit session / pairing key. Using CBC can include using a 256-bit master key for each 256-bit session / pairing key. 40 The session / pairing key uses a 256-bit master key. Using CFB can include each 2 30 The session / pairing key uses a 256-bit master key. Using OFB can include each 2-bit session / pairing key... 40 A single master key is used for each 2-bit session / pairing key. Using AEAD can include each 2-bit session / pairing key. 40 The session / pairing key uses a 256-bit master key.

[0031] Generating the first encrypted packet may include encrypting the first paired key using the first master key and / or a hash of a first key string indicating the first master key (in particular, the first master key filename). Generating the second encrypted packet may include encrypting the first paired key using the second master key and / or a hash of a second key string indicating the second master key (in particular, the second master key filename).

[0032] The method may further include generating a random or pseudo-random first client string by the first client device and transmitting the first client string to the quantum key device, and preferably, generating the first master key in response to receiving the first client string in the quantum key device. More preferably, storing the first master key in the quantum key device may include assigning the first master key to the first client device, and in particular, assigning it to the first client string.

[0033] The method may further include generating a random or pseudo-random second client string by the second client device and transmitting the second client string to the quantum key device, and preferably, generating the first master key in response to receiving the first client string in the quantum key device. More preferably, storing the second master key in the quantum key device may include assigning the second master key to the second client string.

[0034] The first client string and / or the second client string may, for example, include a randomly generated integer, which is assigned to one of the first client device and the second client device (user number).

[0035] The first master key can be transmitted to the first client device via a secure first channel between the first client device and the quantum key device.

[0036] Furthermore, the second master key can be transmitted to the second client device via a secure second channel between the second client device and the quantum key device. Subsequently, master keys (especially those subsequent master keys that replace the first or second master key) can also be transmitted to the first client device via the secure first channel or to the second client device via the secure second channel.

[0037] Specifically, the first / second master key can be transmitted to the first / second client device via a first / second local network connection between the first / second client device and the quantum key device. Preferably, the first master key can be transmitted to the first client device via a first local wired connection (e.g., including cables and / or optical fibers) between the first client device and the quantum key device. Further, the second master key can be transmitted to the second client device via a second local wired connection between the first client device and the quantum key device. Therefore, the security of master key transmission may be increased.

[0038] It is possible to transmit keys other than the master key via a non-local network connection (such as the Internet) instead of the first / second local connection. For example, the pairing key can be transmitted from the quantum key device to the client device via a non-local network connection. Security is provided here by encrypting the pairing key using the master key. Simultaneously, the efficiency of key distribution can be improved by avoiding the use of a local network connection. Communication between the client devices can also be conducted via a non-local network connection.

[0039] The method may further include at least one of the following: generating a third quantum random signal by the quantum random number generator; generating a first pairing key and / or a second pairing key and / or the plurality of additional pairing keys from the plurality of pairing keys by the quantum key device based on the third quantum random signal; assigning each additional pairing key from the first pairing key and / or the second pairing key and / or the plurality of additional pairing keys to the first client device and the second client device by the quantum key device; and storing the first pairing key and / or the second pairing key and / or the plurality of additional pairing keys in the quantum key device.

[0040] The first pairing key, the second pairing key, and at least one of the plurality of other pairing keys can be stored in the (encrypted) key device container.

[0041] The method may include storing the second pairing key in at least one of the first client device and the second client device, particularly in at least one of the first client device container and the second client device container. Providing multiple readily available master keys and / or pairing keys can improve encryption speed, especially with regard to, for example, PKCS#12 or PKCS#15.

[0042] At least one or each of the plurality of paired keys and / or additional paired keys can be assigned to the master key. For example, the first paired key can be assigned to the first master key and / or the second master key.

[0043] Assigning each of the plurality of additional pairing keys to the first client device and the second client device may include storing pairing key information indicating the plurality of additional pairing keys, the first client device, and the second client device in the quantum key device. The plurality of additional pairing keys may therefore be a subset of the plurality of pairing keys assigned to the first client device and the second client device. In other words, the plurality of pairing keys may include the plurality of additional pairing keys.

[0044] The second pairing key and / or the plurality of additional pairing keys may be generated and / or assigned to the first client device and the second client device until a maximum number of additional pairing keys are reached.

[0045] The method may further include the quantum key device encrypting the second pairing key and / or the plurality of other pairing keys using the first master key to generate a third encrypted packet, and transmitting the third encrypted packet to the first client device. The method may further include the quantum key device encrypting the second pairing key and / or the plurality of other pairing keys using the second master key to generate a fourth encrypted packet, and transmitting the fourth encrypted packet to the second client device.

[0046] The system may further include a first server. Preferably, transmitting the first encrypted packet to the first client device may include transmitting the first encrypted packet from the quantum key device to the first server and from the first server to the first client device. Alternatively, transmitting the second encrypted packet to the second client device may include transmitting the second encrypted packet from the quantum key device to the first server and from the first server to the second client device. Alternatively, the first master key may be stored in the first server, particularly in an encrypted first server container. Transmitting the first client string to the quantum key device may include transmitting the first client string from the first client device to the first server and from the first server to the quantum key device.

[0047] Therefore, the first server can act as a distribution center and / or control device between the client device and the quantum key device.

[0048] The first server can use a first server key for encryption. The second master key can also be stored in the first server, particularly in a container within the first server. At least one of the plurality of pairing keys (particularly the first pairing key) can be stored in the first server container. The first / second master key can be transmitted to the first server, for example, via a physical connection between the first server and the quantum key device (e.g., a third wired connection including cables and / or optical fibers), particularly when the quantum key device is part of the first server.

[0049] The method may include authenticating the first server to the first client device using the first master key and / or authenticating the first server to the second client device using the second master key, preferably using a first authentication subset of the first master key portion and a second authentication subset of the second master key portion, respectively. Authenticating the first server may include using a first server (message) authentication code generated using the first and / or second authentication subsets.

[0050] Transmitting the first client string to the quantum key device may include transmitting the first client string to the first server and transmitting the first client string from the server to the quantum key device.

[0051] Furthermore, transmitting the second client string to the quantum key device may include transmitting the second client string to the first server and / or transmitting the second client string from the server to the quantum key device.

[0052] The quantum key distribution device may be separate from the first server. Alternatively, the first server may include the quantum key distribution device. In this case, the transfer between the first server and the quantum key distribution device may include the transfer between the first server's memory and the quantum key distribution device (memory).

[0053] Alternatively, the first client string can be transmitted directly from the first client device to the quantum key device. Furthermore, the second client string can be transmitted directly from the second client device to the quantum key device. The first encrypted packet can be transmitted directly from the quantum key device to the first client device. Additionally, the second encrypted packet can be transmitted directly from the quantum key device to the second client device.

[0054] A server-client pairing key can be generated and / or provided and / or used for encrypted message transmission between the first client device and the server or between the second client device and the server, wherein the server-client pairing key corresponds to the first pairing key.

[0055] The first server may be or may include at least one of a security server, a transport server, a transport router, a message archive server, and a key distribution server.

[0056] The first server (memory) may include a routing table indicating the system's data processing devices, particularly indicating the first client device, the second client device, and the quantum key device.

[0057] The first master key filename and / or the second master key filename can be provided according to the NM principle, where N can be the first server name, and M can be the first client string / second client string and / or a random client number. This naming convention can be used to assign master keys to corresponding data processing devices. Pair key names can be provided in the form 2M-K, where M can be one of the first client string and the second client string, and K can be the other of the first client string and the second client string. The factor of 2 indicates that the pair key corresponds to paired communication.

[0058] At least one of the first client container, the second client container, the key device container, and the first server container may include a key table (key data array). For example, the first client container may include a first client key table, the second client container may include a second client key table, the key device container may include a key device key table, and the first server container may include a first server container key table.

[0059] The first pairing key, the second pairing key, the plurality of additional pairing keys, and the server-client pairing key can be stored in a key table, preferably in one of the plurality of key table units. At least one of the first key string, the second key string, the first client string, and the first server string indicating the first server can be stored in the key table, particularly in one of the plurality of key table units. For example, the first / second master key can be stored in a first / second client container outside the first / second client key table.

[0060] The key table may include multiple sub-tables, each of which may preferably be assigned to one of the system's data processing devices. Each sub-table may be, for example, at least one of a key table row, a key table column, and a set of key table units. At least one, preferably each, sub-table may be encrypted individually using a different sub-table key from among the multiple sub-table keys. At least one, preferably each, sub-table may include different sub-table variables. Each sub-table variable may be generated by a quantum random number generator. Each sub-table variable may include a length between 64 bits and 2048 bits (preferably 512 bits).

[0061] At least one of the sub-table keys, preferably each sub-table key, can be generated using a corresponding master key and a sub-table variable, preferably using a hash of the least significant bit (or most significant bit) of the corresponding master key and the corresponding sub-table variable. For example, a first sub-table assigned to a first client device can be generated using a first master key and a first sub-table variable, preferably using a hash of the first least significant bit of the first master key and the first sub-table variable.

[0062] The key table can be further encrypted using a first master key or a second master key (e.g., using AEAD), preferably if the key table has already been determined by a data processing device in which the user is not active.

[0063] The key table can be configured such that at least one of the first pairing key, the second pairing key, the plurality of additional pairing keys, and the server-client pairing key can be asynchronously readable and writable. The first client container and / or the second client container can be configured such that the master key is asynchronously readable and writable. Asynchronous reads and writes can correspond to a mismatch between the key generation rate and the key usage rate. Asynchronous reads and writes can correspond to containers and / or key tables that are divided into separately encrypted data ranges. Since each data range can be open only for reading or writing, switching to a new encryption key (e.g., when the old key's usage limit is reached) can allow for a transparent and delay-free switch to the new key. Therefore, several sets of keys can be stored simultaneously for communication between the client device and the server.

[0064] It can provide: a first master key and a master key used only for encrypted communication between the first client device and the first server, between the second client device and the first server, and / or between the quantum key device and the first server.

[0065] The method may further include at least one of the following: transmitting a pairing query message instructing the second client device from the first client device to the first server; in response to determining that at least one of the plurality of pairing keys is assigned to the first client device and the second client device and is stored in the first server, transmitting the at least one of the plurality of pairing keys from the first server to the first client device; in response to determining that none of the plurality of pairing keys is assigned to the first client device and the second client device and is stored in the first server, transmitting a pairing key server request message from the first server to the quantum key device; and in response to receiving the pairing key server request message in the quantum key device, transmitting at least one of the plurality of pairing keys from the quantum key device to the first server and transmitting the at least one of the plurality of pairing keys from the first server to the first client device.

[0066] Correspondingly, a second pairing query message instructing the first client device can be transmitted from the second client device to the first server, and a pairing key can be transmitted to the second client device.

[0067] The at least one of the plurality of pairing keys may include the first pairing key and / or the second pairing key.

[0068] Transmitting at least one of the plurality of pairing keys from the quantum key device to the first server and / or from the first server to the first client device may include transmitting at least one of the plurality of pairing keys in the form of an encrypted packet.

[0069] The method may further include removing at least one of the plurality of pairing keys from the first server in response to transmitting at least one of the pairing keys from the first server to the first client device.

[0070] The method may further include generating the third quantum random signal by the quantum random number generator in response to receiving the pairing key request message in the quantum key device.

[0071] At least one or each of the plurality of pairing keys may be a session key and / or a chat key.

[0072] A pairing query message may be transmitted from the first client device to the first server in response to contact information provided in the first client device (preferably, indicating contact information of the second client device).

[0073] The method may include: in response to determining that a first pairing key less than a first pairing key threshold is stored in a first client device, transmitting a first pairing key request message from the first client device to a quantum key device; and / or in response to determining that a second pairing key less than a second pairing key threshold is stored in a second client device, transmitting a second pairing key request message from the second client device to a quantum key device.

[0074] In response to receiving the first / second pairing key request message in the quantum key device, at least one additional pairing key can be transmitted from the quantum key device to the first and / or second client device in the form of an additional encrypted packet. The threshold for the first and / or second pairing key can be, for example, between 2 and 10, preferably 5.

[0075] The method may include at least one of the following: providing a second pairing key among the plurality of pairing keys in the first client device by decrypting a first or third encrypted packet transmitted from the quantum key device to the first client device using the first master key; providing the second pairing key in the second client device by decrypting a second or fourth encrypted packet transmitted from the quantum key device to the second client device using the second master key; establishing a second encrypted connection between the first client device and the second client device using the second pairing key; providing first pairing data in the first client device and / or the quantum key device, the first pairing data indicating a first number of used pairing keys and the first master key; and providing second pairing data in the second client device and / or the quantum key device, the second pairing data indicating a second number of used pairing keys and the second master key.

[0076] The first number of paired keys used indicates the paired keys used for decryption with the first master key. The second number of paired keys used indicates the paired keys used for decryption with the second master key. Therefore, the number of paired keys for each master key can be tracked.

[0077] Providing the first and / or second pairing data may respectively include generating the first and / or second number of pairing keys used or modifying the first and / or second number of pairing keys used, particularly increasing the first and / or second number of pairing keys used, preferably by one. The first and / or second number of pairing keys used may be integer values. The first and / or second number of pairing keys used may have an initial value of zero.

[0078] Alternatively or concurrently, the pairing data may be provided in the first server. The second pairing key may be assigned to the first master key and / or the second master key.

[0079] The method may further include at least one of the following: encrypting the first pairing key using a first encryption key and encrypting the second pairing key using a second encryption key different from the first encryption key in the first client device and / or the second client device; and storing the encrypted first pairing key and the second pairing key in the first client device and / or the second client device.

[0080] Specifically, at least two of the first master key, the second master key, the first pairing key, the second pairing key, the additional pairing key, and the server-client pairing key can be encrypted using pairs of different encryption keys, and preferably, can be stored in at least one of the first client device, the second client device, the first server, and the quantum key device. For example, each of the first pairing key, the second pairing key, and the additional pairing key can be encrypted using pairs of different encryption keys and stored in the first client device.

[0081] The first and second pairing keys can be stored in a key table. The first encryption key can be generated using a first master key and a first sub-table variable, preferably using a hash of the first least significant bit of the first master key and the first sub-table variable. For example, the second encryption key can be generated using the first master key and the second sub-table variable, preferably using a hash of the second least significant bit of the first master key and the second sub-table variable. In particular, different encryption keys can be sub-table keys.

[0082] The method may further include at least one of the following: generating a fourth quantum random signal by the quantum random number generator; generating a symmetric third master key by the quantum key device based on the fourth quantum random signal and storing the third master key in the quantum key device; transmitting the third master key to the first client device and storing the third master key in the first client device; and removing the first master key from the quantum key device and / or the first client device.

[0083] The method may further include at least one of the following: generating a fifth quantum random signal by the quantum random number generator; generating a symmetric fourth master key by the quantum key device based on the fifth quantum random signal and storing the fourth master key in the quantum key device; transmitting the fourth master key to the second client device and storing the fourth master key in the second client device; and removing the second master key from the quantum key device and / or the second client device.

[0084] The third master key may be transmitted to the first client device in response to the quantum key device and / or the first client device determining that a first number of paired keys used exceeds a first threshold. The fourth master key may be transmitted to the second client device in response to the quantum key device and / or the second client device determining that a second number of paired keys used exceeds a second threshold.

[0085] The first master key may be removed from the quantum key device and / or the first client device in response to the quantum key device and / or the first client device determining that a first number of paired keys used exceeds a first threshold. Further, the second master key may be removed from the quantum key device and / or the second client device in response to the quantum key device and / or the second client device determining that a second number of paired keys used exceeds a second threshold.

[0086] Removing the key can include zeroing each bit at the corresponding memory location and doubling the random sequence.

[0087] The first threshold and the second threshold can be the same. The first threshold and / or the second threshold can be between 1,000 and 100,000, preferably between 10,000 and 60,000, and more preferably 50,000. Thus, for example, a new master key can be used for every 50,000 encrypted connections / pairing keys.

[0088] The third and / or fourth master keys can be tested by transmitting a test message from the first / second client device to the first server and / or quantum key distribution device. The test message can be, for example, 128 bits long. The test message can include bit strings, such as: 1010 0101 1111 0000 1100 0011 1010 0101 1111 0000 10100101 11110000 1010 0101 1111 0000 1010 0101 1111 0000 1010 0101 1111 0000 1100 0011 1010 01011111 0000 1010 01011111 0000. In principle, any string known to both the first and second client devices can be used. The test message can be encrypted using the third / fourth master key.

[0089] The method may include providing third pairing data in a first client device and / or quantum key device, indicating a third number of used pairing keys and a third master key, and providing fourth pairing data in a second client device and / or quantum key device, indicating a fourth number of used pairing keys and a fourth master key.

[0090] At least one of the following: a first master key, a second master key, a third master key, a fourth master key, a first pairing key, a second pairing key, an additional pairing key, and a server-client pairing key; preferably each of these, may be stored using a corresponding mask (e.g., stored in random access memory). Each mask may be a randomly generated number (e.g., a sequence of bits), preferably stored in a separate memory page (in an encryption container). Each mask may be randomly generated, for example, by a quantum key distribution device. Storing at least one or each of the keys using a corresponding mask may include applying an XOR operation to the key and the mask (its binary representation) and storing the resulting (bit) string. Accessing / providing the key (e.g., for subsequent encryption using the key) may include applying an XOR operation to the resulting string and the mask, which in turn produces the key.

[0091] The method may include, for example, revoking at least one of a first master key, a second master key, a third master key, a fourth master key, a first pairing key, a second pairing key, an additional pairing key, and a server-client pairing key in response to determining that a key has been stolen. Revoking a key may include removing and / or replacing the key from all data processing devices in the system.

[0092] The first client device, the second client device, the first server, and the quantum key device can be connected to each other via cable and / or wireless means.

[0093] The embodiments described above in conjunction with the methods for encrypted message transmission can be provided accordingly for systems used for encrypted message transmission. The embodiments described herein with respect to the first entity (such as a first client device or a first pairing key) can be provided for corresponding second and / or third and / or fourth entities. As understood herein, storage in the data processing device may include storage in the memory of the data processing device. Attached Figure Description

[0094] In the following description, embodiments are illustrated by way of example and with reference to the accompanying drawings, in which:

[0095] Figure 1 A graphical representation of a system including multiple data processing devices is shown; and

[0096] Figure 2 A graphical representation of a method for encrypting message transmission is shown. Detailed Implementation

[0097] Figure 1 A graphical representation of a system including multiple data processing devices 10, 11, 12, and 13, namely multiple client devices 10 and 11 (including a first client device 10 and a second client device 11), a quantum key distribution device 12, and a first server 13, is shown. A second server and additional client devices, such as a third client device and a fourth client device (not shown), may be provided.

[0098] The first client device 10 includes a first client device memory 10a, a first client device processor 10b, and a first client device transceiver unit 10c. The second client device 11 includes a second client device memory 11a, a second client device processor 11b, and a second client device transceiver unit 11c.

[0099] The quantum key distribution device 12 includes a key device memory 12a, a key device processor 12b, a key device communication interface 12c (e.g., a key device transceiver), and a quantum random number generator 12d. The first server 13 includes a first server memory 13a, a first server processor 13b, and a first server transceiver unit 13c. The first server 13 may also include the quantum key distribution device 12.

[0100] Data processing devices 10 to 13 are configured to exchange signals via corresponding communication channels 10d, 10e, 11d, 11e, 12e, and 14, specifically the first channel 10d between the first client device 10 and the quantum key device 12, the second channel 11d between the second client device 11 and the quantum key device 12, the third channel 10e between the first client device 10 and the first server 13, the fourth channel 11d between the second client device 11 and the first server 13, the fifth channel 12e between the quantum key device 12 and the first server 13, and the sixth channel 14 between the first client device 10 and the second client device 11. Communication channels 10d, 10e, 11d, 11e, 12e, and 14 may each include a wireless channel. Alternatively or additionally, communication channels 10d, 10e, 11d, 11e, 12e, and 14 may include physical connections such as electrical connections and / or wired connections (e.g., cables and / or optical fibers). Each of communication channels 10d, 10e, 11d, 11e, 12e, and 14 may include, for example, an Internet connection and / or a WiFi connection and / or a Bluetooth connection. Communication channels 10d, 10e, 11d, 11e, 12e, and 14 (particularly communication channels connected to the quantum key distribution device 12, such as the first channel 10d, the second channel 11d, and / or the fifth channel 12e) may each include a local network connection, preferably a local wired connection. Communication between client devices 10 and 11 may occur directly using the sixth channel 14 and / or via the first server 13.

[0101] Furthermore, each of the data processing devices 10 to 13 may include a corresponding input device and / or output device (not shown).

[0102] Each of client devices 10, 11 and the first server 13 may be a single computing device. Alternatively, at least one of client devices 10, 11 and the first server 13 may not be limited to a single computing device, but may preferably include multiple sub-devices. Each client device 11, 12 may also be or may include user devices such as personal computers, tablet computers and / or mobile phones. Each client device 11, 12 may also represent another server, particularly a server for another client device.

[0103] Figure 2 A graphical representation of a method for encrypting message transmission is shown.

[0104] In the first step 21, the first client device 10 generates a random first client string (first user number) and transmits the first user number to the first server 13 in order to obtain a symmetric first master key.

[0105] In the second step 22, the first server 13 checks whether a previous connection with the first client device 10 has already been established. If the first server determines that the connection with the first client device 10 is the first connection, it requests the first master key from the quantum key device 12. To do this, the first server 13 transmits the first user number to the quantum key device 12.

[0106] In response (step 23), quantum key distribution device 12 assigns a first master key to first client device 10 (via a first user number), the first master key being generated based on a first quantum random signal already generated by quantum random number generator 12d. The first master key is then transmitted from quantum key distribution device 12 to first client device 10. At this point, first client device 10 should be very close to quantum key distribution device 12 (i.e., physically close), for example, by receiving the first master key via a local network without the presence of a cryptanalyst. Upon receipt, the first master key is stored in an encrypted first client container in first client device 10. A password must be entered before each opening / decryption of the first client container. The first master key is also stored in an encrypted first server container in first server 13. The first master key is now installed. A second master key is then installed accordingly for second client device 11.

[0107] In the fourth step 24, an address is provided in the first client device 10, a user connection table is generated based on the address, and the user connection table is transmitted to the first server 13 (corresponding to the pairing query message).

[0108] In step 25, the first server 13 determines whether a corresponding symmetric pairing key already exists for the user connection provided from the first client device 10. For example, if the provided user connection includes a connection to the second client device 11, the server 13 determines whether to assign the corresponding pairing key to both the first client device 10 and the second client device 11.

[0109] If so, the corresponding pairing key (first pairing key) is transmitted directly from the first server 13 to the first client device 10 in the form of a first encrypted packet encrypted with the first master key. The first pairing key is also transmitted from the first server 13 to the second client device 11 in the form of a second encrypted packet encrypted with the second master key. Otherwise, a request is made to generate the first pairing key in the quantum key device 12 and transmit the first pairing key to the first server 13 for further transmission to the first client device 10 and the second client device 11. The first pairing key is generated by the quantum random number generator 12d based on the corresponding quantum random signal or has been pre-generated and is stored in an encrypted key device container. Additional session keys and chat keys are similarly generated and provided in the client devices.

[0110] In step 26, a first encrypted connection is established between the first client device 10 and the second client device 11 using a first pairing key stored in the two client devices 10 and 11. Using the first pairing key, the first client device 10 and the second client device 11 can be further authenticated to each other, for example via a message authentication code. After the first encrypted connection is terminated, the first pairing key used is removed.

[0111] For the subsequent second encrypted connection between the first client device 10 and the second client device 11 (seventh step 27), a symmetric second pairing key must be generated and provided in both client devices 10 and 11. The second pairing key is again transmitted to the first client device 10 via encryption with the first master key and to the second client device 11 via encryption with the second master key.

[0112] For security reasons, the first / second master key should not be used to transmit more than a certain number of paired keys (e.g., 50,000). After that, the first / second master key should be replaced with a subsequent master key.

[0113] The features disclosed in this specification, drawings and / or claims may be materials used to implement various embodiments individually or in various combinations thereof.

Claims

1. A method for transmitting encrypted messages in a system, the system comprising a first client device (10), a second client device (11), and a quantum key device (12) including a quantum random number generator (12d). The method includes: - A first quantum random signal is generated by the quantum random number generator (12d); - A symmetric first master key is generated by the quantum key device (12) based on the first quantum random signal; - The first master key is transmitted to the first client device (10), and the first master key is stored in an encrypted first client container in the first client device (10); - The quantum key device (12) generates a first encrypted packet by encrypting the first pairing key among a plurality of pairing keys that are symmetric and assigned to the first client device (10) and the second client device (11) using the first master key; - A second quantum random signal is generated by the quantum random number generator (12d); - The quantum key device (12) generates a second master key based on the second quantum random signal; as well as - Transmit the second master key to the second client device (11); - The quantum key device (12) generates a second encrypted packet by encrypting the first pairing key with the second master key, and transmits the first encrypted packet to the first client device (10) and the second encrypted packet to the second client device (11). - The first pairing key is provided in the first client device (10) by decrypting the first encrypted packet using the first master key, and the first pairing key is provided in the second client device (11) by decrypting the second encrypted packet using the second master key; as well as - Use the first pairing key to establish a first encrypted connection between the first client device (10) and the second client device (11).

2. The method according to claim 1, wherein, Establishing the first encrypted connection includes: - Use the first pairing key to generate a first encrypted message in one of the first client device (10) and the second client device (11), and transmit the first encrypted message to the other of the first client device (10) and the second client device (11).

3. The method according to claim 1 or 2, wherein, Establishing the first encrypted connection includes authenticating the first client device (10) and / or the second client device (11) using the first pairing key.

4. The method according to claim 3, wherein, Authenticating the first client device (10) includes: - The first authentication code is generated in the first client device (10) using the first pairing key according to the first authentication message; - Transmit the second message and the first authentication code from the first client device (10) to the second client device (11); - In the second client device (11), the first pairing key is used to generate a second authentication code based on the first authentication message; and - The first authentication code is compared with the second authentication code in the second client device (11).

5. The method according to claim 1 or 2, further comprising: The second master key is stored in an encrypted second client container in the second client device (11).

6. The method according to claim 1 or 2, further comprising: - The first client device (10) generates a random or pseudo-random first client string and transmits the first client string to the quantum key device (12); as well as - The first master key is generated in response to receiving the first client string in the quantum key device (12). Storing the first master key in the quantum key device (12) includes assigning the first master key to the first client device (10).

7. The method according to claim 1 or 2, wherein, The first master key is transmitted to the first client device (10) via a secure first channel (10d) between the first client device (10) and the quantum key device (12).

8. The method according to claim 1 or 2, further comprising: - A third quantum random signal is generated by the quantum random number generator (12d); - The quantum key device (12) generates the first pairing key and / or multiple additional pairing keys based on the third quantum random signal; - The quantum key device (12) assigns the first pairing key and / or each of the plurality of additional pairing keys to the first client device (10) and the second client device (11); and - Store the first pairing key and / or the plurality of additional pairing keys in the quantum key device (12).

9. The method according to claim 8, wherein, The additional pairing keys are generated and / or assigned to the first client device (10) and the second client device (11) until a maximum number of additional pairing keys are reached.

10. The method according to claim 1 or 2, wherein, The system further includes a first server (13), wherein: - Transmitting the first encrypted packet to the first client device (10) includes transmitting the first encrypted packet from the quantum key device (12) to the first server (13) and transmitting the first encrypted packet from the first server (13) to the first client device (10). - Transmitting the second encrypted packet to the second client device (11) includes transmitting the second encrypted packet from the quantum key device (12) to the first server (13) and transmitting the second encrypted packet from the first server (13) to the second client device (11); and - Store the first master key in the first server (13).

11. The method of claim 10, further comprising: - Transmit a pairing query message instructing the second client device (11) from the first client device (10) to the first server (13). - In response to determining that at least one of the plurality of pairing keys is assigned to the first client device (10) and the second client device (11) and is stored in the first server (13), the at least one of the plurality of pairing keys is transmitted from the first server (13) to the first client device (10). - In response to determining that none of the plurality of pairing keys has been assigned to the first client device (10) and the second client device (11) and is stored in the first server (13), a pairing key server request message is transmitted from the first server (13) to the quantum key device (12). as well as - In response to receiving the pairing key server request message in the quantum key device (12), at least one of the plurality of pairing keys is transmitted from the quantum key device (12) to the first server (13) and the at least one of the plurality of pairing keys is transmitted from the first server (13) to the first client device (10).

12. The method according to claim 1 or 2, further comprising: - The second pairing key among the plurality of pairing keys is provided in the first client device (10) by decrypting the first or third encryption packet transmitted from the quantum key device (12) to the first client device (10) using the first master key; - The second pairing key is provided in the second client device (11) by decrypting the second or fourth encryption packet transmitted from the quantum key device (12) to the second client device (11) using the second master key; - Establish a second encrypted connection between the first client device (10) and the second client device (11) using the second pairing key; - Provide first pairing data in the first client device (10) and / or the quantum key device (12), the first pairing data indicating a first number of pairing keys used and the first master key; as well as - Provide second pairing data in the second client device (11) and / or the quantum key device (12), the second pairing data indicating a second number of pairing keys used and the second master key.

13. The method of claim 12, further comprising: - In the first client device (10) and / or the second client device (11), the first pairing key is encrypted using a first encryption key and the second pairing key is encrypted using a second encryption key different from the first encryption key; as well as - The first pairing key and the second pairing key, which will be encrypted, are stored in the first client device (10) and / or the second client device (11).

14. The method according to claim 1 or 2, further comprising: - A fourth quantum random signal is generated by the quantum random number generator (12d); - The quantum key device (12) generates a symmetric third master key based on the fourth quantum random signal and stores the third master key in the quantum key device (12); - Transmit the third master key to the first client device (10) and store the third master key in the first client device (10); as well as - Remove the first master key from the first client device (10) and / or the quantum key device (12).

15. A system for encrypted message transmission, the system comprising a first client device (10), a second client device (11), and a quantum key device (12) having a quantum random number generator (12d), the system being configured to perform the following operations: - A first quantum random signal is generated by the quantum random number generator (12d); - A symmetric first master key is generated by the quantum key device (12) based on the first quantum random signal; - Transmit the first master key to the first client device (10) and store the first master key in an encrypted first client container in the first client device (10); - The quantum key device (12) generates a first encrypted packet by encrypting the first pairing key among a plurality of pairing keys that are symmetric and assigned to the first client device (10) and the second client device (11) using the first master key; - A second quantum random signal is generated by the quantum random number generator (12d); - The quantum key device (12) generates a second master key based on the second quantum random signal; as well as - Transmit the second master key to the second client device (11); - The quantum key device (12) generates a second encrypted packet by encrypting the first pairing key with the second master key, and transmits the first encrypted packet to the first client device (10) and the second encrypted packet to the second client device (11). - The first pairing key is provided in the first client device (10) by decrypting the first encrypted packet using the first master key, and the first pairing key is provided in the second client device (11) by decrypting the second encrypted packet using the second master key; as well as - Use the first pairing key to establish a first encrypted connection between the first client device (10) and the second client device (11).

Images