A quantum security device data communication method

Abstract

The present invention discloses a data communication method for a quantum security device. The method includes a privacy module at a transmitting end transmitting generated user data to an encryption and decryption module at the transmitting end. The encryption and decryption module at the transmitting end obtains the transmitting end quantum IP address, transmitting end port number, receiving end quantum IP address, and receiving end port number corresponding to the user data based on the user data. The four data items, the transmitting end quantum IP address, transmitting end port number, receiving end quantum IP address, and receiving end port number, are hashed to obtain first to fourth hash values. The first to fourth hash values ​​are then XORed with each other to obtain a message hash value. In the data processing flow, the quantum security device of the present invention selects a sending thread based on a stream index, ensuring that the thread used for data sent from the transmitting end to the same application port of the receiving end is the same thread. This ensures that data sent from the transmitting end to the same application port of the receiving end will not be sent out of order after being encrypted by the quantum security device, thereby ensuring data sequentiality.

Description

Technical Field

[0001] The present invention relates to the field of quantum security technology, and in particular to a quantum security device data communication method. Background Art

[0002] Data security remains a key concern in current network data communications. Data security refers to protecting data from unauthorized access, damage, or theft throughout its entire lifecycle. This concept encompasses all aspects of information security, from the physical security of hardware and storage devices to management and access control, and even the logical security of software applications. A strong data security strategy not only protects an organization's information assets from cybercrime but also prevents insider threats and human error. Data security is crucial for a company's sound operations. Recent regulatory trends clearly demonstrate the government's emphasis on data security management. By enhancing the professional capabilities of security teams, we can gradually build a data security culture within the enterprise and help continuously increase the value of its data assets. Data security guarantees inherently place extremely high demands on data encryption algorithms, and the optimization and improvement of encryption algorithms, in turn, place certain requirements on computer computing power. With the advent of supercomputers and quantum computers, computing power has been greatly increased, making the development of quantum encryption technology inevitable. This advancement in quantum encryption technology will inevitably lead to the development of quantum secure communication systems.

[0003] Currently, Chinese patent publication number CN115001686A discloses a global quantum security device for quantum secure communication. In this invention, the global quantum security device acts as a terminal for data encryption and transmission, and decryption. Data is generated and quantum-encrypted by the quantum security device, and then transmitted via a communication module for data exchange.

[0004] The information interaction between quantum security devices is different from the information interaction between previous devices. How to ensure that the data sent by each quantum security device can find the information of the target quantum security device and then send the data to the target quantum security device through the network, and how to ensure that the data sent from the sender to the same application port of the receiver will not be sent out of order after being encrypted by the quantum security device are all urgent problems to be solved. Summary of the Invention

[0005] Purpose of the Invention: The purpose of the present invention is to provide a quantum security device data communication method, which solves the problem of how to enable the data sent by each quantum security device to find the target quantum security device information and then send the data to the target quantum security device via the network. It also solves the problem of how to ensure that the data sent from the sender to the same application port of the receiver is not sent out of order after being encrypted by the quantum security device.

[0006] Technical Solution: The present invention provides a quantum security device data communication method. The participants in the method include a first quantum security device as a transmitting end and a second quantum security device as a receiving end. The method includes the following steps:

[0007] (1) The privacy module of the sending end sends the generated user data to the encryption and decryption module of the sending end. The encryption and decryption module of the sending end obtains the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number corresponding to the user data according to the user data, performs hash calculation on the four data of the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number to obtain the first to fourth hash values, and then XORs the first to fourth hash values ​​with each other to obtain the message hash value;

[0008] (2) The encryption and decryption module of the sending end generates a flow index based on the message hash value and the number of local threads, and marks the thread corresponding to the flow index as the first sending thread of the user data; the encryption and decryption module of the sending end searches for the communication IP and unique identifier RID of the corresponding receiving end through the quantum IP of the receiving end, and then uses the quantum key to quantum encrypt the user data to obtain quantum ciphertext, and then forms a flow index message with the quantum ciphertext, the communication IP of the receiving end, the quantum key, the unique identifier RID of the receiving end and the flow index; the encryption and decryption module of the sending end sends the flow index message to the communication module of the sending end through the first sending thread of the user data;

[0009] (3) The communication module of the sending end parses the stream index message to obtain the quantum ciphertext, the receiving end communication IP, the quantum key, the receiving end's unique identifier RID and the stream index, and marks the corresponding thread as the second sending thread of the user data according to the stream index; then the communication module of the sending end establishes a connection with the communication module of the receiving end according to the receiving end communication IP, and then forms a TCP message with the quantum ciphertext, the receiving end communication IP and the local sending end communication IP, and sends the TCP message to the Internet through the second sending thread of the user data, and then sends the TCP message to the receiving end through the Internet; then, the communication module of the sending end forms a key message with the quantum key and the receiving end's unique identifier RID, and sends the key message to the quantum security base station through the second sending thread of the user data. The quantum security base station parses the quantum key and the receiving end's unique identifier RID, and the quantum security base station relays the quantum key to the receiving end according to the receiving end's unique identifier RID.

[0010] Furthermore, the specific process of the encryption and decryption module of the sending end searching the communication IP and unique identifier RID of the corresponding receiving end through the quantum IP of the receiving end is as follows:

[0011] First, the encryption and decryption module of the sender calls the routing relationship mapping table; then, the communication IP and unique identifier RID of the corresponding receiver are found in the routing relationship mapping table through the receiver's quantum IP;

[0012] Among them, the routing relationship mapping table contains the quantum IP, communication IP and unique identifier RID of each quantum security device, and the quantum IP, communication IP and unique identifier RID of each quantum security device are associated and matched to form a corresponding relationship.

[0013] Furthermore, the routing relationship mapping table is stored in the encryption and decryption module of the sending end, and the routing relationship mapping table is updated according to a preset time.

[0014] Furthermore, the specific process of performing hash calculation on the four data of the sending end quantum IP, the sending end port number, the receiving end quantum IP and the receiving end port number to obtain the first to fourth hash values ​​is as follows:

[0015] The encryption and decryption module at the sending end calls the locally stored hash function, and then hashes the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number in sequence to obtain the first to fourth hash values; wherein the hash function is a Toeplitz hash function based on a linear shift register.

[0016] Furthermore, the encryption and decryption module and the communication module each include N threads, and all threads are marked and numbered in sequence.

[0017] Furthermore, the process of the encryption and decryption module of the sending end generating a flow index according to the message hash value and the number of local threads includes:

[0018] The encryption and decryption module at the sending end performs a remainder operation on the message hash value and the local thread number, and marks the remainder value as the stream index.

[0019] Furthermore, the process of the encryption and decryption module of the sending end generating a flow index according to the message hash value and the number of local threads includes:

[0020] The encryption and decryption module at the sending end calls the stream index mapping table and searches for the message hash value in the stream index mapping table. If an integer value corresponding to the message hash value is found, the integer value is marked as the stream index; if an integer value corresponding to the message hash value is not found, an integer value is randomly generated between the local thread numbers 1 and N, and the generated integer value is marked as the stream index. At the same time, the message hash value and the generated integer value are stored in a corresponding relationship in the stream index mapping table, and the stream index mapping table uses the message hash value as the index.

[0021] Beneficial effects of the present invention: In the data processing process, the quantum security device of the present invention generates a stream index based on the message hash value and the local thread number, and selects the sending thread based on the stream index. The threads used by the sending end to send data to different application ports of the receiving end are different, while the threads used by the sending end to send data to the same application port of the receiving end are the same. This ensures that the data sent by the sending end to the same application port of the receiving end will not be sent out of order after being encrypted by the quantum security device, thereby ensuring the sequentiality of the data and avoiding some problems caused by disorder during the processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the structure of the quantum security device of the present invention;

[0023] Figure 2 This is a schematic diagram of data transmission according to the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0025] like Figure 1 As shown, a quantum security device is equivalent to a terminal device in quantum network and internet communications. After connecting to the quantum network, each quantum security device is assigned a unique identifier (RID). The internet locates the terminal device via its IP address, while the quantum network locates the terminal device via the RID assigned by the quantum security base station. Before describing communication between quantum security devices, it's important to understand the internal module division of a quantum security device. A quantum security device consists of a privacy module, an encryption / decryption module, and a communication module, which transmit data between modules. Because these modules are isolated from each other, the privacy module has its own IP address in network communications, called the quantum IP address, while the corresponding IP address of the communication module is called the communication IP address.

[0026] User data generated between quantum security devices is sent from the privacy module. During data transmission, all data must be quantum encrypted, and the encryption and decryption module performs this. The communication module is responsible for communicating with the outside world, transmitting the processed quantum ciphertext and quantum key to the quantum security device on the other end. Finally, all data is sent by the communication module. The communication module has its own communication IP address and requires the receiver's IP address to send messages. If the sender sends messages to multiple receivers separately, and sends multiple messages consecutively to the same application port on the same receiver, the messages may be sent out of order. This is the problem addressed by the present invention.

[0027] like Figure 2As shown, in order to ensure that the data sent by each quantum security device can find the target quantum security device information, and to ensure that the data sent by the sending end to the same application port of the receiving end is not sent out of order after being encrypted by the quantum security device, the present invention proposes a quantum security device data communication method. The participants of the method include a first quantum security device as the sending end and a second quantum security device as the receiving end. The method includes the following steps:

[0028] (1) The first quantum security device, i.e., the transmitter, sends a message to the second quantum security device, i.e., the receiver. The privacy module of the transmitter generates user data and sends the generated user data to the encryption and decryption module of the transmitter. After the encryption and decryption module of the transmitter obtains the user data, the encryption and decryption module of the transmitter obtains the transmitter quantum IP, transmitter port number, receiver quantum IP, and receiver port number corresponding to the user data according to the user data. Since the transmitter quantum IP, transmitter port number, receiver quantum IP, and receiver port number can uniquely locate the specific application of the specific receiver, the four data of the transmitter quantum IP, transmitter port number, receiver quantum IP, and receiver port number are hashed to obtain the first to fourth hash values, and then the first to fourth hash values ​​are XORed with each other to obtain the message hash value; or other algorithms can be used to combine the four data. The present invention adopts hash calculation.

[0029] The specific process of hashing the four data of the sending end quantum IP, the sending end port number, the receiving end quantum IP and the receiving end port number to obtain the first to fourth hash values ​​is as follows: the encryption and decryption module of the sending end calls the locally stored hash function, and then hashes the sending end quantum IP, the sending end port number, the receiving end quantum IP and the receiving end port number in sequence to obtain the first to fourth hash values; wherein the hash function is a Toeplitz hash function based on a linear shift register.

[0030] (2) The encryption and decryption module of the sending end generates a flow index based on the message hash value and the local number of threads, and marks the thread corresponding to the flow index as the first sending thread of the user data. The process of the encryption and decryption module of the sending end generating a flow index based on the message hash value and the local number of threads includes: the encryption and decryption module of the sending end can perform a remainder operation on the message hash value and the local number of threads, and mark the remainder value obtained as the flow index; or the encryption and decryption module of the sending end calls the flow index mapping table, searches the message hash value in the flow index mapping table, and if an integer value corresponding to the message hash value is found, the integer value is marked as the flow index; if the integer value corresponding to the message hash value is not found, an integer value is randomly generated between the local thread number 1 and N, and the generated integer value is marked as the flow index, and the message hash value and the generated integer value are stored in the flow index mapping table in a corresponding relationship. The flow index mapping table is stored in the encryption and decryption module of the sending end, and the flow index mapping table uses the message hash value as an index.

[0031] For efficiency, there are always N threads supporting concurrent operations. The appropriate number of threads is allocated based on the specific server computing power. Both the sending and receiving ends have N threads in their encryption and decryption modules and communication modules. All threads are labeled and numbered sequentially, that is, 1 represents thread 1, 2 represents thread 2, and so on. The thread corresponding to the remainder value after the modulo operation, or the integer value generated, is marked as the first thread to send user data.

[0032] The encryption and decryption module at the sending end searches for the communication IP and unique identifier RID of the corresponding receiving end through the quantum IP of the receiving end. The specific process is as follows: first, the encryption and decryption module at the sending end calls the routing relationship mapping table, which is stored in the encryption and decryption module at the sending end. The routing relationship mapping table contains the quantum IP, communication IP and unique identifier RID of each quantum security device, and the quantum IP, communication IP and unique identifier RID of each quantum security device are associated and matched to form a corresponding relationship. Knowing any one of the three can obtain the other two addresses; storing the routing relationship mapping table in the encryption and decryption module at the sending end makes the query speed fast, and the routing relationship mapping table is updated according to the preset time, which can be one day or one week, etc.

[0033] When a quantum security device is connected to a communication network, the quantum IP, communication IP and unique identifier RID information of the quantum security device can also be stored in real time on the cloud server. Since the routing relationship mapping table is updated according to the preset time, it is possible that a quantum security device is connected to the communication network during the time interval between the last update and this update. If the routing relationship mapping table in the encryption and decryption module of the sending end cannot find the information, it can be directly updated according to the routing relationship mapping table of the cloud server. Since the routing relationship mapping table in the encryption and decryption module of the sending end is constantly updated and improved, it can ensure smooth data transmission; then the communication IP and unique identifier RID of the corresponding receiving end are found in the routing relationship mapping table through the quantum IP of the receiving end;

[0034] The user data is then quantum-encrypted using a quantum key to obtain quantum ciphertext. The quantum ciphertext, the receiving end's communication IP address, the quantum key, the receiving end's unique identifier (RID), and the stream index are then combined to form a stream index message. The encryption and decryption module on the sending end sends the stream index message to the communication module on the sending end through the first sending thread of the user data.

[0035] In this way, the messages sent from the sender to the same application port of the same receiver will be processed in sequence by the first sending thread, ensuring the order of data encapsulation; then the encryption and decryption module of the sender will encapsulate the above-mentioned quantum ciphertext, the receiver's communication IP, the quantum key, the receiver's unique identifier RID and the orderly stream index into a stream index message and send it to the communication module of the sender.

[0036] (3) The communication module of the sending end has N processing threads, just like the encryption and decryption module. After obtaining the stream index message data, the communication module of the sending end parses the stream index message to obtain the quantum ciphertext, the receiving end communication IP, the quantum key, the receiving end's unique identifier RID and the stream index. The thread corresponding to the stream index is marked as the second sending thread of the user data. This process is the same as the process of selecting the first sending thread of the user data. In this way, the orderly processing of data can also be guaranteed in the communication module.

[0037] Then the communication module of the sending end establishes a connection with the communication module of the receiving end according to the communication IP of the receiving end, and then forms a TCP message with the quantum ciphertext, the communication IP of the receiving end and the local communication IP of the sending end, and sends the TCP message to the Internet through the second sending thread of the user data, and then sends the TCP message to the receiving end through the Internet; then, the communication module of the sending end forms a key message with the quantum key and the unique identifier RID of the receiving end, and sends the key message to the quantum security base station through the second sending thread of the user data. The quantum security base station parses the quantum key and the unique identifier RID of the receiving end, and the quantum security base station relays the quantum key to the receiving end according to the unique identifier RID of the receiving end.

[0038] In the data processing process, the quantum security device of the present invention selects the sending thread according to the stream index, so that the thread used by the sending end to send data to the same application port of the receiving end is the same thread. This ensures that the data sent by the sending end to the same application port of the receiving end will not be sent out of order after being encrypted by the quantum security device, thereby ensuring the sequentiality of the data.

[0039] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A quantum security device data communication method, characterized in that: The participants of the method include a first quantum security device as a transmitting end and a second quantum security device as a receiving end, and the method includes the following steps: (1) The privacy module of the sending end sends the generated user data to the encryption and decryption module of the sending end. The encryption and decryption module of the sending end obtains the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number corresponding to the user data according to the user data, performs hash calculation on the four data of the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number to obtain the first to fourth hash values, and then XORs the first to fourth hash values ​​with each other to obtain the message hash value; (2) The encryption and decryption module of the sending end generates a flow index based on the message hash value and the number of local threads, and marks the thread corresponding to the flow index as the first sending thread of the user data; the encryption and decryption module of the sending end searches for the communication IP and unique identifier RID of the corresponding receiving end through the quantum IP of the receiving end, and then uses the quantum key to quantum encrypt the user data to obtain quantum ciphertext, and then forms a flow index message with the quantum ciphertext, the communication IP of the receiving end, the quantum key, the unique identifier RID of the receiving end and the flow index; the encryption and decryption module of the sending end sends the flow index message to the communication module of the sending end through the first sending thread of the user data; (3) The communication module of the sending end parses the stream index message to obtain the quantum ciphertext, the receiving end communication IP, the quantum key, the receiving end's unique identifier RID and the stream index, and marks the corresponding thread as the second sending thread of the user data according to the stream index; then the communication module of the sending end establishes a connection with the communication module of the receiving end according to the receiving end communication IP, and then forms a TCP message with the quantum ciphertext, the receiving end communication IP and the local sending end communication IP, and sends the TCP message to the Internet through the second sending thread of the user data, and then sends the TCP message to the receiving end through the Internet; then, the communication module of the sending end forms a key message with the quantum key and the receiving end's unique identifier RID, and sends the key message to the quantum security base station through the second sending thread of the user data. The quantum security base station parses the quantum key and the receiving end's unique identifier RID, and the quantum security base station relays the quantum key to the receiving end according to the receiving end's unique identifier RID.

2. A quantum security device data communication method according to claim 1, characterized in that: The specific process of the encryption and decryption module at the sending end searching the corresponding communication IP and unique identifier RID of the receiving end through the quantum IP of the receiving end is as follows: First, the encryption and decryption module of the sender calls the routing relationship mapping table; then, the communication IP and unique identifier RID of the corresponding receiver are found in the routing relationship mapping table through the receiver's quantum IP; Among them, the routing relationship mapping table contains the quantum IP, communication IP and unique identifier RID of each quantum security device, and the quantum IP, communication IP and unique identifier RID of each quantum security device are associated and matched to form a corresponding relationship.

3. A quantum security device data communication method according to claim 2, characterized in that: The routing relationship mapping table is stored in the encryption and decryption module of the sending end, and the routing relationship mapping table is updated according to a preset time.

4. A quantum security device data communication method according to claim 1, characterized in that: The specific process of performing hash calculation on the four data of the sending end quantum IP, the sending end port number, the receiving end quantum IP and the receiving end port number to obtain the first to fourth hash values ​​is as follows: The encryption and decryption module at the sending end calls the locally stored hash function, and then hashes the sending end quantum IP, sending end port number, receiving end quantum IP and receiving end port number in sequence to obtain the first to fourth hash values; wherein the hash function is a Toeplitz hash function based on a linear shift register.

5. A quantum security device data communication method according to claim 1, characterized in that: The encryption and decryption module and the communication module each include N threads, and all threads are marked and numbered in sequence.

6. A quantum security device data communication method according to claim 1, characterized in that: The process of the encryption and decryption module at the sending end generating a flow index according to the message hash value and the number of local threads includes: The encryption and decryption module at the sending end performs a remainder operation on the message hash value and the local thread number, and marks the remainder value as the stream index.

7. A quantum security device data communication method according to claim 5, characterized in that: The process of the encryption and decryption module at the sending end generating a flow index according to the message hash value and the number of local threads includes: The encryption and decryption module at the sending end calls the stream index mapping table and searches for the message hash value in the stream index mapping table. If an integer value corresponding to the message hash value is found, the integer value is marked as the stream index; if an integer value corresponding to the message hash value is not found, an integer value is randomly generated between the local thread numbers 1 and N, and the generated integer value is marked as the stream index. At the same time, the message hash value and the generated integer value are stored in a corresponding relationship in the stream index mapping table, and the stream index mapping table uses the message hash value as the index.

Images