A quantum random number-based TCP encryption tunnel communication method

Abstract

The present application relates to a kind of quantum random number-based TCP encryption tunnel communication method, compared with prior art, it solves the defect that secret key communication technology cannot meet the actual use needs.The present application includes the following steps: data source end carries out the generation of secret key;Secret key distribution service content acquisition;Data source end and data target end communication initialization process;Data source end provides data to data target end;Data target end synchronous loss processing;Data target end inner gateway communication.The present application supports the uniform distribution of multiple encryption tunnel gateway secret keys, uses gateway negotiation mechanism to ensure the uniformity of the secret keys of multiple gateways, and uses the one-time-one secret key consumption mechanism of random secret key in the communication process of encryption tunnel, which ensures the safety of secret key transmission and use, and further provides protection for encryption tunnel communication.

Description

Technical Field

[0001] This invention relates to the field of data encryption communication technology, specifically a TCP encrypted tunnel communication method based on quantum random numbers. Background Technology

[0002] Encrypted tunneling technology is a method to protect the confidentiality and integrity of data by creating an encrypted tunnel between the data source and the data destination. It is widely used in industrial internet, government networks, public security networks, and payment systems, enabling secure encrypted communication across different network layers and branches. Various implementation methods exist, including IPsec, TLS / SSL, and SSH, with TLS / SSL-based encrypted tunneling technology being widely used due to its lightweight nature, ease of deployment, and maintenance.

[0003] Traditional network communication security relies on algorithms including asymmetric and symmetric encryption, hashing, etc., among which asymmetric encryption often plays a crucial role in transmitting the key information required for symmetric encryption. The emergence of quantum computing theory poses a threat to existing cryptographic systems.

[0004] In 1994, Peter Shor proposed Shor's algorithm, a highly efficient method for solving large number factorization; in 1997, Grover Lov K proposed the quantum search algorithm, reducing the search time to... 2019,Craig Gidney,Mart in Based on years of continuous optimization of Shor's algorithm, it was estimated that breaking the 2048-bit RSA algorithm within 8 hours would require a computer with 20 million qubits. In 2021, Elie Gouzien and Nicolas Sangouard proposed breaking the 2048-bit RSA algorithm in 177 days using only 13,436 qubits. From 2017 to 2022, the National Institute of Standards and Technology (NIST) conducted research on cryptography in the post-quantum era, pointing out that key exchange algorithms, asymmetric encryption, and signature algorithms, including DH, ECDH, and RSA, are vulnerable to quantum attacks.

[0005] From the perspective of post-quantum era cryptographic algorithm research, although progress has been made in a series of cryptographic algorithms based on lattices, hashing, multivariates, and encoding, secure key exchange protocols all have varying degrees of shortcomings. The deficiencies in asymmetric encryption and secure key exchange bring security risks to the application of TLS-based encrypted tunneling technology. Commonly used quantum encrypted communication technologies in China generally employ quantum random numbers as keys, transmitting keys through secure media such as QKD, USB tokens, and super SIM cards, and using a one-time pad key consumption method during the session to ensure communication security.

[0006] The above solutions suffer from high QKD implementation costs and cumbersome offline key filling processes for security media such as USB tokens, making it difficult to meet the stable and continuous operation requirements of encrypted tunnels in industrial and government scenarios.

[0007] Therefore, designing a TCP encrypted tunnel communication method that can achieve key distribution and synchronization of multiple encrypted tunnel gateways and reduce the quantum key distribution cost has become an urgent technical problem to be solved. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of existing key communication technologies that cannot meet practical needs, and to provide a TCP encrypted tunnel communication method based on quantum random numbers to solve the above problems.

[0009] To achieve the above objectives, the technical solution of the present invention is as follows:

[0010] A TCP encrypted tunnel communication method based on quantum random numbers, wherein the data source communicates with the data target based on the TCP protocol, includes the following steps:

[0011] 11) Key generation at the data source end: The data source end generates a random key queue based on a quantum random number generator and puts it into the memory area provided by the trusted execution environment built by the confidential computing processor;

[0012] 12) Key distribution service content retrieval: The key distribution service accesses the key queue and retrieves a set of keys by means of Intel SGX's Enclave or AMD's virtual machine mechanism, and provides key distribution service to the data target based on TCP / WEB service;

[0013] 13) Initialization process of communication between the data source and the data target: The data target registers with the data source, groups the data target, and obtains the initial key information for encrypted communication;

[0014] 14) The data source provides data to the data target: The data source provides a set of keys required for internal communication of the gateway to a group of encrypted tunnel gateways, i.e. the data target, through the key distribution service, and ensures that the key content of the group of gateways is synchronized.

[0015] 15) Handling of data target end synchronization loss: When the encryption tunnel gateway key in the data target end loses synchronization, the key content is synchronized by relaying.

[0016] 16) Communication between gateways within the data target end: Each encrypted tunnel gateway within the data key end achieves encrypted communication through a protocol.

[0017] The key generation process at the data source end includes the following steps:

[0018] 21) The quantum random number generator at the data source continuously refreshes and generates random numbers within the memory buffer area;

[0019] 22) Utilize Intel SGX, AMD SEV, or confidential computing chips to build a trusted execution environment, and build memory queues within the trusted execution environment region, i.e., the secure region;

[0020] 23) Draw a set of random numbers in the secure area and generate a random key queue through a key generation algorithm; use the data encapsulation technology provided by the confidential computing chip to encrypt the key and save it to the local disk.

[0021] The content acquisition of the key distribution service includes the following steps:

[0022] 31) Set up a TCP / WEB server in a non-secure area outside the trusted execution environment area to listen for external requests from the data target;

[0023] 32) Invoking the confidential computing mechanism provides an Enclave / virtual machine access mechanism to establish an access path between the TCP / WEB server and the secure zone;

[0024] 33) After receiving a request from the target data terminal, retrieve local disk data according to the request;

[0025] 34) The TCP / WEB server requests to read local disk data from the secure zone and uses confidential computing to provide a data decryption mechanism to decrypt the data;

[0026] 35) Utilize the access path of the secure zone to provide decrypted data to the TCP / WEB service.

[0027] The communication initialization process between the data source and the data target includes the following steps:

[0028] 41) The key distribution service registers data target information.

[0029] When encrypted tunnel gateways A / B / ...N need to communicate, they are grouped together and given the same group ID. Gateways within the group use the same key to communicate with each other.

[0030] 42) The key distribution service extracts a key K1 as the initial session key for the gateway group;

[0031] 43) Establish a grouping description table for each group, including K1, Cn, and S.

[0032] Where K1 is the initial session key, Cn is the number of gateways in the group, and the key list S address is empty;

[0033] 44) The key distribution service generates x509 certificates for each of the encrypted tunnel gateways A / B / ...N based on their registration information. The x509 certificate contains information such as {key generator identifier, gateway identifier, gateway group identifier, gateway access address, server public key, server private key signature, ...}. The key distribution service secretly transmits the certificate and initial key K1 to the gateway through a specific security method. The gateway securely stores the certificate and initial key K1 using HSM or TPM methods, where the specific security method is PGP protocol or U-shield.

[0034] 45) The key distribution service stores a list GL{(gateway A identifier, gateway A address), (gateway B identifier, gateway B address), ...} of encrypted tunnel gateways A / B / ...N.

[0035] The process of the data source providing data to the data target includes the following steps:

[0036] 51) To ensure the synchronization of transmitted content within the group, the key distribution service sends a request count C′n to different gateways. The initial value of C′n is the number of group gateways Cn.

[0037] 52) Encrypted tunnel gateways A / B / ...N sequentially send requests to the key distribution service, with the request format being {Device ID, K1 Encryption (Gateway Certificate, Key Request Request)};

[0038] 53) The key distribution service retrieves the group ID, extracts the key K1 corresponding to the group ID to decrypt the certificate and verifies it with the private key, finds the key data corresponding to the group ID from the local disk, decrypts the key data and populates the key list S:

[0039] If no corresponding key data for the group is found, generate data and populate the key list S according to the key generation steps at the data source end and the content acquisition steps of the key distribution service;

[0040] 54) The key distribution service randomly selects key K2 from the key queue as the next round session key for the encrypted tunnel gateway A / B / ...N;

[0041] 55) The key distribution service returns a key message to gateway A in the format {K1 encrypted(key request response, key list S, K2)}. When the grouping changes, the server sends a {K1 encrypted(update grouping list, GL)} message.

[0042] 56) Gateway A decrypts using K1, saves K2, GL, and S information to a secure location; sends a confirmation message to the key distribution service: {K2 encrypts (confirms key update, Hash(S))};

[0043] 57) The key distribution service decrypts and verifies the key list hash using K2, and calculates C′n = C′n-1;

[0044] 58) If the key distribution service does not receive key update requests from all gateways within the validity period, it will set C′n to 0; when C′n is 0, the key distribution service will modify the marshalling descriptor, replace K1 with K2, and set the contents of the key list S in the descriptor table to empty.

[0045] 59) The key distribution service sends {K2 encryption (confirming key update complete, C′n)} to gateway A;

[0046] 510) Gateway A replaces K1 with K2. If C′n=0, then the key update for this round is completed according to the broadcast notification from GL.

[0047] Encrypted tunnel gateways A / B / ...N sequentially request data from the key distribution service, repeating steps 51) to 510). After each communication, K is used... n Replace K n-1 This serves as the session key for the next communication.

[0048] The data target end synchronization loss handling includes the following steps:

[0049] 61) When the session key of Gateway A expires, it requests initialization from the key distribution service;

[0050] 62) Gateway A completes the initialization work according to the communication initialization process steps of the data source and data target end, and obtains the current session key Kn and certificate content; Gateway A sends {Device ID, Kn encryption (certificate, GL list request)} to the key distribution service; The key distribution server responds to the request, finds the group corresponding to the device ID and returns the GL corresponding to the group to Gateway A;

[0051] 63) Gateway A sends a {Recovery Key Request, Kn Encryption (Certificate)} to other gateways in the group according to GL;

[0052] 64) The remaining gateways request Kn from the key distribution service and send {marshalling ID, Kn encryption (certificate, relay request)};

[0053] 65) The key distribution service returns a {Kn encrypted (relay confirmation)} message to the nearest gateway B and sends a {Kn encrypted (relay gateway ID(B))} message to other gateways;

[0054] 66) Relay gateway B sends a message {recovery key, Kn encryption (certificate)} to gateway A;

[0055] 67) After gateway A confirms, gateway B sends the message {update key, Kn encryption(S), hash(S)}.

[0056] 68) Gateway A decrypts using Kn and saves the key queue S to the secure area.

[0057] The inter-gateway communication within the data target terminal includes the following steps:

[0058] 71) Gateway A generates a random number r1 and sends the random number in plaintext to gateway B;

[0059] 72) Gateways A and B calculate r1 = r1 mod len(S);

[0060] 73) Gateway A sends key S to Gateway B r1 Certificates issued by the encryption key distribution service;

[0061] 74) Gateway B saves S locally r1 Decrypt the certificate and complete the verification; then accept the request from Gateway A.

[0062] 75) Gateway A establishes a connection with local client A, and transmits local client A's requests, including the request address and request content, through S. r1 After encryption, the request is sent to gateway B. Gateway B decrypts the request and forwards it to the corresponding client B. Similarly, gateway B encrypts the response from the corresponding client B and returns it to gateway A. Gateway A decrypts the response and returns it to client A.

[0063] 76) After both parties end the session, gateways A and B will respectively send S r1 destroy;

[0064] 77) After the key of any device A / B / ...N in the encrypted tunnel of the gateway within the group is destroyed, update the keys of all gateways in the group through step 15).

[0065] Beneficial effects

[0066] The present invention provides a TCP encrypted tunnel communication method based on quantum random numbers. Compared with the prior art, the key distribution of the encrypted tunnel can be carried out on a public channel, which is less expensive than quantum key distribution (QKD) devices. It also supports the unified distribution of keys for multiple encrypted tunnel gateways, and adopts a gateway negotiation mechanism to ensure the key consistency of multiple gateways. During the communication process, the encrypted tunnel adopts a one-time key consumption mechanism of random keys to ensure the security of key transmission and use, thereby providing a guarantee for encrypted tunnel communication.

[0067] This invention has the following technical features: the key generation is based on quantum random number generation, and its random algorithm is unbreakable; the data source adopts a trusted execution environment built with confidential computing to avoid source key leakage; the key data distribution avoids the asymmetric encryption DH protocol key transmission form and has a certain resistance to quantum attacks; the relay method ensures the security of session and key transmission when the data target loses synchronization, thereby ensuring the internal communication security of the data target. Attached Figure Description

[0068] Figure 1 This is a sequence diagram of the method of the present invention;

[0069] Figure 2 A diagram illustrating the distribution of keys from the data source to the data target.

[0070] Figure 3 A diagram illustrating the distribution of keys via relay when the data target loses synchronization;

[0071] Figure 4 This is a schematic diagram of the key distribution timing relationship;

[0072] Figure 5 This is a schematic diagram of a gateway grouping descriptor. Detailed Implementation

[0073] To provide a better understanding of the structural features and effects achieved by the present invention, a detailed description is provided below, accompanied by preferred embodiments and accompanying drawings:

[0074] like Figure 1 As shown, the present invention discloses a TCP encrypted tunnel communication method based on quantum random numbers, in which the data source communicates with the data target based on the TCP protocol, including the following steps:

[0075] The first step is to generate keys at the data source end: the data source end generates a random key queue based on a quantum random number generator and puts it into the memory area provided by a trusted execution environment built by a confidential computing processor.

[0076] (1) The quantum random number generator at the data source continuously refreshes and generates random numbers within the memory buffer area;

[0077] (2) Build a trusted execution environment using Intel SGX, AMD SEV or confidential computing chips, and build a memory queue in the trusted execution environment area, i.e. the secure area;

[0078] (3) Draw a set of random numbers in the secure area and generate a random key queue through the key generation algorithm; use the data encapsulation technology provided by the confidential computing chip to encrypt the key and save it to the local disk.

[0079] The second step is to obtain the key distribution service content: The key distribution service uses Intel SGX's Enclave or AMD's virtual machine mechanism to access the key queue and obtain a set of keys, and then provides key distribution services to the data target based on TCP / WEB services.

[0080] (1) Set up a TCP / WEB server in a non-secure area outside the trusted execution environment area to listen for external requests from the data target;

[0081] (2) Call the confidential computing to provide the Enclave / virtual machine access mechanism to establish an access path between the TCP / WEB server and the security zone;

[0082] (3) After receiving the data target request, retrieve local disk data according to the request;

[0083] (4) The TCP / WEB server requests the secure zone to read local disk data and uses confidential computing to provide a data decryption mechanism to decrypt the data;

[0084] (5) Use the access path of the secure zone to provide decrypted data to the TCP / WEB service.

[0085] The third step is the communication initialization process between the data source and the data target: The data target registers with the data source, is grouped, and obtains the initial key information for encrypted communication. Each data target device is assigned an initial session key to establish communication between the data source and the data target. After each session, the data source assigns a new session key to the data target. The data source stores the key of the data target device and provides retrieval capabilities.

[0086] (1) The key distribution service registers the target information of the data.

[0087] When encrypted tunnel gateways A / B / ...N need to communicate, they are grouped together and given the same group ID. Gateways within the group use the same key to communicate with each other.

[0088] (2) The key distribution service extracts a key K1 as the initial session key for the gateway group;

[0089] (3) Establish a group description table for each group. The group description table includes K1, Cn and S.

[0090] Where K1 is the initial session key, Cn is the number of gateways in the group, and the key list S address is empty;

[0091] (4) The key distribution service generates x509 certificates for encrypted tunnel gateways A / B / ...N respectively based on their registration information. The x509 certificate contains {key generator identifier, gateway identifier, gateway group identifier, gateway access address, server public key, server private key signature, ...} information; the key distribution service secretly transmits the certificate and initial key K1 to the gateway through a specific security method; the gateway securely stores the certificate and initial key K1 using HSM, TPM, etc., where the specific security method is PGP protocol or U-shield;

[0092] (5) The key distribution service stores a list GL{(gateway A identifier, gateway A address), (gateway B identifier, gateway B address), ...} of encrypted tunnel gateways A / B / ...N.

[0093] The fourth step is for the data source to provide data to the data target: such as... Figure 2 As shown, the data source provides a set of keys required for internal communication within a group of encrypted tunnel gateways (i.e., the data target end) through a key distribution service, ensuring that the key content of this group of gateways is synchronized. Here, the data source ensures that all devices within the same group at the data target end obtain a consistent key queue. Once it is confirmed that all devices within the group have obtained consistent keys, the data source's key queue is destroyed.

[0094] (1) To ensure the synchronization of transmitted content within the group, the key distribution service sends a request count C′n to different gateways. The initial value of C′n is the number of group gateways Cn.

[0095] (2) Encrypted tunnel gateways A / B / ...N sequentially send requests to the key distribution service. The request format is {Device ID, K1 encryption (gateway certificate, request for key)};

[0096] (3) The key distribution service retrieves the group ID corresponding to the device ID, extracts the decryption certificate corresponding to the device ID using key K1 and verifies it with the private key, searches for the key data of the group ID to which the corresponding device belongs from the local disk, decrypts the key data and populates the key list S:

[0097] If no corresponding key data for the group is found, generate data and populate the key list S according to the key generation steps at the data source end and the content acquisition steps of the key distribution service;

[0098] (4) The key distribution service randomly selects key K2 from the key queue as the next round session key for the encrypted tunnel gateway A / B / ...N;

[0099] (5) The key distribution service returns a key message to gateway A, which is in the format of {K1 encryption (key request response, key list S, K2)}. When the grouping changes, the server sends a {K1 encryption (update grouping list, GL)} message.

[0100] (6) Gateway A decrypts with K1 and saves K2, GL and S information to a secure location; sends a confirmation message to the key distribution service: {K2 encryption (confirm key update, Hash(S))};

[0101] (7) The key distribution service decrypts and verifies the key list hash through K2, and calculates C′n=C′n-1;

[0102] (8) If the key distribution service does not receive key update requests from all gateways within the validity period, it will set C′n to 0; when C′n is 0, the key distribution service will modify the marshalling descriptor, replace K1 with K2, and set the contents of the key list S in the descriptor table to empty.

[0103] (9) The key distribution service sends {K2 encryption (confirming key update complete, C′n)} to gateway A;

[0104] (10) Gateway A replaces K1 with K2. If C′n=0, then the key update for this round is completed according to the broadcast notification from GL.

[0105] Encrypted tunnel gateways A / B / ...N sequentially request data from the key distribution service, repeating processes (1) to (10). After each communication, K is used... n Replace K n-1 This serves as the session key for the next communication.

[0106] Step 5, Handling data synchronization loss at the target end: such as Figure 3 As shown, when the encryption tunnel gateway key in the data target end loses synchronization, the key content is synchronized using a relay method.

[0107] (1) When the session key of gateway A expires, it requests initialization from the key distribution service;

[0108] (2) Figure 4 As shown, Gateway A completes the initialization process according to step 4, obtaining the current session key Kn and certificate content; Gateway A sends {Device ID, Kn encryption (certificate, GL list request)} to the key distribution service; The key distribution server responds to the request, finds the group corresponding to the device ID and returns the GL corresponding to the group to Gateway A;

[0109] (3) Gateway A sends a {Recovery Key Request, Kn Encryption (Certificate)} to other gateways in the group according to GL;

[0110] (4) The remaining gateways request Kn from the key distribution service and send {marshalling ID, Kn encryption (certificate, request for relay)};

[0111] (5) The key distribution service returns a {Kn encrypted (relay confirmation)} message to the nearest gateway B and sends a {Kn encrypted (relay gateway ID(B))} message to other gateways;

[0112] (6) Relay gateway B sends a message {recovery key, Kn encryption (certificate)} to gateway A;

[0113] (7) After gateway A confirms, gateway B sends the message {update key, Kn encryption(S), hash(S)}.

[0114] (8) Gateway A decrypts with Kn and saves the key queue S to the secure area.

[0115] Step 6: Communication between gateways within the data target end: Each encrypted tunnel gateway within the data key end achieves encrypted communication through a protocol. Because the gateways within the data target end use a one-time key communication method, the gateway key consumption rate is inconsistent. When the key of a specific gateway within the group is exhausted, the key queues of all devices within the group need to be replaced. Figure 5 As shown.

[0116] (1) Gateway A generates a random number r1 and sends the random number to gateway B in plaintext;

[0117] (2) Gateways A and B calculate r1 = r1 mod len(S); len(S) is the length of the key queue S.

[0118] (3) Gateway A sends key S to Gateway B r1 Certificates issued by the encryption key distribution service;

[0119] (4) Gateway B retrieves S data stored locally. r1 Decrypt the certificate and complete the verification; then accept the request from Gateway A.

[0120] (5) Gateway A establishes a connection with local client A, and transmits local client A's requests, including request address and request content, through S. r1 After encryption, the request is sent to gateway B. Gateway B decrypts the request and forwards it to the corresponding client B. Similarly, gateway B encrypts the response from the corresponding client B and returns it to gateway A. Gateway A decrypts the response and returns it to client A.

[0121] (6) After both parties end the session, gateways A and B will respectively send S r1 destroy;

[0122] (7) After the key of any device A / B / ...N in the encrypted tunnel of the gateway in the group is destroyed, update the key of all gateways in the group through step five.

[0123] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A TCP encrypted tunnel communication method based on quantum random numbers, wherein the data source end communicates with the data target end based on the TCP protocol, characterized in that, Includes the following steps: 11) Key generation at the data source end: The data source end generates a random key queue based on a quantum random number generator and puts it into the memory area provided by the trusted execution environment built by the confidential computing processor; 12) Key distribution service content retrieval: The key distribution service accesses the key queue and retrieves a set of keys by means of Intel SGX's Enclave or AMD's virtual machine mechanism, and provides key distribution service to the data target based on TCP / WEB service; 13) Initialization process of communication between the data source and the data target: The data target registers with the data source, groups the data target, and obtains the initial key information for encrypted communication; 14) The data source provides data to the data target: The data source provides a set of keys required for internal communication of the gateway to a set of encrypted tunnel gateways, i.e. the data target, through the key distribution service, and ensures that the key content of the encrypted tunnel gateway is synchronized. The process of the data source providing data to the data target includes the following steps: 141) To ensure the synchronization of transmitted content within a group, the key distribution service sends request counts to different gateways. , The initial value is the number of marshalling gateways, Cn; 142) Encrypted tunnel gateways A / B / ...N sequentially send requests to the key distribution service, with the request format being {Device ID, K1 Encryption (Gateway Certificate, Key Request Request)}; 143) The key distribution service retrieves the group ID, extracts the key K1 corresponding to the group ID to decrypt the certificate and verifies it with the private key, finds the key data corresponding to the group ID from the local disk, decrypts the key data and populates the key list S: If no corresponding key data for the group is found, generate data and populate the key list S according to the key generation steps at the data source end and the content acquisition steps of the key distribution service; 144) The key distribution service randomly selects key K2 from the key queue as the next round session key for the encrypted tunnel gateway A / B / ...N; 145) The key distribution service returns a key message to gateway A in the format {K1 encrypted (key request response, key list S, K2)}. When the grouping changes, the server sends a {K1 encrypted (update grouping list, GL)} message. 146) Gateway A decrypts using K1, saves K2, GL, and S information to a secure location; sends a confirmation message to the key distribution service: {K2 encrypts (confirms key update, Hash(S))}; 147) The key distribution service decrypts and verifies the key list hash using K2, and calculates... ; 148) If the key distribution service does not receive key update requests from all gateways within the validity period, it will... Set to 0; when When the value is 0, the key distribution service modifies the marshalling descriptor, replaces K1 with K2, and sets the contents of the key list S in the descriptor table to empty; 149) The key distribution service sends {K2 encryption (confirming key update is complete) to gateway A. )}; 1410) Gateway A replaces K1 with K2, such as Then, according to the GL broadcast notification, the key update for this round is complete; Encrypted tunnel gateways A / B / ...N sequentially request data from the key distribution service, repeating steps 141) to 1410). After each communication, K is used... n Replace K n-1 This serves as the session key for the next communication. 15) Handling of data target end synchronization loss: When the encryption tunnel gateway key in the data target end loses synchronization, the key content is synchronized by relay. 16) Communication between gateways within the data target end: Each encrypted tunnel gateway within the data key end achieves encrypted communication through a protocol.

2. The TCP encrypted tunnel communication method based on quantum random numbers according to claim 1, characterized in that, The key generation process at the data source end includes the following steps: 21) The quantum random number generator at the data source continuously refreshes and generates random numbers within the memory buffer area; 22) Utilize Intel SGX, AMD SEV, or confidential computing chips to build a trusted execution environment, and build memory queues within the trusted execution environment region, i.e., the secure region; 23) Draw a set of random numbers in the secure area and generate a random key queue through a key generation algorithm; use the data encapsulation technology provided by the confidential computing chip to encrypt the key and save it to the local disk.

3. The TCP encrypted tunnel communication method based on quantum random numbers according to claim 1, characterized in that, The content acquisition of the key distribution service includes the following steps: 31) Set up a TCP / WEB server in a non-secure area outside the trusted execution environment area to listen for external requests from the data target; 32) Invoking the confidential computing mechanism provides an Enclave / virtual machine access mechanism to establish an access path between the TCP / WEB server and the secure zone; 33) After receiving a request from the target data terminal, retrieve local disk data according to the request; 34) The TCP / WEB server requests to read local disk data from the secure zone and uses confidential computing to provide a data decryption mechanism to decrypt the data; 35) Utilize the access path of the secure zone to provide decrypted data to the TCP / WEB service.

4. The TCP encrypted tunnel communication method based on quantum random numbers according to claim 1, characterized in that, The communication initialization process between the data source and the data target includes the following steps: 41) The key distribution service registers data target information. When encrypted tunnel gateways A / B / ...N need to communicate, they are grouped together and given the same group ID. Gateways within the group use the same key to communicate with each other. 42) The key distribution service extracts a key K1 as the initial session key for the gateway assembly; 43) Establish a grouping description table for each group, including K1, Cn, and S. Where K1 is the initial session key, Cn is the number of gateways in the group, and the key list S address is empty; 44) The key distribution service generates x509 certificates for each of the encrypted tunnel gateways A / B / ...N based on their registration information. The x509 certificate contains {key generator identifier, gateway identifier, gateway group identifier, gateway access address, server public key, server private key signature} information. The key distribution service secretly transmits the certificate and initial key K1 to the gateway through a specific security method. The gateway securely stores the certificate and initial key K1 using HSM or TPM methods, where the specific security method is PGP protocol or U-shield. 45) The key distribution service stores a list GL{(gateway A identifier, gateway A address), (gateway B identifier, gateway B address), ..., (gateway N identifier, gateway N address)} of encrypted tunnel gateways A / B / ...N.

5. The TCP encrypted tunnel communication method based on quantum random numbers according to claim 1, characterized in that, The data target end synchronization loss handling includes the following steps: 51) When the session key of gateway A expires, it requests initialization from the key distribution service; 52) Gateway A completes the initialization work according to the communication initialization process steps of the data source and data target end, and obtains the current session key Kn and certificate content; Gateway A sends {Device ID, Kn encryption (certificate, GL list request)} to the key distribution service; The key distribution server responds to the request, finds the group corresponding to the device ID and returns the GL corresponding to the group to Gateway A; 53) Gateway A sends a {Recovery Key Request, Kn Encryption (Certificate)} to other gateways in the group according to GL; 54) The remaining gateways request Kn from the key distribution service and send {marshalling ID, Kn encryption (certificate, relay request)}; 55) The key distribution service returns a {Kn encrypted (relay confirmation)} message to the nearest gateway B and sends a {Kn encrypted (relay gateway ID (B))} message to other gateways; 56) Relay gateway B sends a message {recovery key, Kn encryption (certificate)} to gateway A; 57) After gateway A confirms, gateway B sends the message {update key, Kn encryption (S), hash (S)}. 58) Gateway A decrypts using Kn and saves the key queue S to the secure area.

6. The TCP encrypted tunnel communication method based on quantum random numbers according to claim 1, characterized in that, The inter-gateway communication within the data target terminal includes the following steps: 61) Gateway A generates a random number r1 and sends the random number in plaintext to gateway B; 62) Gateways A and B calculate r1 = r1 mod len(S); 63) Gateway A sends key S to gateway B r1 Certificates issued by the encryption key distribution service; 64) Gateway B saves S locally r1 Decrypt the certificate and complete the verification; then accept the request from Gateway A. 65) Gateway A establishes a connection with local client A, and transmits local client A's request, including the request address and request content, through S. r1 After encryption, the request is sent to gateway B. Gateway B decrypts the request and forwards it to the corresponding client B. Similarly, gateway B encrypts the response from the corresponding client B and returns it to gateway A. Gateway A decrypts the response and returns it to client A. 66) After both parties end the session, gateways A and B respectively send S r1 destroy; 67) After the key of any device A / B / ...N in the encrypted tunnel of the gateway within the group is destroyed, update the key of all gateways in the group through step 15).

Images