Key distribution method, device and system applied in quantum key management scenario

Abstract

The present invention discloses a key distribution method, device and system applied in a quantum key management scenario. The present invention pre-stores identity authentication information in a trusted execution environment. The identity information cannot be illegally tampered with. When a password application device needs to apply for a key / password, it needs to compare its own identity information to be verified with the identity authentication information obtained through a proxy module. When the comparison is consistent, the identity identification sent by the password application device is sent to a key security processing module through the proxy module to obtain a target password. By authenticating the password application device, the probability of the password being obtained by a third party is reduced, the security of the password in the distribution process is improved, and the security of the data protected by the password is further improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key distribution method, device and system applied in a quantum key management scenario. Background Art

[0002] Password distribution refers to the process of securely transferring passwords from one entity to another in a network. In the information age, passwords are key elements of identity authentication and data confidentiality, and their security is crucial to personal privacy and corporate secrets. The significance of password distribution is to ensure that the user's password or key can safely reach the intended destination without being obtained by unauthorized individuals and devices. This process is the basis for establishing secure communications and maintaining the secure operation of information systems. It involves not only the creation and update of passwords, but also the revocation and replacement of passwords.

[0003] In the current practice of password distribution, Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are among the most common technologies. These protocols are mainly used for secure communications on the Internet, ensuring encryption of data transmitted between the client and the server, thereby protecting the data from being intercepted or tampered with by a third party. However, even with the use of encryption protocols, the password distribution process cannot completely rule out security threats such as configuration errors, software vulnerabilities, or man-in-the-middle attacks, which can lead to password leaks during the password distribution process. Summary of the invention

[0004] The present invention provides a key distribution method, device and system applied to quantum key management scenarios, which can improve the security of passwords during password distribution and further improve the security of information protected by passwords.

[0005] In order to solve the above technical problems, the first aspect of the present invention discloses a key distribution method applied in a quantum key management scenario, the method comprising:

[0006] The key distribution management module receives an identity sent by a cryptographic application device, wherein the identity is used to uniquely identify a cryptographic application device in the network;

[0007] The key distribution management module applies to the key security processing module for the identity authentication information of the password application device, and determines whether the password application device has passed the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module sends the identity identifier to the key security processing module and applies for a target password matching the identity identifier. The key security processing module is deployed in a trusted execution environment, and the key distribution management module is deployed in a non-trusted execution environment. The communication between the key security processing module and the key distribution management module is transmitted through a proxy module deployed in the non-trusted execution environment.

[0008] The key security processing module sends the target password to the password application device through the key distribution management module.

[0009] As an optional embodiment, in the first aspect of the present invention, the identity authentication information includes: the identity identifier, and one or more of the device model, device asset number, device serial number, device MAC address, device firmware version number, device hardware version number, device production date, plain text password, and device public key. When the cryptographic application device does not support asymmetric encryption, the device public key is empty or the identity authentication information does not include the device public key.

[0010] As an optional implementation, in the first aspect of the present invention, judging whether the password application device passes the identity authentication based on the identity authentication information includes:

[0011] The key distribution management module calculates the session token and the identity authentication information according to a predefined hash function to obtain a hash value of the cryptographic application device. The session token is generated by the key security processing module based on a quantum random number, and the session token is used to identify the session between the key distribution management module and the cryptographic application device.

[0012] The key distribution management module compares the hash value of the cryptographic application device with the hash value to be verified to see if they are equal. If they are equal, the cryptographic application device passes the identity authentication; if they are not equal, the cryptographic application device fails the identity authentication;

[0013] The hash value to be verified is obtained in the following way:

[0014] The password application device calculates its device information and the session token according to the predefined hash function to obtain a hash value to be verified, and the device information is the same as the key value in the identity verification information;

[0015] The cryptographic application device encrypts the hash value to be verified using an encryption key and sends the encrypted value to the key distribution management module, and the key distribution management module decrypts the encrypted value using a decryption key corresponding to the encryption key to obtain the hash value to be verified;

[0016] When the cryptographic application device supports asymmetric encryption, the encryption key and the decryption key refer to the device private key and the device public key; when the cryptographic application device does not support asymmetric encryption, the encryption key and the decryption key both refer to the session key between the cryptographic application device and the key distribution management module.

[0017] As an optional implementation, in the first aspect of the present invention, before the key distribution management module receives the identity sent by the password application device, the method further includes:

[0018] The key distribution management module receives a new session request from the cryptographic application device;

[0019] The key distribution management module applies for a session key and a session token from the key security processing module;

[0020] The key security processing module generates a session key and a session token based on quantum random numbers, and sends them to the key distribution management module;

[0021] The key distribution management module encrypts the session key and the session token and sends them to the password application device, and triggers the key distribution management module to receive the identity identifier sent by the password application device.

[0022] As an optional implementation, in the first aspect of the present invention, when the cryptographic application device supports asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0023] The key distribution management module uses the business management private key to encrypt the session key and session token, and sends the encrypted session key and session token to the cryptographic application device through an asymmetric cryptographic transmission protocol. The encrypted session key and session token will be decrypted in the cryptographic application device using the business management public key. The business management private key and the business management public key refer to the asymmetric keys pre-generated by the key security processing module for the key distribution management module.

[0024] As an optional implementation, in the first aspect of the present invention, when the cryptographic application device does not support asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0025] The key distribution management module sends the session token to the password application device;

[0026] The key distribution management module receives a temporary key sent by the password application device, where the temporary key is generated by the password application device based on a session token and the plaintext password;

[0027] The key distribution management module obtains the quantum session key from the key security processing module, encrypts the quantum session key based on the temporary key and sends it to the cryptographic application device;

[0028] The quantum session key is used as a session key after being decrypted by the cryptographic application device using the temporary key.

[0029] As an optional implementation, in the first aspect of the present invention, before the key distribution management module receives a new session request from the cryptographic application device, the key distribution method applied in the quantum key management scenario further includes:

[0030] The key distribution management module receives the identity authentication information;

[0031] The key distribution management module sends the identity authentication information to the key security processing module;

[0032] The key security processing module encrypts the identity authentication information using a trusted key and sends the encrypted information to the key distribution management module, and triggers the key distribution management module to receive a new session request from the cryptographic application device, wherein the trusted key is a key that can only be accessed in a trusted execution environment;

[0033] And, the key distribution management module applies to the key security processing module for the identity authentication information of the password application device, including:

[0034] The key distribution management module sends the encrypted identity authentication information to the key security processing module, and the key security processing module decrypts the information and sends it to the key distribution management module.

[0035] The second aspect of the present invention discloses a key distribution device applied to a quantum key management scenario, the device comprising: a key distribution management module, an agent module and a key security processing module;

[0036] The key distribution management module is used to receive an identity sent by a cryptographic application device, where the identity is used to uniquely identify a cryptographic application device in the network;

[0037] The key distribution management module is further used to apply for the identity authentication information of the password application device from the key security processing module, and determine whether the password application device has passed the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module is further used to send the identity identifier to the key security processing module and apply for a target password matching the identity identifier. The key security processing module is deployed in a trusted execution environment, and the key distribution management module is deployed in a non-trusted execution environment.

[0038] The proxy module is used to proxy all communication information between the key security processing module and the key distribution management module, and the proxy module is deployed in a non-trusted execution environment;

[0039] The key security processing module is used to send the target password to the password application device through the key distribution management module.

[0040] The third aspect of the present invention discloses another key distribution device applied to a quantum key management scenario, the device comprising:

[0041] A memory storing executable program code;

[0042] a processor coupled to the memory;

[0043] The processor calls the executable program code stored in the memory to execute the key distribution method applied to the quantum key management scenario disclosed in the first aspect of the present invention.

[0044] The fourth aspect of the present invention discloses a quantum key management system, which stores computer instructions. When the computer instructions are called, they are used to execute the key distribution method applied to the quantum key management scenario disclosed in the first aspect of the present invention.

[0045] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0046] The present invention pre-stores identity authentication information in a trusted execution environment, and the identity information cannot be illegally tampered with. When a password application device needs to apply for a key / password, it needs to compare its own identity information to be verified with the identity authentication information obtained through the proxy module. When the comparison is consistent, the identity identification sent by the password application device is sent to the key security processing module through the proxy module to obtain the target password. By authenticating the password application device, the probability of the password being obtained by a third party is reduced, the security of the password in the distribution process is improved, and the security of the data protected by the password is further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0048] Figure 1 It is a flowchart of a key distribution method applied to a quantum key management scenario disclosed in an embodiment of the present invention;

[0049] Figure 2 It is a flowchart of another key distribution method applied to a quantum key management scenario disclosed in an embodiment of the present invention;

[0050] Figure 3 It is a structural schematic diagram of a key distribution device applied in a quantum key management scenario disclosed in an embodiment of the present invention;

[0051] Figure 4 It is a schematic diagram of the structure of another key distribution device applied to a quantum key management scenario disclosed in an embodiment of the present invention;

[0052] Figure 5 It is a structural schematic diagram of a key distribution device applied in a quantum key management scenario disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or end including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or ends.

[0055] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0056] The present invention discloses a key distribution method, device and system applied in a quantum key management scenario. The system includes a key security processing module deployed in a trusted execution environment, and a proxy module and a key distribution management module deployed in an untrusted execution environment. The communication between the key distribution management module and the key security processing module is transmitted through the proxy module. The key security processing module generates a key based on a quantum random number in a trusted execution environment, and generates a derived key in a trusted execution environment based on a root password or SBK (Secure boot key), and encrypts the key / password to be saved based on the derived key and then saves it. The trusted execution environment and the untrusted execution environment in the present invention may refer to the trusted execution environment and the rich execution environment in ARM TrustZone, the secure enclave (Enclaves) and the conventional application execution space (app li cat i on space) in Inter SGX, etc., and the embodiments of the present invention are not limited.

[0057] The present invention generates passwords / keys based on quantum random numbers in a trusted execution environment to enhance the randomness and unpredictability of passwords / keys, thereby greatly enhancing the security of passwords / keys; the identity credibility of the password application device receiving the target password is enhanced by encrypting / decrypting the identity authentication information in the trusted execution environment, thereby reducing the probability of the password being stolen by an illegal device; the session between the key distribution management module and the password application device is protected and identified by the session key and session token generated by the key security processing module in the trusted execution environment, thereby enhancing the security of the password distribution. The implementation of the present invention can improve the security of the password itself, improve the security of the password during the distribution process, and further improve the security of the data protected by the password. The following are detailed descriptions.

[0058] Embodiment 1

[0059] See also Figure 1 , Figure 1 : is a flowchart of a key distribution method applied to a quantum key management scenario disclosed in an embodiment of the present invention. Figure 1 The key distribution method described in the quantum key management scenario can be applied to various trusted execution environments and corresponding untrusted execution environments, and the embodiments of the present invention do not limit this. Figure 1As shown, the key distribution method applied in the quantum key management scenario may include the following operations:

[0060] 101. The key distribution management module receives an identity sent by a cryptographic application device, where the identity is used to uniquely identify a cryptographic application device in the network;

[0061] The identity identifier in this embodiment can be a MAC address, a CPU number, a device serial number, etc., which is not limited in the embodiment of the present invention. The password application device requests a target password, which can be a plain text password provided by the password application device and a target password after the plain text password is encrypted with a key; or the password application device does not provide any password and directly requests the generation of a target password; or it can be a target password queried in a memory according to the identity identifier, which is not limited in the embodiment of the present invention.

[0062] 102. The key distribution management module applies to the key security processing module for the identity authentication information of the password application device, and determines whether the password application device passes the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module sends the identity identifier to the key security processing module and applies for the target password matching the identity identifier. The key security processing module is deployed in the trusted execution environment, and the key distribution management module is deployed in the untrusted execution environment. The communication between the key security processing module and the key distribution management module is transmitted through the proxy module deployed in the untrusted execution environment.

[0063] In this embodiment, the identity authentication information includes an identity identifier, as well as one or more of a device model, a device asset number, a device serial number, a device MAC address, a device firmware version number, a device hardware version number, a device production date, a plain text password, and a device public key. When the cryptographic application device does not support asymmetric encryption, the device public key is empty or the identity authentication information does not include the device public key.

[0064] 103. The key security processing module sends the target password to the password application device through the key distribution management module.

[0065] In this optional embodiment, when the identity identifier does not match the password, or the password matched by the identity identifier is empty, the target password is the password generated by the key security processing module based on the quantum random number; when the identity identifier matches the password, the password is the target password.

[0066] It can be seen that this embodiment pre-stores identity authentication information in the trusted execution environment, and the identity information cannot be illegally tampered with. When the password application device needs to apply for a key / password, it needs to compare its own identity information to be verified with the identity authentication information obtained through the proxy module. When the comparison is consistent, the identity identifier sent by the password application device is sent to the key security processing module through the proxy module to obtain the target password. By authenticating the password application device, the probability of the password being obtained by a third party is reduced, the security of the password in the distribution process is improved, and the security of the data protected by the password is further improved.

[0067] In an optional embodiment, determining whether the password application device passes the identity authentication based on the identity authentication information includes:

[0068] The key distribution management module calculates the session token and the identity authentication information according to a predefined hash function to obtain a hash value of the cryptographic application device. The session token is generated by the key security processing module based on quantum random numbers. The session token is used to identify the session between the key distribution management module and the cryptographic application device.

[0069] The key distribution management module compares whether the hash value of the cryptographic application device is equal to the hash value to be verified. If they are equal, the cryptographic application device passes the identity authentication; if they are not equal, the cryptographic application device fails the identity authentication;

[0070] The hash value to be verified is obtained in the following way:

[0071] The password application device calculates its device information and the session token according to a predefined hash function to obtain a hash value to be verified, and the device information is the same as the key value in the identity verification information;

[0072] The cryptographic application device uses the encryption key to encrypt the hash value to be verified and sends it to the key distribution management module. The key distribution management module uses the decryption key corresponding to the encryption key to decrypt the hash value to obtain the hash value to be verified.

[0073] When the cryptographic application device supports asymmetric encryption, the encryption key and decryption key refer to the device private key and device public key; when the cryptographic application device does not support asymmetric encryption, the encryption key and decryption key both refer to the session key between the cryptographic application device and the key distribution management module.

[0074] In this optional embodiment, the session token refers to the session token of the session between the cryptographic application device and the key distribution management module. The same key value in the device information and the identity authentication information specifically means that the keys in the device information and the identity authentication information must be the same, and the device information and the identity authentication information can be split into several key-value pairs with the same key value according to a predefined format. Comparing whether the hash value of the cryptographic application device is equal to the hash value to be verified means comparing whether the key-value pairs split from the device information and the identity authentication information are exactly the same.

[0075] It can be seen that this optional embodiment combines the session token generated by quantum random numbers and the unique hash value calculated by the hash function for the identity authentication information to strictly verify the identity of the password application device; the session token generated based on quantum random numbers ensures the uniqueness and unpredictability of each session, while the irreversible nature of the hash function ensures the confidentiality of the identity authentication information, improves the security of the password during the distribution process, and further improves the security of the data protected by the password.

[0076] Embodiment 2

[0077] See also Figure 2 , Figure 2 : is a flow chart of another key distribution method applied to quantum key management scenario disclosed in an embodiment of the present invention. Figure 2 The key distribution method described in the quantum key management scenario can be applied to various trusted execution environments and corresponding untrusted execution environments, and the embodiments of the present invention do not limit this. Figure 2 As shown, the key distribution method applied in the quantum key management scenario may include the following operations:

[0078] 201. The key distribution management module receives a new session request from a cryptographic application device;

[0079] 202. The key distribution management module applies for a session key and a session token from the key security processing module;

[0080] In this embodiment, the session key and the session token both correspond to the session between the cryptographic application device and the key distribution management module.

[0081] 203. The key security processing module generates a session key and a session token based on the quantum random number, and sends them to the key distribution management module;

[0082] In this embodiment, the session key and session token can be generated based on the same quantum random number or different quantum random numbers; they can be generated using the same algorithm or different algorithms, and the embodiment of the present invention does not impose any restrictions.

[0083] 204. The key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, and triggers the key distribution management module to receive the identity identifier sent by the cryptographic application device;

[0084] 205. The key distribution management module receives an identity sent by the cryptographic application device, where the identity is used to uniquely identify a cryptographic application device in the network;

[0085] 206. The key distribution management module applies to the key security processing module for the identity authentication information of the password application device, and determines whether the password application device passes the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module sends the identity identifier to the key security processing module and applies for the target password matching the identity identifier. The key security processing module is deployed in the trusted execution environment, and the key distribution management module is deployed in the untrusted execution environment. The communication between the key security processing module and the key distribution management module is transmitted through the proxy module deployed in the untrusted execution environment.

[0086] 207. The key security processing module sends the target password to the password application device through the key distribution management module.

[0087] In the embodiment of the present invention, for the description of steps 205-207, please refer to the detailed description of steps 101-103 in the first embodiment, which will not be repeated here.

[0088] It can be seen that this optional embodiment requires that each time the password application device requests a new target password, it first applies for a new session, which ensures that each password request is made in a new, independent session environment, thereby reducing the risk of the password being intercepted or reused in multiple sessions; the session key and session token inherit the characteristics of quantum uncertainty, and have a high degree of randomness and unpredictability. Such high-entropy keys and tokens are essential for resisting exhaustive attacks and predictive attacks; and the session key and session token are encrypted by the key distribution management module and sent to the password application device, preventing potential eavesdroppers from obtaining the session key and token, and preventing man-in-the-middle attacks; the identity authentication information is pre-stored in the trusted execution environment, and the identity information cannot be illegally tampered with. When the password application device needs to apply for a key / password, it needs to compare its own identity information to be verified with the identity authentication information obtained through the proxy module. When the comparison is consistent, the identity identification sent by the password application device is sent to the key security processing module through the proxy module to obtain the target password. By authenticating the password application device, the probability of the password being obtained by a third party is reduced, the security of the password in the distribution process is improved, and the security of the data protected by the password is further improved.

[0089] In an optional embodiment, when the cryptographic application device supports asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0090] The key distribution management module uses the business management private key to encrypt the session key and session token, and sends the encrypted session key and session token to the cryptographic application device through an asymmetric cryptographic transmission protocol. The encrypted session key and session token will be decrypted in the cryptographic application device using the business management public key. The business management private key and business management public key refer to the asymmetric keys pre-generated by the key security processing module for the key distribution management module.

[0091] In this optional embodiment, the asymmetric cryptographic transmission protocol may be a DH protocol, an ECDH protocol, or any other asymmetric cryptographic transmission protocol, and the embodiment of the present invention does not limit this.

[0092] It can be seen that in this optional embodiment, the key distribution management module uses a private key to encrypt the session key and session token, which can only be decrypted by the paired public key, thereby ensuring the confidentiality of the information during transmission. Because the private key is not transmitted over the network, attackers who intercept the encrypted data cannot decrypt it, ensuring that even if the data is intercepted, the session key and session token will not be leaked. The asymmetric encryption authentication function further defends against man-in-the-middle attacks and significantly improves the security of password distribution.

[0093] In another optional embodiment, when the cryptographic application device does not support asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0094] The key distribution management module sends the session token to the cryptographic application device;

[0095] The key distribution management module receives a temporary key sent by the cryptographic application device, where the temporary key is generated by the cryptographic application device based on a session token and a plaintext password;

[0096] The key distribution management module obtains the quantum session key from the key security processing module, encrypts the quantum session key based on the temporary key and sends it to the cryptographic application device;

[0097] The quantum session key is used as the session key after being decrypted by the cryptographic application device using a temporary key.

[0098] It can be seen that in this optional embodiment, the cryptographic application device receives the session token and generates a temporary key in combination with the plaintext password. The temporary key is used to encrypt the session key generated based on the quantum random number and then securely transmitted back to the device. Because the temporary key is random and one-time, even if the temporary key is leaked, the session key cannot be predicted, thereby protecting the security of the key distribution process.

[0099] In yet another optional embodiment, before the key distribution management module receives a new session request from the cryptographic application device, the key distribution method applied in the quantum key management scenario further includes:

[0100] The key distribution management module receives the identity authentication information;

[0101] The key distribution management module sends the identity authentication information to the key security processing module;

[0102] The key security processing module encrypts the identity authentication information with a trusted key and sends it to the key distribution management module, and triggers the key distribution management module to receive a new session request from the cryptographic application device. The trusted key is a key that can only be accessed in the trusted execution environment.

[0103] And, the key distribution management module applies to the key security processing module for the identity authentication information of the password application device, including:

[0104] The key distribution management module sends the encrypted identity authentication information to the key security processing module, and the key security processing module decrypts it and sends it to the key distribution management module.

[0105] In this optional embodiment, the trusted password refers to a password that can only be accessed in a trusted execution environment, such as a root password or an SBK or a derived key generated based on the SBK. The key distribution management module receives the identity authentication information, which can be the identity authentication information of the password application device filled in by the administrator through the management interface of the business management module, and the embodiment of the present invention does not limit this.

[0106] It can be seen that in this optional embodiment, the key distribution management module receives the identity authentication information from the cryptographic application device and sends it to the key security processing module. The key security processing module uses a trusted key to encrypt the identity authentication information to prevent the memory from being attacked and causing the leakage of the identity authentication information. The identity authentication information is returned to the key distribution management module, which initiates the identity authentication of the cryptographic application device, thereby improving the credibility of the identity security of the cryptographic application device, improving the security of the password during the distribution process, and further improving the security of the information.

[0107] In yet another optional embodiment, the key distribution method applied in the quantum key management scenario further includes:

[0108] The key distribution management module destroys the business management private key and the business management public key before the end of the life cycle.

[0109] It can be seen that this optional embodiment can reduce the probability of unauthorized use or leakage of old keys, reduce the potential security risks caused by leakage of old keys, and enhance the overall password distribution security.

[0110] In yet another optional embodiment, the key distribution method applied in the quantum key management scenario further includes:

[0111] When the session between the key distribution management module and the cryptographic application device ends / closes, or the cryptographic business module does not receive a response from the cryptographic application device within a predetermined time, the key distribution management module will destroy the session key and session token and close the session communication link.

[0112] It can be seen that this optional embodiment destroys the session key and session token and closes the communication link, which can reduce the possibility of old sessions being maliciously exploited and enhance the security of password distribution.

[0113] In yet another optional embodiment, the key distribution method applied in the quantum key management scenario further includes:

[0114] The key distribution management module updates the session key between the key distribution management module and the password application device according to a predetermined session password update strategy.

[0115] It can be seen that this optional embodiment can reduce the key exposure time by strategically replacing the key, reduce the possibility of security vulnerabilities caused by long-term use of the same key, thereby strengthening the security of the key in the quantum key management system and further improving the security of the password during the distribution process.

[0116] In yet another optional embodiment, the key distribution method applied in the quantum key management scenario further includes:

[0117] When the target password needs to be transmitted between the password application device and another password application device, determining whether the password application device and the other password application device both support asymmetric encryption;

[0118] If the result of the determination is yes, the target password is transmitted between the password application device and another password application device through an asymmetric password transmission protocol;

[0119] If the judgment result is no, the key distribution management module receives the identity of the password application device sent by another password application device, sends the identity to the key security processing module to request the target password, and sends the target password to another password application device.

[0120] In this optional embodiment, the identity authentication steps of another password application device and the steps of establishing a session between it and the key distribution management module are the same as those of the password application device. After receiving the identity identifier, the trusted password execution module returns a target password that matches the identity identifier.

[0121] It can be seen that this optional embodiment verifies the identity of the requester through an asymmetric transmission protocol or allows the key distribution management module to reduce the possibility of another password application device that has not passed the verification obtaining the target password, thereby enhancing the security of the password distribution process.

[0122] Embodiment 3

[0123] See also Figure 3 , Figure 3 : is a schematic diagram of a key distribution device used in a quantum key management scenario disclosed in an embodiment of the present invention. Figure 3 The device shown can be applied to various trusted execution environments and corresponding untrusted execution environments, and the embodiments of the present invention do not limit this. Figure 3 The device shown includes: a key security processing module 301, an agent module 302 and a key distribution management module 303;

[0124] The key distribution management module 303 is used to receive an identity sent by a cryptographic application device, where the identity is used to uniquely identify a cryptographic application device in the network;

[0125] The key distribution management module 303 is further used to apply for the identity authentication information of the password application device from the key security processing module 301, and determine whether the password application device has passed the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module 303 is further used to send an identity identifier to the key security processing module 301 and apply for a target password matching the identity identifier. The key security processing module 301 is deployed in a trusted execution environment, and the key distribution management module 303 is deployed in a non-trusted execution environment. The communication between the key security processing module 301 and the key distribution management module 303 is transmitted through the proxy module 302 deployed in the non-trusted execution environment.

[0126] The proxy module 302 is used to proxy all communication information between the key security processing module 301 and the key distribution management module 303. The proxy module 302 is deployed in a non-trusted execution environment;

[0127] The key security processing module 301 is used to send the target password to the password application device through the key distribution management module 303.

[0128] In this embodiment, the identity authentication information includes an identity identifier, as well as one or more of a device model, a device asset number, a device serial number, a device MAC address, a device firmware version number, a device hardware version number, a device production date, a plain text password, and a device public key. When the cryptographic application device does not support asymmetric encryption, the device public key is empty or the identity authentication information does not include the device public key.

[0129] It can be seen that this embodiment pre-stores identity authentication information in the trusted execution environment, and the identity information cannot be illegally tampered with. When the password application device needs to apply for a key / password, it needs to compare its own identity information to be verified with the identity authentication information obtained through the proxy module. When the comparison is consistent, the identity identifier sent by the password application device is sent to the key security processing module through the proxy module to obtain the target password. By authenticating the password application device, the probability of the password being obtained by a third party is reduced, the security of the password in the distribution process is improved, and the security of the data protected by the password is further improved.

[0130] In an optional embodiment, determining whether the password application device passes the identity authentication based on the identity authentication information includes:

[0131] The key distribution management module 303 calculates the session token and the identity authentication information according to a predefined hash function to obtain a hash value of the cryptographic application device. The session token is generated by the key security processing module 301 based on quantum random numbers. The session token is used to identify the session between the key distribution management module 303 and the cryptographic application device.

[0132] The key distribution management module 303 compares the hash value of the cryptographic application device with the hash value to be verified to see if they are equal. If they are equal, the cryptographic application device passes the identity authentication; if they are not equal, the cryptographic application device fails the identity authentication;

[0133] The hash value to be verified is obtained in the following way:

[0134] The password application device calculates its device information and the session token according to a predefined hash function to obtain a hash value to be verified, and the device information is the same as the key value in the identity verification information;

[0135] The cryptographic application device uses the encryption key to encrypt the hash value to be verified and sends it to the key distribution management module 303. The key distribution management module 303 uses the decryption key corresponding to the encryption key to decrypt the hash value to obtain the hash value to be verified.

[0136] When the cryptographic application device supports asymmetric encryption, the encryption key and decryption key refer to the device private key and device public key; when the cryptographic application device does not support asymmetric encryption, the encryption key and decryption key both refer to the session key between the cryptographic application device and the key distribution management module 303.

[0137] It can be seen that this optional embodiment combines the session token generated by quantum random numbers and the unique hash value calculated by the hash function for the identity authentication information to strictly verify the identity of the password application device; the session token generated based on quantum random numbers ensures the uniqueness and unpredictability of each session, while the irreversible nature of the hash function ensures the confidentiality of the identity authentication information, improves the security of the password during the distribution process, and further improves the security of the data protected by the password.

[0138] In another optional embodiment, the key distribution management module 303 is further configured to receive a new session request from the cryptographic application device before the key distribution management module 303 receives the identity sent by the cryptographic application device;

[0139] The key distribution management module 303 is also used to apply for a session key and a session token from the key security processing module 301;

[0140] The key security processing module 301 is also used to generate a session key and a session token based on quantum random numbers, and send them to the key distribution management module 303;

[0141] The key distribution management module 303 is also used to encrypt the session key and the session token and send them to the cryptographic application device, and trigger the key distribution management module 303 to receive the identity identifier sent by the cryptographic application device.

[0142] It can be seen that this optional embodiment requires that each time the password application device requests a new target password, it first applies for a new session, which ensures that each password request is made in a new, independent session environment, thereby reducing the risk of the password being intercepted or reused in multiple sessions; the session key and session token inherit the characteristics of quantum uncertainty and are highly random and unpredictable. Such high-entropy keys and tokens are essential for resisting exhaustive attacks and predictive attacks; and the session key and session token are encrypted by the key distribution management module and sent to the password application device, preventing potential eavesdroppers from obtaining the session key and token, preventing man-in-the-middle attacks, and improving the security of the password during the distribution process.

[0143] In another optional embodiment, when the cryptographic application device supports asymmetric encryption, the key distribution management module 303 encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0144] The key distribution management module 303 uses the business management private key to encrypt the session key and session token, and sends the encrypted session key and session token to the cryptographic application device through an asymmetric cryptographic transmission protocol. The encrypted session key and session token will be decrypted in the cryptographic application device using the business management public key. The business management private key and business management public key refer to the asymmetric key pre-generated by the key security processing module 301 for the key distribution management module.

[0145] It can be seen that in this optional embodiment, the key distribution management module 303 uses a private key to encrypt the session key and session token, which can only be decrypted by the paired public key, thereby ensuring the confidentiality of the information during transmission. Because the private key is not transmitted over the network, an attacker who intercepts the encrypted data cannot decrypt it, ensuring that even if the data is intercepted, the session key and session token will not be leaked. The asymmetric encryption authentication function further defends against man-in-the-middle attacks and significantly improves the security of password distribution.

[0146] In another optional embodiment, when the cryptographic application device does not support asymmetric encryption, the key distribution management module 303 encrypts the session key and the session token and sends them to the cryptographic application device, including:

[0147] The key distribution management module 303 sends the session token to the password application device;

[0148] The key distribution management module 303 receives a temporary key sent by the cryptographic application device, where the temporary key is generated by the cryptographic application device based on the session token and the plaintext password;

[0149] The key distribution management module 303 obtains the quantum session key from the key security processing module 301, encrypts the quantum session key based on the temporary key and sends it to the cryptographic application device;

[0150] The quantum session key is used as the session key after being decrypted by the cryptographic application device using a temporary key.

[0151] It can be seen that in this optional embodiment, the cryptographic application device receives the session token and generates a temporary key in combination with the plaintext password. The temporary key is used to encrypt the session key generated based on the quantum random number and then securely transmitted back to the device. Because the temporary key is random and one-time, even if the temporary key is leaked, the session key cannot be predicted, thereby protecting the security of the key distribution process.

[0152] In yet another optional embodiment, the key distribution management module 303 is further configured to receive identity authentication information before the key distribution management module 303 receives a new session request from the cryptographic application device;

[0153] The key distribution management module 303 is also used to send the identity authentication information to the key security processing module 301;

[0154] The key security processing module 301 is further used to encrypt the identity authentication information using the trusted key and then send it to the key distribution management module 303, and trigger the key distribution management module 303 to receive a new session request from the cryptographic application device. The trusted key is a key that can only be accessed in the trusted execution environment;

[0155] And, the key distribution management module 303 applies to the key security processing module 301 for the identity authentication information of the password application device, including:

[0156] The key distribution management module 303 sends the encrypted identity authentication information to the key security processing module 301 , and the key security processing module 301 decrypts the information and sends it to the key distribution management module 303 .

[0157] It can be seen that in this optional embodiment, the key distribution management module 303 receives the identity authentication information from the cryptographic application device, and sends it to the key security processing module 301. The key security processing module 301 uses a trusted key to encrypt the identity authentication information to prevent the memory from being attacked and causing the leakage of the identity authentication information; the identity authentication information is returned to the key distribution management module 303, which initiates the identity authentication of the cryptographic application device, thereby improving the credibility of the identity security of the cryptographic application device, improving the security of the password during the distribution process, and further improving the security of the information.

[0158] In yet another optional embodiment, the key distribution management module 303 is further configured to destroy the business management private key and the business management public key before the end of the life cycle.

[0159] It can be seen that this optional embodiment can reduce the probability of unauthorized use or leakage of old keys, reduce the potential security risks caused by leakage of old keys, and enhance the overall password distribution security.

[0160] In another optional embodiment, when the session between the key distribution management module 303 and the cryptographic application device ends / closes, or the cryptographic business module 303 does not receive a response from the cryptographic application device within a predetermined time, the key distribution management module 303 is also used to destroy the session key and session token and close the session communication link.

[0161] It can be seen that this optional embodiment destroys the session key and session token and closes the communication link, which can reduce the possibility of old sessions being maliciously exploited and enhance the security of password distribution.

[0162] In yet another optional embodiment, the key distribution management module 303 is further used to update the session key between the key distribution management module 303 and the password application device according to a predetermined session password update policy.

[0163] It can be seen that this optional embodiment can reduce the key exposure time by strategically replacing the key, reduce the possibility of security vulnerabilities caused by long-term use of the same key, thereby strengthening the security of the key in the quantum key management system and further improving the security of the password during the distribution process.

[0164] In yet another optional embodiment, Figure 4 As shown, the key distribution device applied in the quantum key management scenario also includes:

[0165] A determination module 304, used to determine whether the password application device and another password application device both support asymmetric encryption when the target password needs to be transmitted between the password application device and another password application device;

[0166] The transmission module 305 is used to transmit the target password between the password application device and another password application device through an asymmetric password transmission protocol when the judgment result of the judgment module 304 is yes;

[0167] The key distribution management module 303 is also used to receive the identity of the password application device sent by another password application device when the judgment result of the judgment module 304 is no, send the identity to the key security processing module 301 to request the target password, and send the target password to another password application device.

[0168] In this optional embodiment, the identity authentication steps of another password application device and the steps of establishing a session between it and the key distribution management module 303 are the same as those of the password application device. After receiving the identity identifier, the trusted password execution module 301 returns the target password matching the identity identifier.

[0169] It can be seen that this optional embodiment verifies the identity of the requester through an asymmetric transmission protocol or allows the key distribution management module to reduce the possibility of another password application device that has not passed the verification obtaining the target password, thereby enhancing the security of the password distribution process.

[0170] Embodiment 4

[0171] See also Figure 5 , Figure 5 FIG. 1 is a schematic diagram of the structure of another key distribution device used in a quantum key management scenario disclosed in an embodiment of the present invention. Figure 5 As shown, the key distribution device applied in the quantum key management scenario may include:

[0172] A memory 501 storing executable program codes;

[0173] a processor 502 coupled to the memory 501;

[0174] Furthermore, it may also include an input interface 503 and an output interface 504 coupled to the processor 502;

[0175] The processor 502 calls the executable program code stored in the memory 501 to execute the steps of the key distribution method applied to the quantum key management scenario described in Embodiment 1 or Embodiment 2 of the present invention.

[0176] Embodiment 5

[0177] An embodiment of the present invention discloses a quantum key management system, which stores computer instructions. When the computer instructions are called, they are used to execute the steps of the key distribution method applied to the quantum key management scenario described in Embodiment 1 or Embodiment 2 of the present invention.

[0178] Embodiment 6

[0179] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute the steps of the key distribution method applied to a quantum key management scenario described in Embodiment 1 or Embodiment 2.

[0180] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0181] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware. Based on such an understanding, the above-mentioned technical solution can essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0182] Finally, it should be noted that the key distribution method, device and system applied to the quantum key management scenario disclosed in the embodiments of the present invention are only the preferred embodiments of the present invention, which are only used to illustrate the technical scheme of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical schemes described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical schemes from the spirit and scope of the technical schemes of the embodiments of the present invention.

Claims

1. A key distribution method applied in a quantum key management scenario, characterized in that: The method comprises: The key distribution management module receives an identity sent by a cryptographic application device, wherein the identity is used to uniquely identify a cryptographic application device in the network; The key distribution management module applies to the key security processing module for the identity authentication information of the password application device, and determines whether the password application device has passed the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module sends the identity identifier to the key security processing module and applies for a target password matching the identity identifier. The key security processing module is deployed in a trusted execution environment, and the key distribution management module is deployed in a non-trusted execution environment. The communication between the key security processing module and the key distribution management module is transmitted through a proxy module deployed in the non-trusted execution environment. The key security processing module sends the target password to the password application device through the key distribution management module; Furthermore, before the key distribution management module receives the identity sent by the password application device, the method further includes: The key distribution management module receives the identity authentication information; The key distribution management module sends the identity authentication information to the key security processing module; The key security processing module encrypts the identity authentication information using a trusted key and then sends the encrypted information to the key distribution management module; the trusted key is a key that can only be accessed in a trusted execution environment; And, the key distribution management module applies to the key security processing module for the identity authentication information of the password application device, including: The key distribution management module sends the encrypted identity authentication information to the key security processing module, and the key security processing module decrypts the information and sends it to the key distribution management module.

2. The key distribution method applied to quantum key management scenario according to claim 1, characterized in that: The identity authentication information includes: the identity identifier, and one or more of the device model, device asset number, device serial number, device MAC address, device firmware version number, device hardware version number, device production date, plain text password, and device public key. When the cryptographic application device does not support asymmetric encryption, the device public key is empty or the identity authentication information does not include the device public key.

3. The key distribution method applied to quantum key management scenarios according to claim 2 is characterized in that: The determining whether the password application device passes the identity authentication based on the identity authentication information includes: The key distribution management module calculates the session token and the identity authentication information according to a predefined hash function to obtain a hash value of the cryptographic application device. The session token is generated by the key security processing module based on a quantum random number, and the session token is used to identify the session between the key distribution management module and the cryptographic application device; The key distribution management module compares the hash value of the cryptographic application device with the hash value to be verified to see if they are equal. If they are equal, the cryptographic application device passes the identity authentication; if they are not equal, the cryptographic application device fails the identity authentication; The hash value to be verified is obtained in the following way: The password application device calculates its device information and the session token according to the predefined hash function to obtain a hash value to be verified, and the device information is the same as the key value in the identity verification information; The cryptographic application device uses an encryption key to encrypt the hash value to be verified and then sends it to the key distribution management module, and the key distribution management module uses a decryption key corresponding to the encryption key to decrypt the hash value to obtain the hash value to be verified; When the cryptographic application device supports asymmetric encryption, the encryption key and the decryption key refer to the device private key and the device public key; when the cryptographic application device does not support asymmetric encryption, the encryption key and the decryption key both refer to the session key between the cryptographic application device and the key distribution management module.

4. The key distribution method applied to quantum key management scenario according to claim 3 is characterized in that: Before the key distribution management module receives the identity sent by the password application device, the method further includes: The key distribution management module receives a new session request from the cryptographic application device; The key distribution management module applies for a session key and a session token from the key security processing module; The key security processing module generates a session key and a session token based on quantum random numbers, and sends them to the key distribution management module; The key distribution management module encrypts the session key and the session token and sends them to the password application device, and triggers the key distribution management module to receive the identity identifier sent by the password application device.

5. The key distribution method applied to quantum key management scenario according to claim 4 is characterized in that: When the cryptographic application device supports asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including: The key distribution management module uses the business management private key to encrypt the session key and session token, and sends the encrypted session key and session token to the cryptographic application device through an asymmetric cryptographic transmission protocol. The encrypted session key and session token will be decrypted in the cryptographic application device using the business management public key. The business management private key and the business management public key refer to the asymmetric keys pre-generated by the key security processing module for the key distribution management module.

6. The key distribution method applied to quantum key management scenarios according to claim 4 is characterized in that: When the cryptographic application device does not support asymmetric encryption, the key distribution management module encrypts the session key and the session token and sends them to the cryptographic application device, including: The key distribution management module sends the session token to the password application device; The key distribution management module receives a temporary key sent by the password application device, where the temporary key is generated by the password application device based on a session token and the plaintext password; The key distribution management module obtains the quantum session key from the key security processing module, encrypts the quantum session key based on the temporary key and sends it to the cryptographic application device; The quantum session key is used as a session key after being decrypted by the cryptographic application device using the temporary key.

7. A key distribution device used in a quantum key management scenario, characterized in that: The device comprises: a key distribution management module, an agent module and a key security processing module; The key distribution management module is used to receive an identity sent by a cryptographic application device, where the identity is used to uniquely identify a cryptographic application device in the network; The key distribution management module is further used to apply for the identity authentication information of the password application device from the key security processing module, and determine whether the password application device has passed the identity authentication based on the identity authentication information. When the identity authentication is passed, the key distribution management module is further used to send the identity identifier to the key security processing module and apply for a target password matching the identity identifier. The key security processing module is deployed in a trusted execution environment, and the key distribution management module is deployed in a non-trusted execution environment. The proxy module is used to proxy all communication information between the key security processing module and the key distribution management module, and the proxy module is deployed in a non-trusted execution environment; The key security processing module is used to send the target password to the password application device through the key distribution management module; And, the key distribution management module is further used to receive identity authentication information before the key distribution management module receives the identity identifier sent by the password application device; The key distribution management module is further used to send identity authentication information to the key security processing module; The key security processing module is further used to encrypt the identity authentication information using a trusted key and then send it to the key distribution management module, where the trusted key is a key that can only be accessed in a trusted execution environment; And, the key distribution management module applies to the key security processing module for the identity authentication information of the password application device, including: The key distribution management module sends the encrypted identity authentication information to the key security processing module, and the key security processing module decrypts it and sends it to the key distribution management module.

8. A key distribution device used in a quantum key management scenario, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the key distribution method applied to the quantum key management scenario as described in any one of claims 1 to 6.

9. A quantum key management system, characterized in that: The quantum key management system stores computer instructions, which, when called, are used to execute the key distribution method applied to the quantum key management scenario as described in any one of claims 1 to 6.

Images