Method, device and equipment for digital key interaction with fused quantum keys and medium

Abstract

The application relates to a digital key interaction method, device and equipment fusing quantum keys and a medium, wherein the method comprises the following steps: establishing a secure communication channel between a first communication object and a second communication object, and exchanging digital certificates in the secure communication channel to verify the identities of the first communication object and the second communication object; generating a session key according to a master key, and detecting whether the first communication object and the second communication object meet a preset digital key interaction condition according to the session key; updating the session key according to a preset condition to obtain an update result, deriving a sub-key from the master key according to the update result and a preset key derivation mechanism, updating the session key according to the sub-key to obtain a digital key interaction result. The application adopts a new key derivation mechanism, which can effectively improve the security and randomness of the key, reduce the storage and transmission overhead of the key, and is suitable for resource-limited devices and low-delay scenes.

Description

Technical Field

[0001] This application relates to the field of vehicle networking technology, and in particular to a digital key interaction method, device, equipment and medium that integrates quantum key distribution. Background Technology

[0002] Symmetric cryptography is a cryptographic system where encryption and decryption use the same key or mutually derivable keys. It boasts advantages such as fast encryption speed, simple algorithms, and low resource consumption, and is widely used in data security, authentication, and message authentication codes. A crucial issue with symmetric cryptography is key distribution and management. Digital key exchange protocols (DKEP) are protocols used to implement key distribution and management in symmetric cryptography. They utilize technologies such as digital signatures, digital certificates, random numbers, and timestamps to achieve functions like authentication, key negotiation, and key updates between communicating parties. A typical application scenario for DKEP is car digital keys, which enable remote control, keyless entry, and keyless start of a vehicle via a smartphone or other device.

[0003] In related technologies, when transmitting messages between a client and a server, the key in the key pool can be used to add an offset to the encryption parameters, making it difficult for a quantum computer to crack the encryption parameters during transmission and ensuring key updates.

[0004] However, the related technologies expose the master key information during the key update process, making it difficult to improve the security and randomness of the key, making them unsuitable for resource-constrained devices, and easily leading to data leakage and abuse, which urgently needs to be improved. Summary of the Invention

[0005] This application provides a digital key interaction method, apparatus, device, and medium that integrates quantum keys to solve the problems of related technologies exposing master key information during key update, making it difficult to improve key security and randomness, making them unsuitable for resource-constrained devices, and easily causing data leakage and abuse.

[0006] The first aspect of this application provides a digital key interaction method integrating quantum key distribution, comprising the following steps: establishing a secure communication channel between a first communication object and a second communication object, exchanging digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object, and obtaining a final verification result; obtaining a master key that satisfies preset sharing conditions based on the final verification result and a quantum key distribution protocol, generating a session key based on the master key, and detecting whether the first communication object and the second communication object satisfy preset digital key interaction conditions based on the session key; if the first communication object and the second communication object satisfy the preset digital key interaction conditions, updating the session key according to the preset conditions, obtaining an update result, and deriving a subkey from the master key based on the update result and a preset key derivation mechanism, updating the session key based on the subkey, and obtaining a digital key interaction result.

[0007] Optionally, in one embodiment of this application, before exchanging digital certificates in the secure communication channel to verify the identities of the first communication object and the second communication object, the method further includes: obtaining public-private key pairs corresponding to the first communication object and the second communication object; obtaining at least one of the following information based on the public-private key pairs: information of the public key holder, public key, validity period, and issuing authority; and obtaining the digital certificate based on the at least one of the following information.

[0008] Optionally, in one embodiment of this application, the step of exchanging digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object and obtain a final verification result includes: receiving digital certificates of the first communication object and the second communication object within the secure communication channel, and verifying the digital signature and validity period in the digital certificates to obtain a first verification result; based on the first verification result, using the public key to verify the identities of the first communication object and the second communication object to obtain a second verification result; and obtaining the final verification result based on the first verification result and the second verification result.

[0009] Optionally, in one embodiment of this application, updating the session key according to preset conditions to obtain an update result includes: updating the session key according to at least one of time interval, number of communications, and communication status to generate a new session key; using the session key to decrypt and encrypt the new session key so that the new session key meets preset secure transmission conditions, thereby obtaining the update result.

[0010] Optionally, in one embodiment of this application, the step of deriving a subkey from the master key according to the update result and a preset key derivation mechanism includes: performing a hash operation on the master key according to the update result and a hash chain-based key derivation mechanism to obtain a first subkey; iterating on the first subkey until a preset iteration stop condition is met, stopping the iteration, and obtaining the subkey.

[0011] Optionally, in one embodiment of this application, after obtaining the digital key interaction result, the method further includes: disconnecting the secure communication channel to terminate the secure communication between the first communication object and the second communication object; and processing the master key, the session key, the subkey, and the digital certificate to obtain a processing result.

[0012] A second aspect of this application provides a digital key interaction device integrating quantum key distribution, comprising: an establishment module, configured to establish a secure communication channel between a first communication object and a second communication object, and exchange digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object, thereby obtaining a final verification result; a detection module, configured to obtain a master key that satisfies preset sharing conditions based on the final verification result and a quantum key distribution protocol, generate a session key based on the master key, and detect whether the first communication object and the second communication object satisfy preset digital key interaction conditions based on the session key; and an interaction module, configured to, upon detecting that the first communication object and the second communication object satisfy the preset digital key interaction conditions, update the session key according to preset conditions, obtain an update result, and derive a subkey from the master key based on the update result and a preset key derivation mechanism, thereby updating the session key based on the subkey, and obtaining a digital key interaction result.

[0013] Optionally, in one embodiment of this application, it further includes: a first acquisition module, configured to acquire a public-private key pair corresponding to the first communication object and the second communication object before exchanging digital certificates in the secure communication channel to verify the identities of the first communication object and the second communication object; and a second acquisition module, configured to obtain at least one of the following information based on the public-private key pair: information of the public key holder, public key, validity period, and issuing authority, and obtain the digital certificate based on the at least one of the following information.

[0014] Optionally, in one embodiment of this application, the establishment module includes: a receiving unit, configured to receive digital certificates of the first communication object and the second communication object within the secure communication channel, and verify the digital signature and validity period in the digital certificates to obtain a first verification result; a verification unit, configured to verify the identities of the first communication object and the second communication object using the public key based on the first verification result to obtain a second verification result; and a first obtaining unit, configured to obtain the final verification result based on the first verification result and the second verification result.

[0015] Optionally, in one embodiment of this application, the interaction module includes: an update unit, configured to update the session key according to at least one of a time interval, a number of communications, and a communication status, to generate a new session key; and a second acquisition unit, configured to use the session key to decrypt and encrypt the new session key, so that the new session key meets a preset secure transmission condition, and obtain the update result.

[0016] Optionally, in one embodiment of this application, the interaction module further includes: a calculation unit, configured to perform a hash operation on the master key based on the update result and a key derivation mechanism based on a hash chain to obtain a first subkey; and an iteration unit, configured to iterate on the first subkey until a preset iteration stop condition is met, thereby stopping the iteration and obtaining the subkey.

[0017] Optionally, in one embodiment of this application, it further includes: a termination module, configured to disconnect the secure communication channel after obtaining the digital key interaction result, so as to terminate the secure communication between the first communication object and the second communication object; and a processing module, configured to process the master key, the session key, the subkey and the digital certificate to obtain a processing result.

[0018] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the digital key interaction method with fused quantum keys as described in the above embodiments.

[0019] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the digital key interaction method for fused quantum keys as described above.

[0020] A fifth aspect of this application provides a computer program product that stores a computer program that, when executed by a processor, implements the digital key interaction method for fused quantum keys as described above.

[0021] This application employs a hash chain-based key derivation mechanism to derive a series of subkeys from a master key and use these subkeys to update the session key. This effectively improves key security and randomness while reducing key storage and transmission overhead, making it suitable for resource-constrained devices and low-latency scenarios. Therefore, it solves the problems of related technologies exposing master key information during key updates, making it difficult to improve key security and randomness, unsuitable for resource-constrained devices, and prone to data leakage and misuse.

[0022] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0023] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0024] Figure 1 This is a flowchart of a digital key interaction method incorporating quantum keys according to an embodiment of this application;

[0025] Figure 2 This is a diagram illustrating the authentication process (mobile phone-vehicle) of a digital key interaction method incorporating quantum keys according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of the steps of a digital key interaction method incorporating quantum keys according to an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of a digital key interaction device incorporating quantum keys according to an embodiment of this application;

[0028] Figure 5 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0029] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0030] The following description, with reference to the accompanying drawings, outlines a digital key interaction method, apparatus, device, and medium integrating quantum key distribution (QKD) according to embodiments of this application. Addressing the issues raised in the background section regarding the exposure of master key information during key updates, which hinders key security and randomness, makes the method unsuitable for resource-constrained devices, and increases the risk of data leakage and misuse, this application provides a QKD-integrated digital key interaction method. This method employs a hash chain-based key derivation mechanism to derive a series of subkeys from the master key. These subkeys are then used to update the session key, effectively improving key security and randomness while reducing key storage and transmission overhead. This method is suitable for resource-constrained devices and low-latency scenarios. Therefore, it solves the problems of related technologies exposing master key information during key updates, hindering key security and randomness, making them unsuitable for resource-constrained devices, and increasing the risk of data leakage and misuse.

[0031] Specifically, Figure 1 This is a flowchart illustrating a digital key interaction method incorporating quantum keys, provided in an embodiment of this application.

[0032] Before introducing the digital key interaction method integrating quantum keys proposed in the embodiments of this application, let's first introduce the relevant background:

[0033] Commonly used algorithms in symmetric cryptography include DES (Data Encryption Standard), AES (Advanced Encryption Standard), and SM4 (block cipher algorithm). These are all based on block cipher design, which involves dividing plaintext into fixed-length blocks and then encrypting and decrypting each block. The security of a block cipher depends on factors such as key length, block size, number of encryption rounds, and the complexity of the round function. A common attack on block ciphers is differential analysis, which uses the difference between plaintext and ciphertext blocks to deduce part or all of the key information.

[0034] Common algorithms for digital key exchange protocols include DH (Diffie-Hellman), ECDH (Elliptic Curve Diffie-Hellman Key Exchange), and SM9 (Signal Cryptography). These are all based on public-key cryptography, meaning they use different keys for encryption and decryption, with the encryption key being public and the decryption key being private. The security of public-key cryptography depends on the difficulty of the mathematical problem, such as the discrete logarithm problem, the elliptic curve discrete logarithm problem, or the bilinear pairing problem. A common attack method for public-key cryptography is the man-in-the-middle attack, where a malicious third party is inserted between the communicating parties to intercept and tamper with the communication, making the two parties mistakenly believe they are communicating with each other.

[0035] like Figure 1 As shown, the digital key interaction method integrating quantum keys includes the following steps:

[0036] In step S101, a secure communication channel is established between the first communication object and the second communication object, and digital certificates are exchanged within the secure communication channel to verify the identities of the first communication object and the second communication object, thereby obtaining the final verification result.

[0037] It is understood that the first communication object in this application embodiment can be the vehicle end, and the second communication object can be the mobile phone end.

[0038] In practical implementation, this application embodiment can establish a secure communication channel between the vehicle and the mobile phone through wireless communication technologies such as NFC (Near Field Communication), BLE (Bluetooth Low Energy), and UWB (Ultra Wide Band). NFC is a short-range wireless communication technology that enables rapid pairing and data exchange between the device and the vehicle; BLE is a low-power wireless communication technology that enables long-distance connection and control between the device and the vehicle; and UWB is an ultra-wideband wireless communication technology that enables high-precision distance measurement and positioning between the device and the vehicle. This application embodiment exchanges digital certificates within the secure communication channel to verify the other party's identity and obtain the final verification result, thereby ensuring the security and reliability of data transmission.

[0039] Optionally, in one embodiment of this application, before exchanging digital certificates in a secure communication channel to verify the identities of the first communication object and the second communication object, the method further includes: obtaining public-private key pairs corresponding to the first communication object and the second communication object; obtaining at least one of the following information based on the public-private key pairs: information of the public key holder, public key, validity period, and issuing authority; and obtaining digital certificates based on the at least one of the following information.

[0040] It is understood that the embodiments of this application can be performed before the two communicating parties use the digital key for the first time, or when the two communicating parties need to update the digital certificate; the digital certificate in the embodiments of this application is an electronic document used to prove the identity of the public key holder. It contains information such as the public key holder's information, public key, validity period, issuing authority, and the issuing authority's digital signature on the certificate; the issuing authority in the embodiments of this application is a trusted third-party institution, such as an authoritative Certificate Authority (CA), which is responsible for verifying the identity of the public key holder and issuing digital certificates.

[0041] In actual implementation, before exchanging digital certificates within a secure communication channel to verify the identities of the first and second communication objects, the two parties can use any public-key cryptography algorithm to generate a public-private key pair, such as RSA (RSA algorithm), ECC (Error Correcting Code), SM2 (public-key encryption algorithm), etc. Based on the public-private key pair, they obtain information such as the public key holder's information, public key, validity period, and issuing authority. They then obtain their respective digital certificates through a trusted third-party institution. Furthermore, both parties can store their private keys and digital certificates, as well as the issuing authority's public key and digital certificate, through their respective devices, such as smartphones and smartwatches.

[0042] In this embodiment of the application, the communicating parties can generate their own public and private key pairs and obtain their respective digital certificates through a trusted third-party institution, thereby protecting the confidentiality of the communication and enhancing the security and reliability of cyberspace.

[0043] Optionally, in one embodiment of this application, exchanging digital certificates within a secure communication channel to verify the identities of the first communication object and the second communication object, and obtaining a final verification result, includes: receiving digital certificates of the first communication object and the second communication object within the secure communication channel, verifying the digital signature and validity period in the digital certificates to obtain a first verification result, verifying the identities of the first communication object and the second communication object using a public key based on the first verification result to obtain a second verification result, and obtaining a final verification result based on the first verification result and the second verification result.

[0044] It is understood that the embodiments of this application can be performed when both parties need to use a digital key, or when both parties need to update the communication channel.

[0045] In actual implementation, after establishing a communication channel, the two parties in this application embodiment can send their respective digital certificates to each other. The other party verifies the identity of the other party and the validity of the public key by verifying the digital signature and validity period in the digital certificate and decrypting the public key in the digital certificate using the public key of the issuing authority. That is, in this application embodiment, the digital certificates of the first communication object and the second communication object are received in the secure communication channel, and the digital signature and validity period in the digital certificate are verified to obtain the first verification result. Based on the first verification result, the identities of the first communication object and the second communication object are verified using the public key to obtain the second verification result. The final verification result is obtained based on the first verification result and the second verification result.

[0046] In this embodiment, the communicating parties can establish a secure communication channel through wireless communication technologies such as NFC, BLE, and UWB, and exchange their respective digital certificates to verify each other's identities, thereby improving the confidentiality and integrity of the communication and optimizing the user experience.

[0047] In step S102, a master key that meets the preset sharing conditions is obtained based on the final verification result and the quantum key distribution protocol, and a session key is generated based on the master key. The first communication object and the second communication object are then checked based on the session key to see if they meet the preset digital key interaction conditions.

[0048] It is understood that the embodiments of this application can be performed after both parties have completed identity authentication, or when both parties need to update the master key or session key; the preset digital key interaction conditions in the embodiments of this application can be conditions for whether the digital key function is implemented. The QKD protocol in the embodiments of this application is a protocol in which both parties establish a key by transmitting quantum states. Its security is no longer based on the difficulty of mathematical problems, but is guaranteed by the fundamental principles of quantum mechanics. The random numbers exchanged by both parties can be generated by a quantum random number generator (QRNG) deployed in the cloud. A QRNG is a device that uses the uncertainty principle of quantum mechanics to generate random numbers. It can generate truly random numbers, not pseudo-random numbers. The session key is a short-term, temporary, and dynamic key used to encrypt and decrypt communication content to ensure the confidentiality and integrity of communication.

[0049] In practical implementation, this application embodiment can negotiate a shared master key based on the final verification result and the quantum key distribution (QKD) protocol. Using this master key, combined with the random numbers and identity parameters exchanged by both parties, a session key for encrypted communication is generated through a symmetric encryption algorithm, such as DES, AES, or SM4. The session key is then used to check whether the first and second communication objects meet certain digital key interaction conditions. Both parties can use any symmetric cryptographic algorithm to encrypt and decrypt the communication content, with the same session key used for encryption and decryption. The communication content can include various functions of the digital key, such as unlocking, locking, starting, controlling, and sharing. Both parties can choose different wireless communication technologies, such as NFC, BLE, and UWB, according to their needs and preferences to achieve digital key interaction at different distances and in different scenarios, improving the usability and flexibility of the digital key, ensuring key security, and enhancing the reliability and stability of the entire system.

[0050] It should be noted that the preset sharing conditions and preset digital key interaction conditions can be set by those skilled in the art according to the actual situation, and no specific restrictions are imposed here.

[0051] In step S103, when it is detected that the first communication object and the second communication object meet the preset digital key interaction conditions, the session key is updated according to the preset conditions to obtain the update result, and a subkey is derived from the master key according to the update result and the preset key derivation mechanism to update the session key according to the subkey and obtain the digital key interaction result.

[0052] It is understood that the key derivation mechanism in this application can be performed after the two communicating parties have generated a session key, or when the two communicating parties need to use a digital key. The key derivation mechanism in this application has the characteristics of unidirectionality, unpredictability, and collision resistance, which can effectively improve the security and randomness of the key, while reducing the storage and transmission overhead of the key.

[0053] In actual implementation, this application embodiment can periodically update the session key according to preset conditions when it is detected that the first communication object and the second communication object meet certain digital key interaction conditions, obtain the update result, and derive a series of subkeys from the master key based on the update result and hash chain-based key derivation mechanisms such as HMAC (Hash Message Authentication Code), HKDF (HMAC-based KDF), PBKDF2 (Password-Based Key Derivation Function 2), etc., and use these subkeys to update the session key to obtain the digital key interaction result.

[0054] It should be noted that the key derivation mechanism in this application embodiment has the following advantages:

[0055] One-wayness: Due to the one-wayness of hash functions, it is difficult to deduce the original input from the hash value. Therefore, if a subkey is leaked or damaged, it will not affect the security of other subkeys, nor will it expose the information of the master key.

[0056] Unpredictability: Due to the randomness of hash functions, similar inputs will produce drastically different hash values. Therefore, even if an attacker knows a subkey, they cannot predict the value of the next subkey or deduce the value of the master key.

[0057] Collision resistance: Due to the collision resistance of hash functions, it is difficult to find two different inputs that produce the same hash value. Therefore, even if an attacker tries to forge a subkey, it is difficult for it to produce the same hash value as the real subkey, thus making it detectable by the communicating parties.

[0058] Reduced overhead: Due to the structure of the hash chain, the communicating parties only need to store the master key and the currently used subkey, instead of storing all the subkeys, which saves storage space. At the same time, the communicating parties only need to transmit the hash value of the subkey, instead of transmitting the subkey itself, which saves transmission bandwidth.

[0059] It should be noted that the preset digital key interaction conditions, preset key derivation mechanism and preset conditions can be set by those skilled in the art according to the actual situation, and no specific restrictions are imposed here.

[0060] Optionally, in one embodiment of this application, updating the session key according to preset conditions to obtain an update result includes: updating the session key according to at least one of the following conditions: time interval, number of communications, and communication status, generating a new session key; and using the session key to decrypt and encrypt the new session key so that the new session key meets preset secure transmission conditions, thereby obtaining an update result.

[0061] It is understood that the embodiments of this application can be performed after the two communicating parties generate the master key, or when the two communicating parties need to update the subkey or session key.

[0062] In practical implementation, this application embodiment can set certain conditions, such as time intervals, communication frequency, and communication status, according to its own security needs and strategies to determine when to update the session key. The session key is periodically updated based on the time intervals, communication frequency, and communication status to generate a new session key, preventing key expiration or leakage. The communicating parties in this application embodiment can use any symmetric cryptographic algorithm, such as DES, AES, or SM4, to generate the new session key and use the old session key to encrypt and decrypt the new session key, ensuring the secure transmission of the new session key. After updating the session key, both parties will use the new session key to encrypt and decrypt the communication content to ensure the confidentiality and integrity of the communication. This application embodiment uses the session key to decrypt and encrypt the new session key, ensuring that the new session key meets the preset secure transmission conditions, obtaining the update result, and realizing the function of a digital key.

[0063] It should be noted that the preset secure transmission conditions can be set by those skilled in the art according to the actual situation, and no specific restrictions are imposed here.

[0064] Optionally, in one embodiment of this application, deriving a subkey from a master key based on an update result and a preset key derivation mechanism includes: performing a hash operation on the master key based on the update result and a hash chain-based key derivation mechanism to obtain a first subkey; iterating on the first subkey until a preset iteration stop condition is met, stopping the iteration, and obtaining the subkey.

[0065] It is understood that the communicating parties in this application embodiment can use any key derivation mechanism based on hash function, such as HMAC, HKDF, PBKDF2, etc., to derive a series of subkeys from the master key. The hash function is a one-way, irreversible, fixed-length, collision-resistant, and random mathematical function that can map an input of arbitrary length to a fixed-length output, called a hash value or digest.

[0066] In actual implementation, the communicating parties in this embodiment can use a hash chain structure to organize and use these subkeys. That is, starting with the master key, hash operations are performed sequentially to obtain the first subkey, then the first subkey is hashed to obtain the second subkey, and so on, forming a chain-like structure. Figure 2 As shown, the communicating parties can use these subkeys to update the session key. That is, each time the session key is updated, the next subkey is used instead of the master key. This avoids frequent use and leakage of the master key, and also increases the randomness and diversity of the session key. Specifically, in this embodiment, the master key can be hashed based on the update result and a hash chain-based key derivation mechanism to obtain the first subkey. The first subkey is iterated until a certain iteration stopping condition is met, at which point the iteration stops, resulting in a series of subkeys.

[0067] In this embodiment, the communicating parties use a hash chain-based key derivation mechanism to derive a series of subkeys from the master key and use these subkeys to update the session key. This key derivation mechanism has the characteristics of unidirectionality, unpredictability, and collision resistance, which can effectively improve the security and randomness of the key, while reducing the storage and transmission overhead of the key.

[0068] Optionally, in one embodiment of this application, after obtaining the digital key interaction result, the method further includes: disconnecting the secure communication channel to terminate the secure communication between the first communication object and the second communication object; and processing the master key, session key, subkey and digital certificate to obtain the processing result.

[0069] This application embodiment can be implemented when the two communicating parties no longer need to use digital keys, or when the two communicating parties detect an anomaly or attack.

[0070] In this embodiment, after completing the digital key function, the communicating parties disconnect the communication channel and delete or destroy the relevant keys and certificates to prevent data leakage or misuse. The communicating parties can use any wireless communication technology, such as NFC, BLE, UWB, etc., to disconnect the communication channel. Simultaneously, they can use secure methods, such as erasing, overwriting, and encryption, to delete or destroy the relevant keys and certificates, such as master keys, session keys, subkeys, digital certificates, etc., to prevent them from being recovered or used.

[0071] Specifically, it can be combined with Figure 3 As shown, the working principle of the digital key interaction method with fused quantum keys in the embodiments of this application is explained in detail with a specific example.

[0072] like Figure 3As shown, embodiments of this application may include the following steps:

[0073] Step S301: The vehicle and mobile devices generate public and private key pairs respectively, and obtain their own digital certificates from the CA.

[0074] Step S302: The two communicating parties establish a secure communication channel and exchange certificates to verify their identities.

[0075] Step S303: Negotiate the master key and session key via QKD.

[0076] Step S304: Implement digital key functionality using session keys.

[0077] Step S305: Update the session key periodically according to preset conditions.

[0078] Step S306: Generate a series of subkeys based on the hash chain key derivation mechanism to update the session key.

[0079] Step S307: Disconnect the communication channel and delete the relevant keys and certificates.

[0080] The digital key interaction method integrating quantum key distribution proposed in this application uses a hash chain-based key derivation mechanism to derive a series of subkeys from the master key. These subkeys are then used to update the session key, effectively improving key security and randomness while reducing key storage and transmission overhead. This method is suitable for resource-constrained devices and low-latency scenarios. Therefore, it solves the problems of related technologies exposing master key information during key updates, making it difficult to improve key security and randomness, unsuitable for resource-constrained devices, and prone to data leakage and misuse.

[0081] Next, with reference to the accompanying drawings, a digital key interaction device incorporating quantum keys according to an embodiment of this application is described.

[0082] Figure 4 This is a schematic diagram of the structure of a digital key interaction device that integrates quantum keys according to an embodiment of this application.

[0083] like Figure 4 As shown, the digital key interaction device 10 integrating quantum keys includes: a setup module 100, a detection module 200, and an interaction module 300.

[0084] Specifically, module 100 is used to establish a secure communication channel between the first communication object and the second communication object, and exchange digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object, and obtain the final verification result.

[0085] The detection module 200 is used to obtain a master key that meets the preset sharing conditions based on the final verification result and the quantum key distribution protocol, generate a session key based on the master key, and detect whether the first communication object and the second communication object meet the preset digital key interaction conditions based on the session key.

[0086] The interaction module 300 is used to update the session key according to the preset conditions when the first communication object and the second communication object are detected to meet the preset digital key interaction conditions, obtain the update result, and derive a subkey from the master key according to the update result and the preset key derivation mechanism, so as to update the session key according to the subkey and obtain the digital key interaction result.

[0087] Optionally, in one embodiment of this application, the digital key interaction device 10 integrating quantum keys further includes: a first acquisition module and a second acquisition module.

[0088] The first acquisition module is used to acquire the public-private key pair corresponding to the first communication object and the second communication object before exchanging digital certificates in the secure communication channel to verify the identities of the first communication object and the second communication object.

[0089] The second acquisition module is used to obtain at least one of the following information based on the public-private key pair: the information of the public key holder, the public key, the validity period, and the issuing authority, and to obtain the digital certificate based on the at least one of the following information.

[0090] Optionally, in one embodiment of this application, the establishment module 100 includes: a receiving unit, a verification unit, and a first acquisition unit.

[0091] The receiving unit is used to receive the digital certificates of the first communication object and the second communication object in the secure communication channel, and to verify the digital signature and validity period in the digital certificate to obtain the first verification result.

[0092] The verification unit is used to verify the identities of the first communication object and the second communication object using a public key based on the first verification result, and obtain the second verification result.

[0093] The first acquisition unit is used to obtain the final verification result based on the first verification result and the second verification result.

[0094] Optionally, in one embodiment of this application, the interaction module 300 includes: an update unit and a second acquisition unit.

[0095] The update unit is used to update the session key according to at least one of the following conditions: time interval, number of communications, and communication status, and generate a new session key.

[0096] The second acquisition unit is used to decrypt and encrypt the new session key using the session key, so that the new session key meets the preset secure transmission conditions and obtains the update result.

[0097] Optionally, in one embodiment of this application, the interaction module 300 further includes a calculation unit and an iteration unit.

[0098] The operation unit is used to perform a hash operation on the master key based on the update result and the key derivation mechanism based on the hash chain to obtain the first subkey.

[0099] An iterative unit is used to iterate over the first subkey until a preset iteration stop condition is met, at which point the iteration stops and the subkey is obtained.

[0100] Optionally, in one embodiment of this application, the digital key interaction device 10 integrating quantum keys further includes a termination module and a processing module.

[0101] The termination module is used to disconnect the secure communication channel after obtaining the digital key interaction result, thereby terminating the secure communication between the first communication object and the second communication object.

[0102] The processing module is used to process the master key, session key, subkey, and digital certificate to obtain the processing result.

[0103] It should be noted that the foregoing explanation of the embodiment of the digital key interaction method with fused quantum keys also applies to the digital key interaction device with fused quantum keys in this embodiment, and will not be repeated here.

[0104] The digital key interaction device integrating quantum key distribution proposed in this application uses a hash chain-based key derivation mechanism to derive a series of subkeys from the master key and uses these subkeys to update the session key. This effectively improves key security and randomness while reducing key storage and transmission overhead, making it suitable for resource-constrained devices and low-latency scenarios. Therefore, it solves the problems of related technologies exposing master key information during key updates, making it difficult to improve key security and randomness, unsuitable for resource-constrained devices, and prone to data leakage and misuse.

[0105] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0106] The memory 501, the processor 502, and the computer program stored on the memory 501 and capable of running on the processor 502.

[0107] When the processor 502 executes the program, it implements the digital key interaction method with fused quantum keys provided in the above embodiments.

[0108] Furthermore, electronic devices also include:

[0109] Communication interface 503 is used for communication between memory 501 and processor 502.

[0110] The memory 501 is used to store computer programs that can run on the processor 502.

[0111] The memory 501 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0112] If the memory 501, processor 502, and communication interface 503 are implemented independently, then the communication interface 503, memory 501, and processor 502 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 5 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0113] Optionally, in a specific implementation, if the memory 501, processor 502, and communication interface 503 are integrated on a single chip, then the memory 501, processor 502, and communication interface 503 can communicate with each other through an internal interface.

[0114] Processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0115] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described digital key interaction method for fused quantum keys.

[0116] This application also provides a computer program product storing a computer program that, when executed by a processor, implements the above-described digital key interaction method using fused quantum keys.

[0117] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0118] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0119] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0120] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0121] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0122] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0123] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0124] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A digital key interaction method incorporating quantum key distribution, characterized in that, Includes the following steps: A secure communication channel is established between the first communication object and the second communication object, and digital certificates are exchanged within the secure communication channel to verify the identities of the first communication object and the second communication object, thereby obtaining the final verification result; Based on the final verification result and the quantum key distribution protocol, a master key that meets the preset sharing conditions is obtained, and a session key is generated based on the master key. Based on the session key, it is detected whether the first communication object and the second communication object meet the preset digital key interaction conditions. When it is detected that the first communication object and the second communication object meet the preset digital key interaction conditions, the session key is updated according to the preset conditions to obtain an update result, and a subkey is derived from the master key according to the update result and the preset key derivation mechanism to update the session key according to the subkey to obtain the digital key interaction result. Before exchanging digital certificates within the secure communication channel to verify the identities of the first and second communication objects, the method further includes: obtaining public-private key pairs corresponding to the first and second communication objects; obtaining at least one of the following information based on the public-private key pairs: information of the public key holder, public key, validity period, and issuing authority; and obtaining the digital certificate based on the at least one of the following information. The step of exchanging digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object, and obtaining a final verification result, includes: receiving digital certificates of the first communication object and the second communication object within the secure communication channel, and verifying the digital signature and validity period in the digital certificates to obtain a first verification result; based on the first verification result, using the public key to verify the identities of the first communication object and the second communication object to obtain a second verification result; and obtaining the final verification result based on the first verification result and the second verification result. The step of deriving a subkey from the master key based on the update result and a preset key derivation mechanism includes: performing a hash operation on the master key based on the update result and a hash chain-based key derivation mechanism to obtain a first subkey; iterating on the first subkey until a preset iteration stop condition is met, stopping the iteration, and obtaining the subkey.

2. The method according to claim 1, characterized in that, The step of updating the session key according to preset conditions to obtain the update result includes: The session key is updated based on at least one of the following conditions: time interval, number of communications, and communication status, to generate a new session key; The new session key is decrypted and encrypted using the session key, so that the new session key meets the preset secure transmission conditions, and the update result is obtained.

3. The method according to claim 1, characterized in that, After obtaining the digital key interaction result, the following is also included: Disconnect the secure communication channel to terminate secure communication between the first communication object and the second communication object; The master key, the session key, the subkey, and the digital certificate are processed to obtain the processing result.

4. A digital key interaction device integrating quantum key distribution, characterized in that, The digital key interaction method using fused quantum keys as described in any one of claims 1-3 includes: The module is used to establish a secure communication channel between a first communication object and a second communication object, and to exchange digital certificates within the secure communication channel to verify the identities of the first communication object and the second communication object, and obtain the final verification result. The detection module is used to obtain a master key that meets the preset sharing conditions based on the final verification result and the quantum key distribution protocol, generate a session key based on the master key, and detect whether the first communication object and the second communication object meet the preset digital key interaction conditions based on the session key. An interaction module is used to update the session key according to the preset conditions when the first communication object and the second communication object are detected to meet the preset digital key interaction conditions, obtain an update result, and derive a subkey from the master key according to the update result and the preset key derivation mechanism, so as to update the session key according to the subkey and obtain a digital key interaction result. It also includes: a first acquisition module, used to acquire the public-private key pair corresponding to the first communication object and the second communication object before exchanging digital certificates in the secure communication channel to verify the identities of the first communication object and the second communication object; and a second acquisition module, used to obtain at least one of the following information based on the public-private key pair: information of the public key holder, public key, validity period, and issuing authority, and to obtain the digital certificate based on the at least one of the following information. The establishment module includes: a receiving unit, configured to receive digital certificates of the first communication object and the second communication object within the secure communication channel, and verify the digital signature and validity period in the digital certificates to obtain a first verification result; a verification unit, configured to verify the identities of the first communication object and the second communication object using the public key based on the first verification result to obtain a second verification result; and a first obtaining unit, configured to obtain the final verification result based on the first verification result and the second verification result. The interaction module further includes: a calculation unit, used to perform a hash operation on the master key according to the update result and the key derivation mechanism based on the hash chain to obtain a first subkey; and an iteration unit, used to iterate on the first subkey until a preset iteration stop condition is met, and then stop the iteration to obtain the subkey.

5. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the digital key interaction method of fused quantum keys as described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the digital key interaction method with fused quantum keys as described in any one of claims 1-3.

7. A computer program product, comprising a computer program, characterized in that, The computer program is executed to implement the digital key interaction method with fused quantum keys as described in any one of claims 1-3.

Images