Secure communication method, key distribution center, device, medium, and product

Abstract

The application discloses a secure communication method, which comprises the following steps: a terminal device sends a session key request message to a key distribution center; the key distribution center receives the session key request message, and determines to obtain a key between a first quantum key distribution node and a second quantum key distribution node based on the session key request message; the key distribution center sends a key request message to a third quantum key distribution node; the third quantum key distribution node performs a key generation process between the first quantum key distribution node and the second quantum key distribution node, obtains a session key, and sends the session key to the key distribution center; and the key distribution center receives the session key, and sends the session key to the terminal device and a server. The application also discloses a key distribution center, a terminal device, a server, a key updating terminal device, a third quantum key distribution node, a computer readable storage medium and a computer program product.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of communications, and in particular to a secure communication method, a key distribution center, a terminal device, a server, a key update terminal device, a third quantum key distribution node, a computer readable storage medium, and a computer program product. BACKGROUND

[0002] Currently, two parties participating in communication encrypt communication data through a session key, so as to ensure the security of network communication. In related technologies, a key distribution center (KDC) generates a session key, and transmits the session key to each communication party through a secure channel established by a long-term key shared by the KDC and each communication party.

[0003] However, the above-mentioned session key acquisition scheme at least has the problem of poor security. SUMMARY

[0004] Embodiments of the present application provide a secure communication method, a key distribution center, a terminal device, a server, a key update terminal device, a third quantum key distribution node, a computer readable storage medium, and a computer program product, and provide a scheme for supporting distribution of keys in a QKDN to communication parties in an application layer.

[0005] In a first aspect, the present application provides a secure communication method, applied to a key distribution center, and including:

[0006] receiving a session key request message sent by a terminal device; wherein the session key request message is used to request acquisition of a session key; the session key request message includes an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of a server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm on the basis of the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key, by the authentication encryption key;

[0007] determining, on the basis of the session key request message, a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with the server; wherein the key update terminal device is used to import an authentication encryption key into the terminal device;

[0008] sending a key request message to a third quantum key distribution node connected with the key distribution center; wherein the key request message includes an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node;

[0009] receive a key request response message sent by the third quantum key distribution node; wherein the key request response message comprises a session key used for secure communication between the terminal device and the server and metadata of the session key;

[0010] send the session key to the terminal device and the server.

[0011] In a second aspect, the embodiments of the present application provide a secure communication method, applied to a terminal device, the terminal device comprising:

[0012] send a session key request message to a key distribution center; wherein the session key request message is used to request to obtain a session key; the session key request message comprises an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of the server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm based on the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key;

[0013] receive a session key sent by the key distribution center; wherein the session key is used for secure communication between the terminal device and the server; and the session key is a key between a second quantum key distribution node connected with the server and a first quantum key distribution node connected with a key update terminal device.

[0014] In a third aspect, the embodiments of the present application provide a secure communication method, applied to a server, the server comprising:

[0015] receive, through a first secure channel, a session key sent by a key distribution center, an identifier of a terminal device, an identifier of the server, and a first random number generated by the terminal device;

[0016] wherein the session key is used for secure communication between the terminal device and the server; and the session key is a key between a second quantum key distribution node connected with the server and a first quantum key distribution node connected with a key update terminal device; and the key update terminal device is used to import an authentication encryption key into the terminal device.

[0017] In a fourth aspect, the embodiments of the present application provide a secure communication method, applied to a key update terminal device, the key update terminal device comprising:

[0018] receive a key request sent by a terminal device; wherein the key request is used to request to obtain a one-time key connected with a key distribution center;

[0019] receive a key file sent by the first quantum key distribution node; wherein the key file comprises one or more keys and metadata corresponding to each key;

[0020] bind the terminal with the key metadata corresponding to the key; wherein the key metadata comprises a key identifier, a source identifier and a destination identifier; the source identifier is an identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is an identifier corresponding to the binding between the key distribution center and the third quantum key distribution node;

[0021] send the key file to the terminal device.

[0022] In a fifth aspect, an embodiment of the present application provides a secure communication method, applied to a third quantum key distribution node, the third quantum key distribution node comprising:

[0023] receive a key request message sent by a key distribution center; wherein the key request message is used to obtain a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with a server; the key request message comprises an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node;

[0024] perform a key generation process between the first quantum key distribution node and the second quantum key distribution node to obtain a session key;

[0025] send a key request response message to the key distribution center; wherein the key request response message comprises the session key used for secure communication between the terminal device and the server and metadata of the session key.

[0026] In a sixth aspect, an embodiment of the present application provides a key distribution center, comprising:

[0027] a first receiving module, configured to receive a session key request message sent by a terminal device; wherein the session key request message is used to request to obtain a session key; the session key request message comprises an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of a server, a first random number generated by the terminal device and a first verification code; the first verification code is a verification code generated based on the identifier of the terminal device, the identifier of the server, the first random number and the identifier of the authentication encryption key using a message verification code algorithm based on the authentication encryption key;

[0028] a first processing module, configured to determine, based on the session key request message, to obtain a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with a server; wherein the key update terminal device is a terminal device into which an authentication encryption key is imported.

[0029] The first sending module is configured to send a key request message to a third quantum key distribution node connected to the key distribution center, wherein the key request message comprises an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node.

[0030] The first receiving module is configured to receive a key request response message sent by the third quantum key distribution node, wherein the key request response message comprises a session key used for secure communication between the terminal device and the server and metadata of the session key.

[0031] The first sending module is configured to send the session key to the terminal device and the server.

[0032] In a seventh aspect, an embodiment of the present application provides a terminal device, which comprises:

[0033] The second sending module is configured to send a session key request message to the key distribution center, wherein the session key request message is used to request to obtain a session key, and the session key request message comprises an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of the server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm on the basis of the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key.

[0034] The second receiving module is configured to receive a session key sent by the key distribution center, wherein the session key is used for secure communication between the terminal device and the server, and the session key is a key between a second quantum key distribution node connected to the server and a first quantum key distribution node connected to the key update terminal device.

[0035] In an eighth aspect, an embodiment of the present application provides a server, which comprises:

[0036] The third receiving module is configured to receive, through a first secure channel, a session key sent by the key distribution center, an identifier of the terminal device, an identifier of the server, and a first random number generated by the terminal device, wherein the session key is used for secure communication between the terminal device and the server, and the session key is a key between a second quantum key distribution node connected to the server and a first quantum key distribution node connected to the key update terminal device; and the key update terminal device is used to import an authentication encryption key into the terminal device.

[0037] In a ninth aspect, an embodiment of the present application provides a key update terminal device, which comprises:

[0038] The fourth receiving module is used to receive a key request sent by the terminal device; wherein the key request is used to request a one-time key for connecting to the key distribution center;

[0039] The fourth receiving module is used to receive a key file sent by the first quantum key distribution node; wherein the key file includes one or more keys and metadata corresponding to each key;

[0040] The fourth processing module is used to bind the terminal and the key metadata corresponding to the key; the key metadata includes a key identifier, a source identifier, and a destination identifier; the source identifier is the identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is the identifier corresponding to the binding between the key distribution center and the third quantum key distribution node;

[0041] The fourth sending module is used to send the key file to the terminal device.

[0042] In a tenth aspect, embodiments of this application provide a third quantum key distribution node, the third quantum key distribution node comprising:

[0043] The fifth receiving module is used to receive a key request message sent by the key distribution center; wherein, the key request message is used to obtain the key between the first quantum key distribution node connected to the key update terminal device and the second quantum key distribution node connected to the server; the key request message includes the identifier of the first quantum key distribution node and the identifier of the second quantum key distribution node;

[0044] The fifth processing module is used to execute the key generation process between the first quantum key distribution node and the second quantum key distribution node to obtain the session key;

[0045] The fifth sending module is used to send a key request response message to the key distribution center; wherein the key request response message includes a session key and the session key metadata used for secure communication between the terminal device and the server.

[0046] Eleventhly, embodiments of this application provide a key distribution center, the key distribution center comprising:

[0047] The first memory is used to store executable instructions;

[0048] The first processor, when executing executable instructions stored in the first memory, implements the aforementioned secure communication method.

[0049] In a twelfth aspect, embodiments of this application provide a terminal device, the terminal device comprising:

[0050] The second memory is used to store executable instructions;

[0051] The second processor, when executing executable instructions stored in the second memory, implements the aforementioned secure communication method.

[0052] In a thirteenth aspect, embodiments of this application provide a server, the server comprising:

[0053] The third memory is used to store executable instructions;

[0054] The third processor, when executing executable instructions stored in the third memory, implements the aforementioned secure communication method.

[0055] In a fourteenth aspect, embodiments of this application provide a key update terminal device, the key update terminal device comprising:

[0056] The fourth memory is used to store executable instructions;

[0057] The fourth processor is used to implement the above-mentioned secure communication method when executing executable instructions stored in the fourth memory.

[0058] In a fifteenth aspect, embodiments of this application provide a third quantum key distribution node, the third quantum key distribution node comprising:

[0059] The fifth memory is used to store executable instructions;

[0060] The fifth processor, when executing executable instructions stored in the fifth memory, implements the above-described communication method.

[0061] In a sixteenth aspect, embodiments of this application provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the above-described secure communication method.

[0062] In a seventeenth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the aforementioned secure communication method.

[0063] This application provides a scheme to support the distribution of keys in a QKDN to communication parties at the application layer. The quantum key shared between two QKDN nodes is used as the session key, enabling the mobile terminal to establish a secure connection with the server based on the session key. At the same time, the session key is generated based on quantum technology and has the characteristics of a true random number, so the secure connection established by the mobile terminal using this key has higher security. Attached Figure Description

[0064] Figure 1 This is a schematic diagram of a secure communication system according to an embodiment of this application;

[0065] Figure 2 A schematic diagram of the KDC framework provided in the embodiments of this application;

[0066] Figure 3 A schematic diagram of the framework of QKDN provided in the embodiments of this application;

[0067] Figure 4 Flowchart of the secure communication method provided in the embodiments of this application Figure 1 ;

[0068] Figure 5 Flowchart of the secure communication method provided in the embodiments of this application Figure 2 ;

[0069] Figure 6 Flowchart of the secure communication method provided in the embodiments of this application Figure 3 ;

[0070] Figure 7 Flowchart of the secure communication method provided in the embodiments of this application Figure 4 ;

[0071] Figure 8 A schematic block diagram of a key distribution center provided for embodiments of this application;

[0072] Figure 9 A schematic block diagram of a terminal device provided in an embodiment of this application;

[0073] Figure 10 A schematic block diagram of a server provided for an embodiment of this application;

[0074] Figure 11 A schematic block diagram of a key update terminal device provided in an embodiment of this application;

[0075] Figure 12 A schematic block diagram of a third quantum key distribution node provided for embodiments of this application;

[0076] Figure 13 This is a schematic structural diagram of a communication device provided in an embodiment of this application. Detailed Implementation

[0077] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0078] Figure 1 This is a schematic diagram of a secure communication system according to an embodiment of this application.

[0079] like Figure 1 As shown, the secure communication system has a two-layer architecture. The upper layer is the service layer, which consists of a KDC (Key Distribution Center), key update terminal equipment, servers, and terminal equipment. The lower layer is the Quantum Key Distribution Network (QKDN) layer, which includes multiple Quantum Key Distribution (QKD) nodes that generate and provide keys for the service layer.

[0080] in, Figure 1 In this context, the Key Management Center (KDC) is a facility that manages keys. The functions of a KDC include at least key generation, entity authentication, key distribution, and key lifecycle management. For example, a KDC like Kerberos consists of an Authentication Server (AS) and a Ticket Granting Server (TGS). Kerberos, as a trusted third party, supports secure authentication of users on target servers over unprotected networks. Kerberos can also establish cryptographic keys between clients and target servers. In most cases, the KDC shares a key with each communicating party. The KDC generates temporary session keys and uses the shared key to establish secure channels. Each communicating party is then assigned a session key for communicating with other parties, such as... Figure 2 As shown, the KDC establishes a secure channel with user A using a shared key, and assigns a session key to user A; the KDC establishes a secure channel with user B using a shared key, and assigns a session key to user B; the KDC establishes a secure channel with user C using a shared key, and assigns a session key to user C; the KDC establishes a secure channel with user D using a shared key, and assigns a session key to user D. The KDC typically uses symmetric cryptographic algorithms, such as the Advanced Encryption Standard (AES)-256, with a key length of 256 bits, to resist quantum computing attacks. If the key length is 256 bits, then the KDC is a quantum-safe key distribution center.

[0081] Figure 1The terminal devices mentioned include, but are not limited to, any terminal device connected to network devices or other terminal devices via wired or wireless connections. For example, a terminal device can refer to an access terminal, user equipment (UE), user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent, or user device. An access terminal can be a cellular phone, cordless phone, Session Initiation Protocol (SIP) phone, IoT device, satellite handheld terminal, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), handheld device with wireless communication capabilities, computing device or other processing device connected to a wireless modem, in-vehicle device, wearable device, terminal device in a 5G network, or terminal device in a future evolved network.

[0082] Figure 1 The servers in the system can provide different services to terminal devices, such as WWW servers.

[0083] Figure 1 A key update terminal device is a terminal device that can provide keys to other terminal devices.

[0084] QKDN is a quantum key distribution network based on QKD technology, primarily composed of QKD nodes. QKD utilizes quantum mechanics to ensure communication security, enabling both parties to generate and share a random, secure key for encrypting and decrypting messages. QKD transmits light particles or photons via fiber optic cables between the two parties. A significant advantage of QKD lies in its resistance to quantum computing attacks, based on its quantum physics principles of single-quantum indivisibility and the non-cloning of quantum states. The non-cloning theorem states that it is impossible to create an identical copy of an unknown quantum state, preventing attackers from simply copying data, as they now do with network traffic. Furthermore, if an attacker interferes with or views the system, the system state changes, alerting relevant parties to the attack. If the distance between QKD nodes exceeds a certain range, trusted QKD relay nodes need to be deployed between them. Logically, QKDN has a four-layer structure: from bottom to top, the quantum layer, the key management layer, the QKDN control layer, and the application layer. Figure 3As shown. The QKD module in the quantum layer generates quantum keys and provides them to the key manager; the key manager of the QKD node provides quantum keys to applications in the application layer, while the key manager of the QKD trusted relay node is used for quantum key relay management and does not provide quantum keys to the application layer. The QKDN control layer includes a QKDN controller. Furthermore, a QKDN network management system needs to be deployed in the QKDN to manage and control the quantum layer, key management layer, and QKDN control layer. The application layer is managed and controlled by the corresponding application management system.

[0085] It should be noted that QKD nodes can be further subdivided into QKDN user nodes and QKDN access nodes. QKDN user nodes are trusted nodes located on the QKD user side, responsible for obtaining keys from the QKDN and providing corresponding keys for specific cryptographic applications to conduct secure communication. QKDN access nodes are responsible for aggregating the key traffic flows from multiple user nodes connected to them and forwarding these flows to remote QKD nodes via OTP channels based on a trusted relay scheme. That is, QKDN user nodes can only obtain the shared quantum key between themselves and other QKD nodes within the network; while QKDN access nodes can obtain the shared quantum key between any two QKD nodes in the QKDN.

[0086] The KDC, key update terminal device, and server each connect to the lower-level QKD node to obtain the QKDN layer key. The node connected to the KDC is the QKD access node, which can obtain the key generated between any two nodes in the QKDN. The terminal device injects keys from the QKDN in batches through the key update terminal device and uses these keys as one-time authentication encryption keys to connect to the KDC. The service layer KDC obtains the session key from the QKDN. The mobile terminal and KDC authenticate each other using the authentication encryption key. Simultaneously, the KDC encrypts the session key using the authentication encryption key and transmits it to the terminal device. The KDC transmits the session key to the server through a long-term secure channel. The terminal device uses the session key to securely access the server.

[0087] It should be noted that, with Figure 1 The QKD C node connected to the KDC in the middle is the QKD access node; and Figure 1 The key update terminal device connected to the QKD A node is a QKD user node; and Figure 1 The server in the middle is connected to the QKD E node, which is a QKD user node.

[0088] It should be noted that, Figure 1This application merely illustrates the system to which this application applies; of course, the methods shown in the embodiments of this application can also be applied to other systems. Furthermore, the terms "system" and "network" are often used interchangeably herein. The term "and / or" in this application merely describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects have an "or" relationship. It should also be understood that "instruction" mentioned in the embodiments of this application can be a direct instruction, an indirect instruction, or an indication of a related relationship. For example, A instructing B can mean that A directly instructs B, for example, B can be obtained through A; it can also mean that A indirectly instructs B, for example, A instructs C, B can be obtained through C; or it can mean that there is a related relationship between A and B. It should also be understood that "correspondence" mentioned in the embodiments of this application can indicate a direct or indirect correspondence between two things, or an related relationship between two things, or a relationship of instruction and being instructed, configuration and being configured, etc. It should also be understood that the "predefined" or "predefined rules" mentioned in the embodiments of this application can be implemented by pre-storing corresponding codes, tables, or other means that can be used to indicate relevant information in the device (e.g., including terminal devices and network devices), and this application does not limit the specific implementation method. For example, predefined can refer to those defined in a protocol. It should also be understood that in the embodiments of this application, the "protocol" can refer to standard protocols in the field of communication, such as LTE protocol, NR protocol, and related protocols applied to future communication systems, and this application does not limit this.

[0089] To facilitate understanding of the technical solutions of the embodiments of this application, the relevant technologies of the embodiments of this application are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this application in any way, and they all fall within the protection scope of the embodiments of this application.

[0090] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0091] Figure 4 This is a flowchart illustrating a secure communication method provided in an embodiment of this application, as shown below. Figure 4 As shown, this method is applied to Figure 1 In the secure communication system shown, the method includes:

[0092] Step 401: The terminal device sends a session key request message to the key distribution center.

[0093] The session key request message is used to request a session key. The session key request message includes the identifier of the authentication encryption key, the identifier of the terminal device, the identifier of the server, a first random number generated by the terminal device, and a first verification code. The first verification code is a verification code generated by using a message verification code algorithm based on the identifier of the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key.

[0094] In this embodiment, the terminal device can send a session key request message to the key distribution center through the existing wireless channel to better ensure compatibility with the existing system and reduce the cost of system transformation.

[0095] In some embodiments, the first random number can be a quantum random number generated by a quantum random number generator or an ordinary random number, used to prevent replay attacks.

[0096] In this embodiment of the application, the identifier of the terminal device includes, but is not limited to, the Mobile Station international Integrated Services Digital Network number (MSISDN), the International Mobile Subscriber Identity (IMSI), the International Mobile Equipment Identity (IMEI), the service identifier (such as the domain name of the terminal), and the service number of a user's application (such as the user identifier of a chat software, communication software, or other software installed on the terminal).

[0097] In this embodiment of the application, the server identifier includes the server's Internet Protocol (IP) address and Medium Access Control (MAC) address.

[0098] In this application, each authentication encryption key has a unique identifier; in some embodiments, the identifier includes color identifiers, graphic identifiers, text identifiers, number identifiers, location identifiers, etc.

[0099] It should be noted that the key distribution center can also be called a (quantum) cryptographic security service center, (quantum) cryptographic service center, (quantum) security service center, (quantum) security center, etc.

[0100] In this embodiment, the authentication encryption key can be a quantum key or a regular key generated by a pseudo-random number generator / physical noise source generator. If the authentication encryption key is a quantum key, it can be generated by a quantum random number generator or by negotiation between at least QKD nodes in a QKDN, and then provided to the terminal device via a key update terminal device.

[0101] In this application embodiment, the message verification code algorithm includes, but is not limited to, the keyedhashed message authentication code (HMAC) function, the MD5 message-digest algorithm, the Secure Hash Algorithm 1 (SHA1), the Cyclic Redundancy Check (CRC), the Data Encryption Standard (DES), and the Advanced Encryption Standard (AES).

[0102] Step 402: The key distribution center receives the session key request message and, based on the session key request message, determines to obtain the key between the first quantum key distribution node connected to the key update terminal device and the second quantum key distribution node connected to the server.

[0103] Among them, the key update terminal device injects the authentication encryption key into the terminal device.

[0104] In this embodiment of the application, the key distribution center receives the session key request message sent by the terminal device through a wireless channel.

[0105] In this embodiment of the application, both the first quantum key distribution node and the second quantum key distribution node are QKDN user nodes.

[0106] In this embodiment of the application, the key distribution center needs to determine, based on the content included in the session key request message, the shared quantum key between the first quantum key distribution node and the second quantum key distribution node that needs to be obtained.

[0107] Step 403: The key distribution center sends a key request message to the third quantum key distribution node connected to the key distribution center.

[0108] The key request message includes the identifiers of the first quantum key distribution node and the second quantum key distribution node.

[0109] It should be noted that each quantum key distribution node has a unique identifier.

[0110] In this embodiment, the third quantum key distribution node is a QKDN access node, which can obtain the shared quantum key between any two QKD nodes in the QKDN.

[0111] Step 404: The third quantum key distribution node receives the key request message, executes the key generation process between the first and second quantum key distribution nodes, and obtains the session key.

[0112] In this embodiment of the application, the third quantum key distribution node instructs the first quantum key distribution node and the second quantum key distribution node to perform key negotiation; the first quantum key distribution node and the second quantum key distribution node negotiate to generate a shared key; the third quantum key distribution node actively obtains the negotiated shared quantum key from the first quantum key distribution node or the second quantum key distribution node, or the first quantum key distribution node or the second quantum key distribution node sends the negotiated quantum key to the third quantum key distribution node.

[0113] Step 405: The third quantum key distribution node sends a key request response message to the key distribution center.

[0114] The key request response message includes a session key and its metadata, which are used for secure communication between the terminal device and the server.

[0115] It should be noted that secure communication includes, but is not limited to, encrypted calls, encrypted text messages, encrypted instant messages, encrypted audio and video conferencing, encrypted 5G (5G) messages (e.g., Rich Communication Services (RCS) messages), encrypted walkie-talkie messages, and encrypted emails.

[0116] In this embodiment of the application, each key has corresponding key metadata, and the format of the key metadata is shown in Table 1:

[0117] Key ID Kae Key length 256bit Key providing time 11:05 Application name Application A Source ID (ID of QKD A node, name of key update terminal device) Destination ID (ID of QKD C node, name of KDC)

[0118] Table 1

[0119] It should be noted that KeyID can be a unique identifier for the quantum key shared between two QKD nodes. The key length can be 128 bits or 256 bits; the key provision time can be the time when the QKD node provides the key to the service layer; the source identifier can be the identifier of the QKD A node connected to the key update terminal device and the name of the key update terminal device; the destination identifier can be the identifier of the QKD C node connected to the KDC and the name of the KDC.

[0120] In this embodiment of the application, the third quantum key distribution node uses the quantum key shared between the first quantum key distribution node and the second quantum key distribution node as the session key and feeds it back to the key distribution center.

[0121] Step 406: The key distribution center receives the key request response message.

[0122] Step 407: The key distribution center sends the session key to the terminal device and the server.

[0123] In this embodiment, the session key is sent in various ways, including in-band, out-of-band, media, signaling, data, message, control plane, and user plane. Existing media channels can be used to send the session key, improving compatibility with existing systems and reducing system modification costs. Furthermore, when conducting multi-party secure communication, the established media plane communication channel is a one-to-many multicast / broadcast communication channel. This means that the session key is sent only once through the established multicast / broadcast communication channel, and other terminals or servers can receive it, effectively reducing the number of messages sent.

[0124] This application provides a secure communication method, comprising: a terminal device sending a session key request message to a key distribution center; wherein the session key request message is used to request a session key; the session key request message includes an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of a server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated using a message verification code algorithm based on the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key; the key distribution center receiving the session key request message sent by the terminal device; and the key distribution center, based on the session key request message, determining to obtain a first quantum key distribution node connected to the key update terminal device and a second quantum key connected to the server. The process involves distributing keys between nodes; a key distribution center sending a key request message to a third quantum key distribution node connected to it; the key request message including the identifiers of the first and second quantum key distribution nodes; the third quantum key distribution node receiving the key request message; the third quantum key distribution node executing the key generation process between the first and second quantum key distribution nodes to obtain a session key; the third quantum key distribution node sending a key request response message to the key distribution center; the key request response message including a session key and its metadata for secure communication between the terminal device and the server; the key distribution center receiving the key request response message; and the key distribution center sending the session key to both the terminal device and the server. In other words, this application provides a scheme to support the distribution of keys in a QKDN to communication parties at the application layer, using a quantum key shared between two QKDN nodes as the session key, enabling the mobile terminal to establish a secure connection with the server based on the session key; simultaneously, the session key is generated based on quantum technology and possesses true random number characteristics, resulting in higher security for secure connections established by the mobile terminal using this key.

[0125] This application introduces a KDC (Key Controller), which allows mobile terminals to obtain session keys for communication with multiple servers simply by acquiring a key that is authenticated with the KDC. This enables the management of keys from QKDN (Quick Key DN) based on the KDC, providing secure key services for a large number of users.

[0126] Figure 5 This is a flowchart illustrating a secure communication method provided in an embodiment of this application, as shown below. Figure 5 As shown, this method is applied to Figure 1 In the secure communication system shown, the method includes:

[0127] Step 501: The terminal device sends a session key request message to the key distribution center.

[0128] The session key request message is used to request a session key. The session key request message includes the identifier of the authentication encryption key, the identifier of the terminal device, the identifier of the server, a first random number generated by the terminal device, and a first verification code. The first verification code is a verification code generated by using a message verification code algorithm based on the identifier of the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key.

[0129] Step 502: The key distribution center receives the session key request message and determines the authentication encryption key based on the identifier of the authentication encryption key.

[0130] In this embodiment, if the key distribution center cannot find the corresponding authentication encryption key in the secure storage area based on the identifier of the authentication encryption key, the process terminates. If the key distribution center finds the corresponding authentication encryption key in the secure storage area based on the identifier of the authentication encryption key, step 504 is executed.

[0131] Step 503: The key distribution center verifies the first verification code based on the authentication encryption key.

[0132] Step 504: If the verification is successful, the key distribution center determines that the session key request message was sent by the terminal device; then proceed to step 505.

[0133] In this embodiment, after receiving the session key request message, the key distribution center uses a message verification code algorithm to generate a first reference verification code based on the authentication encryption key in the session key request message, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key in the session key request message. Then, it compares the first reference verification code with the first verification code. If the first reference verification code and the first verification code are the same, it is determined that the first verification code has been verified and that the session key request message was sent by the terminal device. If the first reference verification code and the first verification code are not completely the same, it indicates that the first verification code has not been verified, and a prompt message is returned to the terminal device or the process is terminated.

[0134] It should be noted that the message verification code algorithm used by the key distribution center to generate the first reference verification code is the same as the message verification code algorithm used by the terminal device to generate the first verification code. Here, the key distribution center can obtain relevant information about the message verification code algorithm used by the terminal device from the session key request message, or the key distribution center and the terminal device can pre-negotiate a message verification code algorithm; this application does not make specific limitations in this regard.

[0135] Step 505: Based on the identifier of the terminal device and the identifier of the authentication encryption key, the key distribution center determines the source node corresponding to the session key as the first quantum key distribution node; based on the identifier of the server, it determines the destination node corresponding to the session key as the second quantum key distribution node.

[0136] It should be noted that the key distribution center can determine the identifier of the key update terminal device that provides the authentication encryption key to the terminal device based on the identifier of the terminal device and the identifier of the authentication encryption key, and determine the identifier of the first quantum key distribution node based on the identifier of the key update terminal device; the key distribution center can determine the identifier of the second quantum key distribution node based on the identifier of the server.

[0137] It should be noted that the key distribution center determines the destination node corresponding to the session key as the first quantum key distribution node based on the identifier of the terminal device and the identifier of the authentication encryption key; and determines the source node corresponding to the session key as the second quantum key distribution node based on the identifier of the server.

[0138] Step 506: The key distribution center sends a key request message to the third quantum key distribution node connected to the key distribution center.

[0139] Step 507: The third quantum key distribution node receives the key request message and executes the key generation process between the first and second quantum key distribution nodes to obtain the session key.

[0140] Step 508: The third quantum key distribution node sends a key request response message to the key distribution center.

[0141] The key request response message includes a session key and its metadata, which are used for secure communication between the terminal device and the server.

[0142] Step 509: The key distribution center receives the key request response message.

[0143] Step 510: The key distribution center sends the session key, the terminal device identifier, the server identifier, and the first random number generated by the terminal device to the server through the first secure channel.

[0144] Step 511: The server receives the session key, the terminal device's identifier, the server's identifier, and the first random number generated by the terminal device through the first secure channel.

[0145] Step 512: The server sends a second random number to the key distribution center through the first secure channel.

[0146] The second random number is generated by the server; the second random number can be bound to the session key; the second random number is used to prevent replay attacks and to determine the corresponding session key.

[0147] Step 513: The key distribution center receives the second random number through the first secure channel.

[0148] Step 514: The key distribution center encrypts the session key based on the authentication encryption key to obtain the encrypted session key.

[0149] It should be noted that step 514 may be executed before step 510, or before step 511, or before step 512, or before step 513. This application does not make specific restrictions on the execution order of step 514 and steps 510 to 513.

[0150] Step 515: The key distribution center sends a session key request response message to the terminal device.

[0151] The session key request response message includes the encrypted session key, the identifier of the terminal device, the identifier of the key distribution center, the second random number generated by the server, the first random number, and the second verification code; the second verification code is a verification code generated by using the message verification code algorithm based on the authentication encryption key, the identifier of the terminal device, the identifier of the key distribution center, the second random number, the first random number, and the encrypted session key.

[0152] It should be noted that the second verification code is generated using a message verification code algorithm based on the authentication encryption key pair with the terminal device's identifier, the key distribution center's identifier, the second random number, and the first random number.

[0153] Furthermore, the key distribution center deletes the authentication encryption key from the secure storage area at the same time as sending the session key request response message to the terminal device; or deletes the authentication encryption key from the secure storage area before sending the session key request response message to the terminal device; or deletes the authentication encryption key from the secure storage area after sending the session key request response message to the terminal device. It should be noted that the authentication encryption key is one-time use, and the key distribution center needs to delete the authentication encryption key after use.

[0154] Step 516: The terminal device receives the session key request response message, compares the first random number in the session key request response message with the first random number generated by the terminal device, and determines whether the session key request response message is a replay message.

[0155] In this embodiment of the application, if the first random number in the session key request response message is the same as the first random number generated by the terminal device, the session key request response message is determined not to be a replay message; if the first random number in the session key request response message is different from the first random number generated by the terminal device, the session key request response message is determined to be a replay message.

[0156] Step 517: If the session key request response message is not a replay message, the terminal device verifies the second verification code based on the authentication encryption key.

[0157] Step 518: If the verification is successful, the terminal device proves that the communication counterpart is the key distribution center and deletes the authentication encryption key.

[0158] In this embodiment, after receiving the session key request response message, the terminal device uses a message verification code algorithm to generate a second reference verification code based on the authentication encryption key in the session key request response message, the terminal device identifier, the key distribution center identifier, the second random number, the first random number, and the encrypted session key in the session key request response message. Then, it compares the second reference verification code with the second verification code. If the second reference verification code and the second verification code are the same, it is determined that the second verification code has been verified successfully, the sender of the session key request response message is identified as the key distribution center, and the terminal device deletes the authentication encryption key stored internally. If the second reference verification code and the second verification code are not completely the same, it is determined that the second verification code has not been verified successfully, and the terminal device returns a prompt message to the key distribution center or terminates the process.

[0159] In this embodiment, after receiving the session key request response message, the terminal device uses a message verification code algorithm to generate a second reference verification code based on the authentication encryption key in the session key request response message, the terminal device identifier, the key distribution center identifier, the second random number, and the first random number in the session key request response message. Then, it compares the second reference verification code with the second verification code. If the second reference verification code and the second verification code are the same, it is determined that the second verification code has passed verification, the sender of the session key request response message is identified as the key distribution center, and the terminal device deletes the authentication encryption key stored internally. If the second reference verification code and the second verification code are not completely the same, it is determined that the second verification code has failed verification, and the terminal device returns a prompt message to the key distribution center or terminates the process.

[0160] It should be noted that the message verification code algorithm used by the terminal device to generate the second reference verification code is the same as the message verification code algorithm used by the key distribution center to generate the second verification code. Here, the terminal device can obtain relevant information about the message verification code algorithm used by the key distribution center from the session key request response message, or the key distribution center and the terminal device can pre-negotiate a message verification code algorithm; this application does not make specific limitations in this regard.

[0161] Step 519: The terminal device sends a session request to the server.

[0162] The session request includes the identifier of the terminal device, the identifier of the server, a third random number generated by the terminal device, a second random number, and a third verification code; the third verification code is a verification code generated by using a message verification code algorithm based on the session key pair of the identifier of the terminal device, the identifier of the server, the third random number, and the second random number.

[0163] Step 520: The server receives the session request, compares the second random number generated by the server with the second random number in the session request, and determines whether the session request is a replay message.

[0164] In this embodiment of the application, if the second random number in the session request is the same as the second random number generated by the server, it is determined that the session request is not a replay message; if the second random number in the session request is different from the second random number generated by the server, it is determined that the session request is a replay message.

[0165] Step 521: If the session request is not a replay message, the server obtains the session key corresponding to the second random number; and verifies the third verification code based on the session key.

[0166] It should be noted that the server first binds the second random number to the session key. After the server receives and verifies the session request, it will directly obtain the session key bound to the second random number.

[0167] In this embodiment, the terminal device uses a message verification code algorithm to generate a third reference verification code based on the session key, the terminal device identifier, the server identifier, the third random number, and the second random number in the session request. Then, it compares the third reference verification code with the third verification code. If the third reference verification code and the third verification code are the same, it means that the verification of the third verification code has passed, and a session request response message is sent to the terminal device. If the third reference verification code and the third verification code are not completely the same, it means that the verification of the third verification code has failed, and a prompt message is returned to the key distribution center, or the process is terminated.

[0168] Step 522: If the verification is successful, the server sends a session request response message to the terminal device.

[0169] The session request response message includes the identifier of the terminal device, the identifier of the server, a third random number, and a fourth verification code; the fourth verification code is a verification code generated by using a message verification code algorithm based on the session key pair of the identifier of the terminal device, the identifier of the server, and the third random number.

[0170] Step 523: The terminal device receives the session request response message, compares the third random number generated by the terminal device with the third random number in the session request response message, and determines whether the session request response message is a replay message.

[0171] In this embodiment of the application, if the third random number in the session request response message is the same as the third random number generated by the terminal device, the session request response message is determined not to be a replay message; if the third random number in the session request response message is different from the third random number generated by the terminal device, the session request response message is determined to be a replay message.

[0172] Step 524: If the session request response message is not a replay message, the terminal device will conduct secure communication with the server based on the session key.

[0173] In this embodiment, the terminal device uses a message verification code algorithm to generate a fourth reference verification code based on the session key, the terminal device identifier, the server identifier, and a third random number in the session request response message. Then, the fourth reference verification code is compared with the fourth verification code. If the fourth reference verification code and the fourth verification code are the same, it means that the verification of the fourth verification code has passed, and the terminal device conducts secure communication with the server based on the session key. If the fourth reference verification code and the fourth verification code are not completely the same, it means that the verification of the fourth verification code has failed, and the process is terminated.

[0174] It should be noted that the descriptions of the same steps and contents as in other embodiments in this embodiment can be found in the descriptions in other embodiments, and will not be repeated here.

[0175] In some embodiments, such as Figure 6 As shown, the method provided in this embodiment of the invention includes the following:

[0176] Step A1: The terminal device sends a key request to the key update terminal device.

[0177] The key request is used to request a one-time key to connect to the key distribution center.

[0178] Step A2: The key update terminal device receives the key request and sends the key request to the first quantum key distribution node, such as QKDA.

[0179] Step A3: QKD A and the third quantum key distribution node, such as QKD C, perform QKD key negotiation.

[0180] QKD C is a quantum key distribution node connected to KDC; QKD A is a quantum key distribution node connected to the key update terminal device.

[0181] Step A4: QKD C sends the key file to KDC; QKD A sends the key file to the key update terminal device.

[0182] The key file includes one or more keys, as well as metadata for each key.

[0183] Furthermore, the key update terminal device receives the key file sent by the first quantum key distribution node, i.e., QKD A; the key distribution center receives the key file sent by the third quantum key distribution node, i.e., QKD C.

[0184] Step A5: Key update terminal device binding terminal, such as the key metadata corresponding to the user's identifier and key on the terminal.

[0185] The key metadata includes a key identifier, a source identifier, and a destination identifier; the source identifier is the identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is the identifier corresponding to the binding between the key distribution center and the third quantum key distribution node.

[0186] Step A6: The key update terminal device sends a key file to the terminal device; further, the terminal device receives the key file.

[0187] Step A7: The key distribution center receives the mapping information between the terminal and the key metadata corresponding to the key sent by the key update terminal device through a secure channel.

[0188] The key metadata includes a key identifier, a source identifier, and a destination identifier; the source identifier is the identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is the identifier corresponding to the binding between the key distribution center and the third quantum key distribution node.

[0189] It should be noted that after receiving the mapping information, the key distribution center binds the terminal based on the mapping information, such as the user's identifier on the terminal and the key metadata corresponding to the key.

[0190] Step A8: The key distribution center updates the key file based on the mapping information.

[0191] For example, a mobile user goes to an operator's service center and applies for bulk injection of keys from QKDN at a key update terminal device. The key update terminal device initiates a key request to the connected QKD A node. The QKD A node and the QKD C node connected to the KDC initiate a QKD key negotiation process, generating a key file containing bulk keys and key metadata for key management. The key file is output to both the key update terminal and the KDC. The key update terminal device binds the mobile user's identifier IDx with the key metadata and transmits it to the KDC through a long-term secure channel between the key update terminal and the KDC. The KDC finds the corresponding keys through the key metadata and binds the user's identifier IDx with these keys and the key metadata.

[0192] For example, the mobile terminal uses an authentication encryption key to mutually authenticate with the KDC. The KDC requests a key from the QKDN layer between the QKDA node (connection key update terminal) and the QKD E node (connection server Y). After obtaining this key, the KDC uses it as a session key and distributes it to the mobile terminal and the server. The mobile terminal uses the session key to establish secure communication between the mobile terminal and the server. The session key distribution process is as follows: Figure 7 As shown.

[0193] Step 701: Mobile terminal X sends a session key request message to KDC.

[0194] For example, mobile terminal X sends message 1 to KDC; the content of message 1 includes IDx, IDy, N1x, KeyID, and MAC1.

[0195] Here, IDx is the identifier of mobile terminal X, IDy is the identifier of server Y, N1x is a one-time random number generated by mobile terminal X, KeyID is the identifier of the authentication encryption key used by mobile terminal this time, and MAC1 is the message verification code generated based on the authentication encryption key pair IDx, IDy, N1x, and KeyID using a message verification code algorithm such as HMAC; its calculation formula is as follows: MAC1 = HMAC(AE-key, IDx‖IDy‖N1x‖KeyID); here, AE-key is the authentication encryption key corresponding to KeyID, and ‖ is the string concatenation.

[0196] Step 702: KDC sends a key request message to the access node QKDN C in the QKDN it is connected to.

[0197] For example, KDC sends message 2 to the QKD C node; the content of message 2 includes ID. QKD-A ID QKD-E .

[0198] Here, ID QKD-AID QKD-E These are the identifiers for node QKD A and node QKD E, respectively.

[0199] It should be noted that after receiving message 1, the KDC searches for the corresponding authentication encryption key AE-key in the storage based on the KeyID in message 1. If not found, the process terminates. When the authentication encryption key AE-key is found, it is used to verify MAC1. If the verification is successful, it proves that message 1 has not been tampered with by an attacker, and also proves that the message sender is mobile terminal X. Based on IDx and KeyID, the KDC determines from which key update terminal mobile terminal X obtained the authentication encryption key, and the QKD node identifier in the key update terminal's QKDN, thereby determining the QKD source node (QKD A) of the required key in the QKDN. Based on IDy, the KDC confirms that the QKD destination node of the required key in the QKDN is QKD E (connected to server Y); that is, based on IDx, KeyID, and IDy, the KDC determines the key Kae required between the QKD A node (connected to the key update terminal) and the QKD E node (connected to server Y).

[0200] Step 703: QKD C sends a key request response message to KDC.

[0201] For example, the QKD C node sends message 3 to the KDC; the content of message 3 includes Kae and MetaKae.

[0202] Here, Kae is the key between QKD A node and QKD E node, i.e., the session key, and MetaKae is the key metadata.

[0203] In this embodiment of the application, after the QKD C node receives message 2, the QKD C node determines the ID... QKD-A ID QKD-E The system confirms the need for a key Kae between QKD node A (connected to the key update terminal device) and QKD node E (connected to server Y). QKD node C retrieves the key Kae and key metadata MetaKae from the QKDN. QKD node C outputs Kae and MetaKae to the KDC via message 3. The KDC uses the key Kae as the session key SE-key.

[0204] Step 704: KDC sends session information and session key to server Y.

[0205] In this embodiment of the application, KDC transmits session information and session key to server Y through a secure channel with server Y.

[0206] For example, KDC sends message 4 to server Y; the content of message 4 includes IDx, IDy, N1x, and SE-key.

[0207] Step 705: Server Y sends a one-time random number Ny to KDC.

[0208] In this embodiment, after receiving message 4, server Y generates a one-time random number Ny for subsequent replay attack prevention and binds Ny to the session key SE-key. Server Y then transmits Ny to KDC through a secure channel.

[0209] For example, server Y sends message 5 to KDC; the content of message 5 includes Ny.

[0210] Step 706: KDC sends a session key request response message to mobile terminal X.

[0211] For example, KDC sends message 6 to mobile terminal X; the content of message 6 includes IDx, ID KDC N1x, Ny, [SE-key] AE-key , MAC2.

[0212] Here, [SE-key] AE-key This indicates that the session key SE-key is encrypted using an encryption algorithm, such as AES, based on the authentication encryption key AE-key; MAC2 is based on the authentication encryption key pair IDx, ID KDC N1x and Ny use a message verification code algorithm, such as HMAC, to generate a message verification code. The calculation formula is as follows: MAC2 = HMAC(AE-key, IDx‖ID) KDC ||N1x||Ny||[SE-key] AE-key Here, KDC uses both encryption algorithms and message verification code algorithms. The above encryption functions can also be implemented using authentication encryption algorithms based on authentication encryption keys.

[0213] Furthermore, KDC removes the one-time authentication encryption key from the secure storage area.

[0214] Step 707: Mobile terminal X sends a session request to server Y.

[0215] For example, mobile terminal X sends message 7 to server Y; the content of message 7 includes IDx, IDy, N2x, Ny, and MAC3.

[0216] Here, N2x is a one-time random number generated by mobile terminal X, and MAC3 is a message verification code generated based on the session key SE-key using a message verification code algorithm such as HMAC on IDx, IDy, N2x, and Ny. The calculation formula is as follows: MAC3 = HMAC(SE-key, IDx‖IDy‖N2x‖Ny).

[0217] It should be noted that after receiving message 6, mobile terminal X compares N1x in message 6 with N1x in message 1. If they are equal, it can be determined that message 6 is not a replay message. MAC2 is verified using the authentication encryption key. If the verification is successful, it proves that the communicating party is KDC. Mobile terminal X deletes the one-time authentication encryption key. Further, mobile terminal X generates a session request and sends it to server Y.

[0218] Step 708: Server Y sends a session request response message to mobile terminal X.

[0219] For example, server Y sends message 8 to mobile terminal X; the content of message 8 includes IDy, IDx, N2x, and MAC4.

[0220] Here, MAC4 is a message verification code generated based on the session key SE-key using a message verification code algorithm such as HMAC on IDy, IDx, and N2x. The calculation formula is as follows: MAC4 = HMAC(SE-key, IDy‖IDx‖N2x).

[0221] In this embodiment, after receiving message 7, server Y compares the received Ny with the Ny sent in message 5. If they are the same, it confirms that message 7 is not a replay. Based on Ny, server Y finds the corresponding session key SE-key. Server Y uses the SE-key to verify MAC3. If the verification passes, it proves the authenticity of mobile terminal X and that it possesses the session key. Server Y generates a session request response message and sends it to mobile terminal X. After receiving message 8, mobile terminal X compares the received N2x with the N2x sent in the message. If they are the same, it confirms that message 8 is not a replay. Mobile terminal X uses the session key SE-key to verify MAC4. If the verification passes, it proves that the communicating party is server Y and that it possesses the session key SE-key.

[0222] Embodiments of this application provide a key distribution center, which can be used to implement... Figure 4 to Figure 5 A corresponding embodiment provides a secure communication method, referring to... Figure 8 As shown, the key distribution center 800 includes:

[0223] The first receiving module 801 is used to receive a session key request message sent by a terminal device; wherein, the session key request message is used to request to obtain a session key; the session key request message includes an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of the server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm based on the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key;

[0224] The first processing module 802 is used to determine, based on the session key request message, the key between the first quantum key distribution node connected to the key update terminal device and the second quantum key distribution node connected to the server; wherein, the key update terminal device injects an authentication encryption key into the terminal device;

[0225] The first sending module 803 is used to send a key request message to a third quantum key distribution node connected to the key distribution center; wherein the key request message includes the identifier of the first quantum key distribution node and the identifier of the second quantum key distribution node;

[0226] The first receiving module 801 is used to receive a key request response message sent by the third quantum key distribution node; wherein the key request response message includes a session key and metadata of the session key for secure communication between the terminal device and the server;

[0227] The first sending module 803 is used to send session keys to terminal devices and servers.

[0228] In other embodiments of this application, the first processing module 802 is used to encrypt the session key based on the authentication encryption key to obtain the encrypted session key;

[0229] The first sending module 803 is used to send the encrypted session key to the terminal device.

[0230] In other embodiments of this application, the first processing module 802 is used to determine an authentication encryption key based on the identifier of the authentication encryption key; verify a first verification code based on the authentication encryption key; if the verification is successful, determine that the session key request message was sent by the terminal device; determine the source node corresponding to the session key as the first quantum key distribution node based on the identifier of the terminal device and the identifier of the authentication encryption key; and determine the destination node corresponding to the session key as the second quantum key distribution node based on the identifier of the server.

[0231] In other embodiments of this application, the first sending module 803 is used to send a session key, the identifier of the terminal device, the identifier of the server, and a first random number to the server through a first secure channel.

[0232] In other embodiments of this application, the first receiving module 801 is used to receive a second random number sent by the server through a first secure channel; wherein the second random number is generated by the server; the second random number can be bound to a session key; the second random number is used to prevent replay attacks and to determine the corresponding session key.

[0233] In other embodiments of this application, the first sending module 803 is used to send a session key request response message to the terminal device; wherein, the session key request response message includes an encrypted session key, an identifier of the terminal device, an identifier of the key distribution center, a second random number generated by the server, a first random number, and a second verification code; the second verification code is a verification code generated by using a message verification code algorithm based on the authentication encryption key, the identifier of the terminal device, the identifier of the key distribution center, the second random number, the first random number, and the encrypted session key.

[0234] In other embodiments of this application, the first processing module 802 is used to delete the authentication encryption key from the secure storage area.

[0235] In other embodiments of this application, the first receiving module 801 is used to receive a key file sent by the third quantum key distribution node; wherein, the key file includes one or more keys and metadata corresponding to each key;

[0236] The first receiving module 801 is used to receive, through the second secure channel, mapping information between the terminal and the key metadata corresponding to the key sent by the key update terminal device; wherein, the key metadata includes a key identifier, a source identifier, and a destination identifier; the source identifier is the identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is the identifier corresponding to the binding between the key distribution center and the third quantum key distribution node;

[0237] The first processing module 802 is used to update the key file based on the mapping information.

[0238] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0239] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0240] Embodiments of this application provide a terminal device that can be used to implement... Figure 4 to Figure 5 A corresponding embodiment provides a secure communication method, referring to... Figure 9 As shown, the terminal device 900 includes:

[0241] The second sending module 901 is used to send a session key request message to the key distribution center; wherein, the session key request message is used to request to obtain a session key; the session key request message includes an identifier of the authentication encryption key, an identifier of the terminal device, an identifier of the server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm based on the identifier of the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key;

[0242] The second receiving module 902 is used to receive the session key sent by the key distribution center; wherein, the session key is used for secure communication between the terminal device and the server; the session key is the key between the second quantum key distribution node connected to the server and the first quantum key distribution node connected to the key update terminal device.

[0243] In other embodiments of this application, the second receiving module 902 is used to receive a session key request response message sent by the key distribution center; wherein, the session key request response message includes an encrypted session key, an identifier of the terminal device, an identifier of the key distribution center, a second random number generated by the server, a first random number, and a second verification code; the second verification code is a verification code generated by using a message verification code algorithm based on the authentication encryption key, the identifier of the terminal device, the identifier of the key distribution center, the second random number, the first random number, and the encrypted session key; the encrypted session key is obtained by the key distribution center encrypting the session key based on the authentication encryption key.

[0244] In other embodiments of this application, the second processing module 903 is used to compare the first random number in the session key request response message with the first random number generated by the terminal device to determine whether the session key request response message is a replay message; if the session key request response message is not a replay message, the second verification code is verified based on the authentication encryption key; if the verification is successful, it is proven that the communication counterpart is the key distribution center, and the authentication encryption key is deleted.

[0245] In other embodiments of this application, the second sending module 901 is used to send a session request to the server; wherein, the session request includes the identifier of the terminal device, the identifier of the server, a third random number generated by the terminal device, a second random number, and a third verification code; the third verification code is a verification code generated by using a message verification code algorithm based on the session key pair of the identifier of the terminal device, the identifier of the server, the third random number, and the second random number.

[0246] In other embodiments of this application, the second receiving module 902 is used to receive a session request response message sent by the server; wherein the session request response message includes the identifier of the terminal device, the identifier of the server, a third random number and a fourth verification code; the fourth verification code is a verification code generated by using a message verification code algorithm based on the session key pair of the identifier of the terminal device, the identifier of the server and the third random number;

[0247] The second processing module 903 is used to compare the third random number generated by the terminal device with the third random number in the session request response message to determine whether the session request response message is a replay message; if the session request response message is not a replay message, it performs secure communication with the server based on the session key.

[0248] In other embodiments of this application, the second sending module 901 is used to send a key request to the key update terminal device; wherein, the key request is used to request to obtain a one-time key for connecting to the key distribution center;

[0249] The second receiving module 902 is used to receive a key file sent by the key update terminal device; wherein the key file includes one or more keys and metadata corresponding to each key.

[0250] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0251] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0252] Embodiments of this application provide a server that can be used to implement Figure 4 to Figure 5 A corresponding embodiment provides a secure communication method, referring to... Figure 10 As shown, server 1000 includes:

[0253] The third receiving module 1001 is used to receive, through the first secure channel, a transmission session key, an identifier of the terminal device, an identifier of the server, and a first random number generated by the terminal device, sent by the key distribution center; wherein, the session key is used for secure communication between the terminal device and the server; the session key is the key between the second quantum key distribution node connected to the server and the first quantum key distribution node connected to the key update terminal device; the key update terminal device injects an authentication encryption key into the terminal device.

[0254] In other embodiments of this application, the third sending module 1002 is used to send a second random number to the key distribution center through a first secure channel; wherein the second random number is generated by the server; the second random number can be bound to a session key; the second random number is used to prevent replay attacks and determine the corresponding session key.

[0255] In other embodiments of this application, the third receiving module 1001 is used to receive a session request sent by a terminal device; wherein, the session request includes the identifier of the terminal device, the identifier of the server, a third random number generated by the terminal device, a second random number, and a third verification code; the third verification code is a verification code generated based on the session key pair of the identifier of the terminal device, the identifier of the server, the third random number, and the second random number using a message verification code algorithm;

[0256] The third processing module 1003 is used to compare the second random number generated by the server with the second random number in the session request to determine whether the session request is a replay message.

[0257] The third acquisition module 1004 is used to acquire the session key corresponding to the second random number if the session request is not a replay message.

[0258] The third processing module 1003 is used to verify the third verification code based on the session key;

[0259] The third sending module 1002 is used to send a session request response message to the terminal device if the verification is successful. The session request response message includes the identifier of the terminal device, the identifier of the server, a third random number, and a fourth verification code. The fourth verification code is a verification code generated by using a message verification code algorithm based on the session key pair of the identifier of the terminal device, the identifier of the server, and the third random number.

[0260] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0261] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0262] This application provides a key update terminal device, which can be used to implement a secure communication method provided in this application. (Refer to...) Figure 11 As shown, the key update terminal device 1100 includes:

[0263] The fourth receiving module 1101 is used to receive a key request sent by the terminal device; wherein the key request is used to request a one-time key for connecting to the key distribution center;

[0264] The fourth receiving module 1101 is used to receive a key file sent by the first quantum key distribution node; wherein the key file includes one or more keys and metadata corresponding to each key;

[0265] The fourth processing module 1102 is used to bind the terminal and the key metadata corresponding to the key; wherein, the key metadata includes a key identifier, a source identifier and a destination identifier; the source identifier is the identifier corresponding to the binding between the key update terminal device and the first quantum key distribution node; the destination identifier is the identifier corresponding to the binding between the key distribution center and the third quantum key distribution node;

[0266] The fourth sending module 1103 is used to send a key file to the terminal device.

[0267] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0268] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0269] Embodiments of this application provide a third quantum key distribution node, which can be used to implement... Figure 4 to Figure 5 A corresponding embodiment provides a secure communication method, referring to... Figure 12 As shown, the third quantum key distribution node 1200 includes:

[0270] The fifth receiving module 1201 is used to receive a key request message sent by the key distribution center; wherein, the key request message is used to obtain the key between the first quantum key distribution node connected to the key update terminal device and the second quantum key distribution node connected to the server; the key request message includes the identifier of the first quantum key distribution node and the identifier of the second quantum key distribution node;

[0271] The fifth processing module 1202 is used to execute the key generation process between the first quantum key distribution node and the second quantum key distribution node to obtain the session key;

[0272] The fifth sending module 1203 is used to send a key request response message to the key distribution center; wherein the key request response message includes a session key and the session key metadata for secure communication between the terminal device and the server.

[0273] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0274] It should be noted that, in the embodiments of this application, if the above-mentioned secure communication method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, ROMs, magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0275] Figure 13 This is a schematic structural diagram of a communication device 1300 provided in an embodiment of this application. This communication device can function as a key distribution center / terminal device / server / key update terminal device / third quantum key distribution node. Figure 13 The communication device 1300 shown includes a first processor 1310, which can call and run computer programs from memory to implement the methods in the embodiments of this application.

[0276] Optionally, such as Figure 13 As shown, the communication device 1300 may further include a first memory 1320. The first processor 1310 can call and run computer programs from the first memory 1320 to implement the methods in the embodiments of this application.

[0277] The first memory 1320 can be a separate device independent of the first processor 1310, or it can be integrated into the first processor 1310.

[0278] Optionally, such as Figure 13 As shown, the communication device 1300 may also include a transceiver 1330. The first processor 1310 can control the transceiver 1330 to communicate with other devices. Specifically, it can send information or data to other devices or receive information or data sent by other devices.

[0279] The transceiver 1330 may include a transmitter and a receiver. The transceiver 1330 may further include an antenna, and the number of antennas may be one or more.

[0280] Optionally, the communication device 1300 may specifically be a key distribution center / terminal device / server / key update terminal device / third quantum key distribution node in the embodiments of this application, and the communication device 1300 may implement the corresponding processes implemented by the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0281] In some embodiments, this application also provides a computer program product, including a computer program that can be executed by a first processor 1310 of a communication device 1300 to perform the steps described in any of the foregoing methods.

[0282] It should be understood that the processor in the embodiments of this application may be an integrated circuit chip with signal processing capabilities. In implementation, the steps of the above method embodiments can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0283] As one embodiment, the processor may include one or more general-purpose central processing units (CPUs). Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used for processing data (e.g., executing instructions).

[0284] It is understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be ROM, Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), or flash memory. The volatile memory can be Random Access Memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0285] It should be understood that the above-described memory is exemplary and not a limiting description. For example, the memory in the embodiments of this application may also be static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM), etc. That is to say, the memory in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0286] This application also provides a computer-readable storage medium for storing computer programs.

[0287] Optionally, the computer-readable storage medium can be applied to the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node in the embodiments of this application, and the computer program causes the computer to execute the corresponding processes implemented by the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0288] In the above embodiments, the implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product.

[0289] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0290] The secure communication method, key distribution center, terminal device, server, key update terminal device, third quantum key distribution node, computer-readable storage medium, and computer program product provided in the embodiments of this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0291] It should be understood that the phrases "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some implementations," or "some embodiments" mentioned throughout the specification mean that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, the phrases "an embodiment," "an embodiment," "an embodiment of this application," "the foregoing embodiment," "some implementations," or "some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0292] Unless otherwise specified, the execution of any step in the embodiments of this application by the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node may be performed by the processor of the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node. Unless otherwise specified, the embodiments of this application do not limit the order in which the key distribution center / terminal device / server / key update terminal device / third quantum key distribution node performs the following steps. Furthermore, the methods used to process data in different embodiments may be the same or different methods.

[0293] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0294] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0295] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0296] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0297] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0298] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0299] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0300] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0301] The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0302] It should be noted that in the various embodiments involved in this application, all steps or some steps may be performed, as long as a complete technical solution can be formed.

[0303] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of secure communication, characterized by, The method is applied to a key distribution center, and the method comprises the following steps: receiving a session key request message sent by a terminal device; wherein the session key request message is used for requesting to obtain a session key; the session key request message comprises an identifier of an authentication encryption key, an identifier of the terminal device, an identifier of a server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm on the basis of the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key; determining, on the basis of the session key request message, a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with the server; wherein the key update terminal device is used for importing the authentication encryption key into the terminal device; sending a key request message to a third quantum key distribution node connected with the key distribution center; wherein the key request message comprises an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node; receiving a key request response message sent by the third quantum key distribution node; wherein the key request response message comprises a session key used for secure communication between the terminal device and the server and metadata of the session key; sending the session key to the terminal device and the server.

2. The method of claim 1, wherein, The step of sending the session key to the terminal device comprises the following steps: encrypting the session key on the basis of the authentication encryption key to obtain an encrypted session key; sending the encrypted session key to the terminal device.

3. The method of claim 1, wherein, The step of determining, on the basis of the session key request message, the key between the first quantum key distribution node connected with the key update terminal device and the second quantum key distribution node connected with the server comprises the following steps: determining the authentication encryption key on the basis of the identifier of the authentication encryption key; verifying the first verification code on the basis of the authentication encryption key; if the verification is passed, determining that the session key request message is sent by the terminal device; determining, on the basis of the identifier of the terminal device and the identifier of the authentication encryption key, that a source node corresponding to the session key is the first quantum key distribution node; determining, on the basis of the identifier of the server, that a destination node corresponding to the session key is the second quantum key distribution node.

4. The method of claim 1, wherein, The step of sending the session key to the server comprises the following step: sending, through a first secure channel, the session key, the identifier of the terminal device, the identifier of the server, and the first random number to the server.

5. The method of claim 1, wherein, The method further comprises the following steps: receiving a second random number sent by the server through the first secure channel; wherein the second random number is generated by the server; the second random number can be bound with the session key; and the second random number is used for anti-replay attack and determining a corresponding session key.

6. The method of claim 2, wherein, The step of sending the encrypted session key to the terminal device comprises the following steps: sending a session key request response message to the terminal device; The session key request response message includes the encrypted session key, the identifier of the terminal device, the identifier of the key distribution center, the second random number generated by the server, the first random number, and the second verification code; the second verification code is a verification code generated by using a message verification code algorithm on the basis of the authentication encryption key, the identifier of the terminal device, the identifier of the key distribution center, the second random number, the first random number, and the encrypted session key.

7. The method of claim 6, wherein, The method further includes: deleting the authentication encryption key from the secure storage area.

8. The method of claim 1, wherein, The method further includes: receiving a key file sent by the third quantum key distribution node; wherein the key file includes one or more keys and metadata corresponding to each key; receiving, through the second secure channel, mapping information between the terminal and the key corresponding to the key metadata sent by the key updating terminal device; wherein the key metadata includes a key identifier, a source identifier, and a destination identifier; the source identifier is an identifier corresponding to the binding of the key updating terminal device and the first quantum key distribution node; the destination identifier is an identifier corresponding to the binding of the key distribution center and the third quantum key distribution node; updating the key file based on the mapping information.

9. A method of secure communication, characterized by The method applied to a terminal device includes: sending a session key request message to a key distribution center; wherein the session key request message is used to request to obtain a session key; the session key request message includes an identifier of an authentication encryption key, an identifier of a terminal device, an identifier of a server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm on the basis of the authentication encryption key, the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key; receiving a session key sent by the key distribution center; wherein the session key is used for secure communication between the terminal device and the server; the session key is a key between a second quantum key distribution node connected with the server and a first quantum key distribution node connected with a key updating terminal device; the key updating terminal device is used to import the authentication encryption key into the terminal device.

10. The method of claim 9, wherein, The receiving of the session key sent by the key distribution center includes: receiving a session key request response message sent by the key distribution center; The session key request response message includes the encrypted session key, the identifier of the terminal device, the identifier of the key distribution center, the second random number generated by the server, the first random number, and the second verification code; the second verification code is a verification code generated by using a message verification code algorithm on the basis of the authentication encryption key, the identifier of the terminal device, the identifier of the key distribution center, the second random number, the first random number, and the encrypted session key; the encrypted session key is obtained by encrypting the session key by the key distribution center on the basis of the authentication encryption key.

11. The method of claim 10, wherein, The method further includes: comparing the first random number in the session key request response message with the first random number generated by the terminal device to determine whether the session key request response message is a replay message; If the session key request response message is not a replay message, verifying the second verification code based on the authentication encryption key; If the verification is passed, it is proved that the communication party is the key distribution center, and the authentication encryption key is deleted.

12. The method of claim 11, wherein, The method further comprises: sending a session request to a server; wherein the session request comprises an identifier of the terminal device, an identifier of the server, a third random number generated by the terminal device, a second random number, and a third verification code; the third verification code is a verification code generated by using a message verification code algorithm on the identifier of the terminal device, the identifier of the server, the third random number, and the second random number based on the session key.

13. The method of claim 12, wherein, The method further comprises: receiving a session request response message sent by the server; wherein the session request response message comprises an identifier of the terminal device, an identifier of the server, a third random number, and a fourth verification code; the fourth verification code is a verification code generated by using a message verification code algorithm on the identifier of the terminal device, the identifier of the server, and the third random number based on the session key; comparing the third random number generated by the terminal device with the third random number in the session request response message to determine whether the session request response message is a replay message; If the session request response message is not a replay message, performing secret communication with the server based on the session key.

14. The method of claim 9, wherein, The method further comprises: sending a key request to the key update terminal device; wherein the key request is used to request to obtain a one-time key connected to the key distribution center; receiving a key file sent by the key update terminal device; wherein the key file comprises one or more keys and metadata corresponding to each key.

15. A method of secure communication, characterized by Applied to a server, the method comprises: receiving, through a first secure channel, a session key, an identifier of a terminal device, an identifier of the server, and a first random number generated by the terminal device sent by a key distribution center; wherein the session key is used for the terminal device and the server to perform secret communication; the session key is a key between a second quantum key distribution node connected to the server and a first quantum key distribution node connected to a key update terminal device; the key update terminal device is used for the terminal device to import an authentication encryption key.

16. The method of claim 15, wherein, The method further comprises: sending, through the first secure channel, a second random number to the key distribution center; wherein the second random number is generated by the server; the second random number can be bound with the session key; the second random number is used for anti-replay attack and determining the corresponding session key.

17. The method of claim 15, wherein, The method further comprises: receiving a session request sent by a terminal device; wherein the session request comprises an identifier of the terminal device, an identifier of the server, a third random number generated by the terminal device, a second random number, and a third verification code; the third verification code is a verification code generated by using a message verification code algorithm on the identifier of the terminal device, the identifier of the server, the third random number, and the second random number based on the session key; comparing the second random number generated by the server with the second random number in the session request to determine whether the session request is a replay message; If the session request is not a replay message, obtaining a session key corresponding to the second random number; Based on the session key, verifying the third verification code; If the verification is passed, sending a session request response message to the terminal device; wherein the session request response message includes the identity of the terminal device, the identity of the server, the third random number and the fourth verification code; the fourth verification code is a verification code generated by the terminal device using the message authentication code algorithm based on the session key, the identity of the terminal device, the identity of the server and the third random number.

18. A method of secure communication, characterized by The method applied to the key update terminal device comprises: Receiving a key request sent by a terminal device; wherein the key request is used to request to obtain a one-time key connected to a key distribution center; the key update terminal device is used to import an authentication encryption key for the terminal device; Receiving a key file sent by a first quantum key distribution node; wherein the key file includes one or more keys and metadata corresponding to each key; the first quantum key distribution node is connected to the key update terminal device; Binding the key metadata corresponding to the terminal and the key; wherein the key metadata includes key identification, source identification and destination identification; the source identification is the identification corresponding to the binding of the key update terminal device and the first quantum key distribution node; the destination identification is the identification corresponding to the binding of the key distribution center and the third quantum key distribution node; the third quantum key distribution node is connected to the key distribution center; Sending the key file to the terminal device.

19. A method of secure communication, characterized by The method applied to the third quantum key distribution node comprises: Receiving a key request message sent by a key distribution center; wherein the key request message is used to obtain a key between a first quantum key distribution node connected to a key update terminal device and a second quantum key distribution node connected to a server; the key request message includes the identification of the first quantum key distribution node and the identification of the second quantum key distribution node; Performing a key generation process between the first quantum key distribution node and the second quantum key distribution node to obtain a session key; Sending a key request response message to the key distribution center; wherein the key request response message includes a session key used for secure communication between the terminal device and the server and metadata of the session key.

20. A key distribution center, characterized by, The key distribution center comprises: A first receiving module is configured to receive a session key request message sent by a terminal device; wherein the session key request message is used to request to obtain a session key; the session key request message includes the identification of an authentication encryption key, the identification of the terminal device, the identification of the server, the first random number generated by the terminal device and the first verification code; the first verification code is a verification code generated by the terminal device using the message authentication code algorithm based on the authentication encryption key, the identification of the terminal device, the identification of the server, the first random number and the identification of the authentication encryption key; The first processing module is configured to determine, based on the session key request message, a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with a server, wherein the key update terminal device is configured to import an authentication encryption key for the terminal device. The first sending module is configured to send a key request message to a third quantum key distribution node connected with a key distribution center, wherein the key request message comprises an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node. The first receiving module is configured to receive a key request response message sent by the third quantum key distribution node, wherein the key request response message comprises a session key used for secure communication between the terminal device and the server and metadata of the session key. The first sending module is configured to send the session key to the terminal device and the server.

21. A terminal device, comprising: The terminal device comprises: The second sending module is configured to send a session key request message to a key distribution center, wherein the session key request message is used to request a session key, and the session key request message comprises an identifier of an authentication encryption key, an identifier of a terminal device, an identifier of a server, a first random number generated by the terminal device, and a first verification code; the first verification code is a verification code generated by using a message verification code algorithm based on the identifier of the terminal device, the identifier of the server, the first random number, and the identifier of the authentication encryption key. The second receiving module is configured to receive a session key sent by the key distribution center, wherein the session key is used for secure communication between the terminal device and the server, and the session key is a key between a second quantum key distribution node connected with the server and a first quantum key distribution node connected with a key update terminal device; the key update terminal device is configured to import an authentication encryption key for the terminal device.

22. A server, comprising: The server comprises: The third receiving module is configured to receive, through a first secure channel, a session key, an identifier of a terminal device, an identifier of a server, and a first random number generated by the terminal device, which are sent by a key distribution center; wherein the session key is used for secure communication between the terminal device and the server, and the session key is a key between a second quantum key distribution node connected with the server and a first quantum key distribution node connected with a key update terminal device; the key update terminal device is configured to import an authentication encryption key for the terminal device.

23. A key update terminal device, characterized by comprising: The key update terminal device comprises: The fourth receiving module is configured to receive a key request sent by a terminal device, wherein the key request is used to request a one-time key connected with a key distribution center; the key update terminal device is configured to import an authentication encryption key for the terminal device. The fourth receiving module is configured to receive a key file sent by a first quantum key distribution node, wherein the key file comprises one or more keys and metadata corresponding to each key; the first quantum key distribution node is connected with the key update terminal device. The fourth processing module is configured to bind the terminal with key metadata corresponding to the key; the key metadata comprises a key identifier, a source identifier, and a destination identifier; the source identifier is an identifier corresponding to the binding of the key update terminal device and the first quantum key distribution node; the destination identifier is an identifier corresponding to the binding of the key distribution center and the third quantum key distribution node; and the third quantum key distribution node is connected with the key distribution center. The fourth sending module is configured to send the key file to the terminal device.

24. A third quantum key distribution node, comprising: The third quantum key distribution node comprises: The fifth receiving module is configured to receive a key request message sent by the key distribution center; the key request message is used to obtain a key between a first quantum key distribution node connected with a key update terminal device and a second quantum key distribution node connected with a server; and the key request message comprises an identifier of the first quantum key distribution node and an identifier of the second quantum key distribution node. The fifth processing module is configured to perform a key generation process between the first quantum key distribution node and the second quantum key distribution node, and obtain a session key. The fifth sending module is configured to send a key request response message to the key distribution center; the key request response message comprises the session key used for secure communication between the terminal device and the server and metadata of the session key.

25. A communications device, characterized by The communication device comprises: A memory is configured to store executable instructions. A processor is configured to execute the executable instructions stored in the memory to implement the secure communication method in any one of claims 1 to 8, or the secure communication method in any one of claims 9 to 14, or the secure communication method in any one of claims 15 to 17, or the secure communication method in claim 18, or the secure communication method in claim 19.

26. A computer-readable storage medium, characterized in that, The computer readable storage medium stores one or more programs, which can be executed by one or more processors to implement the secure communication method in any one of claims 1 to 8, or the secure communication method in any one of claims 9 to 14, or the secure communication method in any one of claims 15 to 17, or the secure communication method in claim 18, or the secure communication method in claim 19.

27. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the secure communication method in any one of claims 1 to 8, or the secure communication method in any one of claims 9 to 14, or the secure communication method in any one of claims 15 to 17, or the secure communication method in claim 18, or the secure communication method in claim 19.

Images