Server, method and system for quantum key access and terminal equipment

Abstract

The invention discloses a server, method and system for quantum key access and terminal equipment. The server is connected with the client through a remote call protocol; the server comprises a server key access interface and a quantum SDK (Software Development Kit) for accessing a quantum key management system, and the server key access interface supports multi-process quantum key access of the client; a quantum SDK key access interface is packaged in the server key access interface, and the quantum SDK key access interface communicates with a quantum SDK; wherein the server key access interface is used for receiving a quantum key access request message sent by a client; calling a quantum SDK key access interface to request a quantum SDK to access a quantum key based on the quantum key access request message, and obtaining a quantum key access response message returned by the quantum key management system through the quantum SDK; returning the quantum key access response message to the client; multi-process access to the quantum key can be realized, and wide application of the quantum key is facilitated.

Description

Technical Field

[0001] The present application relates to the field of quantum secure communication technology, and in particular to a server, method, system and terminal device for quantum key access. Background Art

[0002] Quantum key is a new cryptographic system. Unlike traditional cryptographic systems, the security of quantum key depends on quantum physics rather than the complexity of mathematical operations. The quantum key management system is a management system used to provide quantum key generation and distribution services. During the business development process, it was found that in actual quantum key usage scenarios, there are often multiple services that need to access quantum keys at the same time, and the software development kit (SDK) interface provided by the quantum key management system currently on the market can only provide single-process access functions, which cannot meet the needs of multi-process access to quantum keys. Summary of the invention

[0003] The present application provides a quantum key access server, method, system and terminal device to solve the problem that quantum keys cannot be accessed by multiple processes.

[0004] In a first aspect, an embodiment of the present application provides a quantum key access server, wherein the server is connected to a client via a remote call protocol; the server comprises: a server key access interface and a quantum SDK for accessing a quantum key management system, wherein the server key access interface supports multi-process quantum key access of the client; a quantum SDK key access interface is encapsulated in the server key access interface, and the quantum SDK key access interface is used to call the quantum SDK to access the quantum key management system;

[0005] Among them, the server-side key access interface is used to receive the quantum key access request message sent by the client; call the quantum SDK key access interface to request access to the quantum key from the quantum SDK based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK; return the quantum key access response message to the client.

[0006] In a second aspect, an embodiment of the present application provides a quantum key access method, which is applied to a quantum key access server, and the method includes:

[0007] Receiving, via the server key access interface, a quantum key access request message sent by the client;

[0008] Through the server key access interface, the internally encapsulated quantum SDK key access interface is called to request the quantum SDK to access the quantum key based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK;

[0009] The quantum key access response message is returned to the client through the server key access interface.

[0010] In a third aspect, an embodiment of the present application provides a quantum key access system, including: a client, a server, and a quantum key management system; the client is connected to the server via a remote call protocol;

[0011] The client includes a client key access interface, the server includes a server key access interface and a quantum SDK for accessing a quantum key management system, the client key access interface is connected to the server key access interface via a remote call protocol, and the server key access interface supports multi-process quantum key access; the server key access interface is encapsulated with a quantum SDK key access interface, and the quantum SDK key access interface is used to call the quantum SDK to access the quantum key management system;

[0012] The client is used to initiate a key access request and send it to the server through the client key access interface; and receive a quantum key access response message returned by the server through the client key access interface;

[0013] The server is used to receive a quantum key access request message sent by the client through the server key access interface; call the quantum SDK key access interface encapsulated in the server key access interface, request quantum SDK access to the quantum key based on the quantum key access request message, obtain the quantum key access response message returned by the quantum key management system through the quantum SDK; and return the quantum key access response message to the client.

[0014] In a fourth aspect, an embodiment of the present application provides a terminal device, the terminal device comprising:

[0015] at least one processor;

[0016] and a memory communicatively coupled to the at least one processor;

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the quantum key access method described in any embodiment of the present application.

[0018] The technical solution of the embodiment of the present application provides a quantum key access server, method, system and terminal device, which is connected to the client through a remote call protocol; the server includes: a server key access interface and a quantum SDK for accessing a quantum key management system, the server key access interface supports multi-process quantum key access of the client; the server key access interface is encapsulated with a quantum SDK key access interface, the quantum SDK key access interface is used to call the quantum SDK to access the quantum key management system; wherein the server key access interface is used to receive a quantum key access request message sent by the client; the quantum SDK key access interface is called to request quantum SDK to access the quantum key based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK; and the quantum key access response message is returned to the client. The server is connected to the client through a remote call protocol, and a server key access interface supporting multi-process quantum key access and having a quantum SDK access function and a quantum SDK for accessing the quantum key management system are encapsulated inside the server, so that the client can access the quantum key managed by the quantum key management system in multiple processes based on the remote call protocol, which solves the problem of being unable to access the quantum key in multiple processes and achieves the beneficial effect of expanding the application scope of the quantum key.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram of the structure of a quantum key access system provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of the structure of a server in a quantum key access system provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of the structure of a server and a quantum key management system in a quantum key access system provided in an embodiment of the present application;

[0024] Figure 4 A flowchart of a quantum key access method provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of the structure of another quantum key access system provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of a terminal device for implementing the quantum key access method of an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0029] Figure 1 A schematic diagram of the structure of a quantum key access system provided in an embodiment of the present application, which can be applied to the case of supporting multi-process quantum key access. The quantum key access system includes a client, a server, and a quantum key management system. In this embodiment, the server of quantum key access can provide an access platform for the multi-process quantum key access of the client.

[0030] like Figure 1 As shown, the server 10 includes: a server key access interface 110 and a quantum SDK 130, the server key access interface 110 supports multi-process quantum key access; the server key access interface 110 is encapsulated with a quantum SDK key access interface 120, and the quantum SDK key access interface 120 is used to call the quantum SDK 130 to access the quantum key management system 30; the server 10 is connected to the client 20 through a remote call protocol. Among them, the server key access interface 110 is used to receive a quantum key access request message sent by the client 20; the quantum SDK key access interface 120 is called to request quantum SDK 130 to access the quantum key based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system 30 through the quantum SDK 130; and the quantum key access response message is returned to the client 20.

[0031] Among them, the Remote Procedure Call (RPC) is a protocol that requests message services from a remote computer program over the network without having to understand the underlying network technology. The quantum key management system can be understood as a system for managing quantum keys. The quantum key management system can include: quantum key security media and quantum key security service platform. The quantum key security media is used to provide security authentication functions for the application of quantum keys, such as identity authentication, digital signatures, and data encryption. The quantum key security media can be, for example, quantum key U shields and quantum key TF cards; the quantum key security service platform is used to provide services for the storage, distribution, relay, management, and application of quantum keys.

[0032] The server key access interface can be understood as an interface set in the server for the client to access the quantum key. The access content of the quantum key may include the application, acquisition and destruction of the quantum key. In this embodiment, the server key access interface set in the server can support multi-process quantum key access. It is understandable that a corresponding client key access interface also needs to be set in the client to support the client to initiate multi-process quantum key access.

[0033] However, the server-side key access interface cannot directly access the quantum key management system. Therefore, it is necessary to encapsulate the corresponding quantum SDK key access interface in the server-side key access interface. The quantum SDK key access interface can be understood as an interface that can communicate directly with the quantum SDK. The quantum SDK can be understood as a collection of multiple software development tools that are used to help developers create, test and deploy software applications to call the quantum management system. It should be noted that in order to adapt to quantum key management systems of different manufacturers, types and models, quantum SDKs adapted to multiple different models of quantum key management systems can be encapsulated. The embodiment of the present invention does not limit this and can be configured according to actual needs.

[0034] The quantum key access request message can be understood as a message requesting access to a quantum key, and may include, for example, a service session ID, a local client device ID, and / or a peer client device ID, etc. The quantum key access response message can be understood as a message generated in response to the quantum key access request message.

[0035] Specifically, the server 10 of quantum key access is connected to each client 20 through a remote call RPC protocol. The server 10 of quantum key access receives the quantum key access request message sent by each client 20 based on the RPC protocol through the key access interface 110 that supports multi-process quantum key access; and calls the internally encapsulated quantum SDK key access interface 120 through the key access interface 110, and requests quantum key access to the quantum SDK 130 based on the quantum key access request message, so that the quantum key management system 30 returns the quantum key access response message through the quantum SDK 130. The server 10 of quantum key access accesses the quantum SDK by calling the internally encapsulated quantum SDK key access interface 120, obtains the quantum key access response message returned by the quantum key management system 30, and returns the quantum key access response message to the client 20.

[0036] The embodiment of the present invention provides a quantum key access server, which is connected to the client through a remote call protocol; and the server key access interface that supports multi-process quantum key access and has a quantum SDK access function and a quantum SDK for accessing a quantum key management system are encapsulated inside the server, which can realize multi-process quantum key access to the quantum key management system, thereby facilitating the wide application of quantum keys and meeting the requirements of usage scenarios. In addition, quantum SDKs adapted to multiple different models of quantum key management systems can be encapsulated, which improves the adaptability of the server to quantum key access.

[0037] In an optional embodiment, the quantum key access request message may include: a quantum key application request message, a quantum key acquisition request message, and a quantum key destruction request message. The quantum key application request message is used to request the application of a first quantum key, and the quantum key acquisition request message is used to request the acquisition of a second quantum key corresponding to the first quantum key. The quantum key destruction request message is used to request the destruction of a quantum key.

[0038] Correspondingly, the quantum key access response message may include: a quantum key application response message, a quantum key acquisition response message, and a quantum key destruction response message. The quantum key application response message is used to respond to a quantum key application request, and may include, for example, returning the cause of failure or the type of failure when the application request fails, such as if the application request is invalid or the application request has timed out; returning the allocated first quantum key when the application request succeeds. The quantum key acquisition response message is used to respond to a quantum key acquisition request, and may include, for example, returning the cause of failure or the type of failure when the acquisition request fails, such as if the acquisition request is invalid or the acquisition request has timed out; returning the allocated second quantum key when the acquisition request succeeds. The quantum key destruction response message is used to respond to a quantum key destruction request, and may include, for example, whether the destruction is successful, the destruction prompt information, and the cause of the destruction failure.

[0039] It should be noted that the first quantum key requested by the quantum key application request message and the second quantum key requested by the quantum key acquisition request message are a set of quantum keys for encryption and decryption. The first quantum key and the second quantum key can be determined according to the encryption algorithm used to generate the quantum key. For example, if a symmetric encryption algorithm is used, the first quantum key and the second quantum key are the same shared key. If an asymmetric encryption algorithm is used, the first quantum key is a quantum key private key, and the second quantum key is the corresponding quantum key public key.

[0040] Exemplarily, the application scenario of the quantum key application request and the quantum key acquisition request can be: in the process of creating a quantum key-based session between client A and client B, client A accesses the corresponding server key access interface through the corresponding client key access interface based on business needs, thereby sending a quantum key application request message to the quantum SDK through the encapsulated corresponding quantum SDK key access interface to access the quantum key management system through the corresponding quantum SDK. The quantum key application request message includes the ID of client B and the current session ID. The quantum key management system generates a first quantum key based on the quantum key application request, and returns the first quantum key to client A through the quantum SDK, the server key access interface, and the client key access interface. , so that client A can perform session encryption based on the first quantum key; client B having a conversation with client A accesses the corresponding server key access interface through the corresponding client key access interface, thereby sending a quantum key acquisition request message to the quantum SDK through the encapsulated corresponding quantum SDK key access interface, so as to access the quantum key management system through the corresponding quantum SDK to obtain the second quantum key corresponding to the first quantum key. The quantum key acquisition request message includes the ID of client A and the current session ID. The quantum key management system returns the second quantum key corresponding to the first quantum key to client B through the quantum SDK, the server key access interface, and the client key access interface, so that client B can perform session decryption based on the second quantum key.

[0041] Figure 2 A schematic diagram of the structure of another quantum key access server provided in an embodiment of the present application. As an optional embodiment of the present application, in order to satisfy the application request, acquisition request and destruction request for the quantum key, such as Figure 2 As shown, the server key access interface 110 includes: a server key application interface 111, a server key acquisition interface 112 and a server key destruction interface 113; the server key application interface 111 encapsulates a quantum SDK key application interface 121, the server key acquisition interface 112 encapsulates a quantum SDK key acquisition interface 122, and the server key destruction interface 113 encapsulates a quantum SDK key destruction interface 123;

[0042] Among them, the server-side key application interface 111 is used to call the quantum SDK key application interface 121 to request the quantum SDK 130 of the quantum key management system 30 to apply for a quantum key; the server-side key acquisition interface 112 is used to call the SDK key acquisition interface 122 to request the quantum SDK 130 of the quantum key management system 30 to obtain a quantum key; the server-side key destruction interface 113 is used to call the quantum SDK key destruction interface 123 to request the quantum SDK 130 of the quantum key management system 30 to destroy the quantum key.

[0043] Specifically, when the server-side key application interface 111 receives a quantum key application request message through the client's quantum key application interface, it calls the internally encapsulated quantum SDK key application interface to access the quantum key management system 30 through the quantum SDK 130 to request to apply for a quantum key, and obtains a quantum key application response message returned by the quantum key management system 30 through the quantum SDK 130. When the server-side key acquisition interface 112 receives a quantum key acquisition request message through the client's quantum key acquisition interface, it calls the internally encapsulated SDK key acquisition interface 122 to access the quantum key management system 30 through the quantum SDK 130 to request to obtain a quantum key, and obtains a quantum key acquisition response message returned by the quantum key management system 30 through the quantum SDK 130. When the server-side key destruction interface 113 receives a quantum key destruction request message through the client's quantum key destruction interface, it calls the internally encapsulated SDK key destruction interface 123 to access the quantum key management system 30 through the quantum SDK 130 to request to destroy the quantum key, and obtains a quantum key destruction response message returned by the quantum key management system 30 through the quantum SDK 130.

[0044] Figure 3 A schematic diagram of the structure of a server and a quantum key management system in a quantum key access system provided in an embodiment of the present application. Before the server calls the quantum SDK key access interface encapsulated in the server key access interface and requests the quantum key management system to access the quantum key based on the received quantum key access request message, it also needs to be initialized. Therefore, as an optional embodiment of the embodiment of the present application, Figure 3As shown, the server 10 also includes: a server initialization interface 140; a quantum SDK initialization interface 150 is encapsulated in the initialization interface 140; wherein the initialization interface 140 is used to call the quantum SDK initialization interface 150 to access the quantum SDK 130, and obtain the identity authentication information obtained by the quantum SDK 130 from the quantum key security medium 31 in the quantum key management system 30; based on the identity authentication information, a communication link is established between the quantum SDK 130 and the quantum key security service platform 32 in the quantum key management service system 30; the quantum SDK initialization interface 150 is called to access the quantum SDK 130, so that the quantum SDK 130 sends a network access authentication request message to the quantum key security service platform 32 based on the communication link, and obtains the authentication token returned by the quantum key security service platform 32.

[0045] Among them, the initialization interface can be understood as an interface for initializing the quantum SDK encapsulated inside the server. The quantum SDK initialization interface encapsulated inside the server initialization interface can be understood as an interface that can directly perform an initialization interaction process with the quantum SDK. The initialization process includes: a communication link creation process and a network access authentication process. It should be noted that the communication link creation process and the network access authentication process can be encapsulated in one interface or in two different interfaces, which depends on the design of the quantum key management service system, and the embodiment of the present invention does not limit this. Exemplarily, the communication link creation process and the network access authentication process are executed through the quantum SDK initialization interface; or the quantum SDK initialization interface includes: a communication link creation interface and a network access authentication interface, and the communication link creation process is executed through the communication link creation interface, and the network access authentication process is executed through the network access authentication interface.

[0046] The identity authentication information can be understood as the information used to authenticate the user identity of the quantum key security medium, and is used to determine whether the user has the authority to access the quantum key. The network access authentication request message is used to request network access authentication to obtain an authentication token. The authentication token Token is a temporary authentication identifier with a certain validity period.

[0047] Specifically, the corresponding quantum SDK initialization interface 150 is encapsulated in the server initialization interface 140, which is used to initialize the quantum SDK provided by the quantum key management system 30. Before receiving the quantum key access request message sent by the client through the server key access interface, the quantum SDK initialization interface 150 is called through the server initialization interface 140 to access the quantum SDK 130, and the identity authentication information is obtained from the quantum key security medium 31 in the quantum key management system 30 through the quantum SDK 130, and a communication link is established between the quantum SDK 130 and the quantum key security service platform 32 in the quantum key management system 30 based on the identity authentication information. The quantum SDK initialization interface 150 is called to access the quantum SDK 130, so that the quantum SDK 130 sends a network authentication request message to the quantum key security service platform 32 based on the created communication link, and the quantum SDK initialization interface 150 is called to access the quantum SDK 130 to obtain the authentication token returned by the quantum key security service platform 32 based on the communication link.

[0048] In another optional embodiment of the present invention, in order to clean up temporary files, release occupied memory and close the communication link after the quantum key access process of the server is completed, the server also needs to be deinitialized after the quantum key access process of the server is completed. Figure 3 As shown, the server 10 also includes: a server deinitialization interface 160; a quantum SDK deinitialization interface 170 is encapsulated in the server deinitialization interface 160; wherein the server deinitialization interface 160 is used to call the quantum SDK deinitialization interface 170 to clean up temporary files and release occupied memory after the quantum key access process of the server is completed, and access the quantum SDK 130, so that the quantum SDK 130 sends a communication link closing request message to the quantum key security service platform 32, and the communication link closing request message is used to request the quantum key security service platform to close the communication link.

[0049] Among them, the server deinitialization interface can be understood as an interface for deinitializing the quantum SDK encapsulated inside the server. The quantum SDK deinitialization interface encapsulated inside the server deinitialization interface can be understood as an interface that can directly interact with the quantum SDK for deinitialization. The deinitialization process includes: cleaning temporary files, releasing occupied memory, and closing the communication link. The communication link closing request message can be understood as a message for requesting to close the communication link.

[0050] Specifically, when the server detects that the quantum key access process of the server has ended, it calls the quantum SDK deinitialization interface 170 encapsulated in the deinitialization interface 160, cleans up the temporary files stored in the server and releases the memory occupied by the quantum key access process of the server, and accesses the quantum SDK 130 by calling the quantum SDK deinitialization interface 170, so that the quantum SDK 130 sends a communication link closing request message to the quantum key security service platform 32, so that the quantum key security service platform 32 disconnects the communication link with the quantum SDK 130 after receiving the communication link closing request message, and no longer receives the quantum key access request of the server. When the server accesses the quantum key again, it needs to re-execute the initialization process.

[0051] It should be noted that the quantum SDK packaged inside the server can be adjusted based on the SDK provided by the quantum key management system, and the original design of the quantum SDK should be retained as much as possible. For example, the quantum SDK packaged inside the server integrates the application, acquisition, destruction, initialization and deinitialization functions of the quantum key management system, such as the quantum SDK application interface, quantum SDK acquisition interface, quantum SDK destruction interface, quantum SDK initialization interface and quantum SDK deinitialization interface.

[0052] Figure 4 A flowchart of a quantum key access method provided in an embodiment of the present application. This embodiment is applicable to the case where multiple processes access quantum keys. The method can be executed by a quantum key access server of any of the above embodiments. The quantum key access server can be implemented in the form of hardware and / or software. The quantum key access server can be configured in a quantum key access system; the quantum key access system also includes a client.

[0053] like Figure 4 As shown, the method includes:

[0054] S110. Receive a quantum key access request message sent by the client through the server key access interface.

[0055] Specifically, the client sends a quantum key access request message to the server's server key access interface through the client key access interface based on business needs. Since the server key access interface supports multi-process quantum key access, the server can receive quantum key access request messages sent by multiple clients in multiple processes and implement multi-process access to quantum keys through the server key access interface.

[0056] S120. Through the server-side key access interface, call the quantum SDK key access interface to request quantum SDK to access the quantum key based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK.

[0057] Specifically, for each quantum key access process on the server side, the server side calls the server side key access interface, calls the internally encapsulated quantum SDK key access interface through the server side key access interface to send a quantum key access request message to the quantum SDK, requests access to the quantum key from the quantum key management system through the quantum SDK, obtains the quantum key access response message returned by the quantum key management system in response to the quantum key access request message through the quantum SDK; thereby realizing multi-process access to the quantum key.

[0058] S130. Return the quantum key access response message to the client through the server key access interface.

[0059] Specifically, the server-side key access interface calls the internally encapsulated quantum SDK key access interface, so that the quantum SDK key access interface accesses the quantum SDK, obtains the returned quantum key access response message, and returns the quantum key access response message to the client's client key access interface based on the RPC protocol, so that the client receives the quantum key access response message.

[0060] The technical solution of the embodiment of the present invention is that the server receives the quantum key access request message sent by the client through the server key access interface supporting multi-process quantum key access; through the server key access interface, the quantum SDK key access interface is called to request quantum SDK access to the quantum key based on the quantum key access request message, and the quantum key access response message is obtained from the quantum key management system through the quantum SDK, and the quantum key access response message is returned to the client. By connecting the server and the client through a remote call protocol; and encapsulating the server key access interface supporting multi-process quantum key access and having the quantum SDK access function and the quantum SDK for accessing the quantum key management system inside the server, multi-process quantum key access to the quantum key management system can be achieved, which is conducive to the widespread application of quantum keys.

[0061] As an optional implementation of the embodiment of the present application, before the step of receiving the quantum key access request message sent by the client through the server key access interface, it also includes:

[0062] Through the initialization interface, call the internally encapsulated quantum SDK initialization interface to access the quantum SDK, and obtain the identity authentication information obtained by the quantum SDK from the quantum key security medium in the quantum key management system; based on the identity authentication information, establish a communication link between the quantum SDK and the quantum key security service platform in the quantum key management system; call the quantum SDK initialization interface to access the quantum SDK, so that the quantum SDK sends a network access authentication request message to the quantum key security service platform based on the communication link, and obtains the authentication token returned by the quantum key security service platform.

[0063] Specifically, a quantum SDK initialization interface is encapsulated inside the initialization interface. The quantum SDK is accessed by calling the internally encapsulated quantum SDK initialization interface through the initialization interface, so that the quantum SDK obtains identity authentication information from the quantum key security medium in the quantum key management system. The identity authentication information may include, for example: the ID (SID) of the quantum key security medium and the ID of the terminal device where the local client is deployed. The identity authentication information is sent to the quantum key security service platform in the quantum key management system through the quantum SDK. After the quantum key security service platform verifies the identity authentication information, it authorizes the quantum SDK encapsulated inside the server, allowing the quantum SDK to establish a communication link with the quantum key security service platform. The communication link can be established by using a three-way handshake communication method, which will not be described in detail in the embodiments of the present invention.

[0064] The quantum SDK is accessed by calling the quantum SDK initialization interface through the initialization interface, so that the quantum SDK sends the network access authentication request message to the quantum key security service platform based on the created communication link, and the quantum key security service platform verifies the network access authentication request message, responds after the verification and generates an authentication token, so that the server obtains the authentication token returned to the quantum SDK by the quantum key security service platform based on the created communication link, and returns the authentication token to the client.

[0065] As another optional embodiment of the embodiment of the present application, S120, through the server key access interface, calling the internally encapsulated quantum SDK key access interface to request quantum SDK to access the quantum key based on the quantum key access request message, and obtaining the quantum key access response message returned by the quantum key management system through the quantum SDK includes:

[0066] S121. Through the server-side key access interface, call the internally encapsulated quantum SDK key access interface to access the quantum SDK.

[0067] Specifically, the client generates a quantum key access request message based on the business session identifier, the peer client device identifier and the authentication token, and sends the quantum key access request message to the server based on the RPC protocol. The server calls the server key access interface and the internally encapsulated quantum SDK key access interface to access the quantum SDK, so that the SDK sends the quantum key access request message to the quantum key security service platform in the quantum key management system.

[0068] S122. Send the quantum key access request message to the quantum key security service platform in the quantum key management system through the quantum SDK, so that the quantum key security service platform verifies the business session identifier, the peer client device identifier and the authentication token contained in the quantum key access request message, and generates a quantum key access response message according to the verification result.

[0069] The service session identifier can be understood as a unique identifier of the service session requesting quantum key access, such as a service session ID. The peer client device identifier can be understood as a unique identifier of a terminal device to which the peer client that establishes a session with the local client belongs, such as a peer client device ID.

[0070] Specifically, the quantum SDK sends a quantum key access request message to the quantum key security service platform in the quantum key management system. After receiving the quantum key access request message, the quantum key security service platform parses the quantum key access request message, obtains the business session identifier, the peer client device identifier and the authentication token, verifies the business session identifier, the peer client device identifier and the authentication token, and generates a quantum key access response message based on the verification result.

[0071] Exemplarily, in the case where the quantum key access request message is a quantum key application request message, if the verification result is that the verification is passed, a quantum key access response message including the quantum key assigned by the quantum key management system is generated; if the verification result is that the verification is not passed, a quantum key access response message including invalid application request information is generated. In the case where the quantum key access request message is a quantum key acquisition request message, if the verification result is that the verification is passed, a quantum key access response message including the quantum key assigned by the quantum key management system and adapted to the quantum key application request is generated; if the verification result is that the verification is not passed, a quantum key access response message including invalid acquisition request information is generated. In the case where the quantum key access request message is a quantum key destruction request message, if the verification result is that the verification is passed, a quantum key access response message including destruction result information is generated; if the verification result is that the verification is not passed, a quantum key access response message including invalid destruction request information is generated.

[0072] S123. Through the server-side key access interface, call the internally encapsulated quantum SDK key access interface to access the quantum SDK, and obtain the quantum key access response message generated by the quantum key security service platform received by the quantum SDK.

[0073] Specifically, the server calls the server key access interface, and through the server key access interface, calls the internally encapsulated quantum SDK key access interface to access the quantum SDK, and obtains the quantum key access response message generated by the quantum key security service platform for the quantum key access request message through the quantum SDK.

[0074] As an optional embodiment of the embodiment of the present application, the quantum key access method also includes: after the quantum key access process of the server is completed, calling the internally encapsulated quantum SDK deinitialization interface through the deinitialization interface to clean up temporary files and release occupied memory, and access the quantum SDK, so that the quantum SDK sends a communication link closing request message to the quantum key security service platform, and the communication link closing request message is used to request the quantum key security service platform to close the communication link.

[0075] Specifically, when the server detects that the quantum key access process of the server has ended, it calls the deinitialization interface, so that the deinitialization interface calls the internally encapsulated quantum SDK deinitialization interface, cleans up the temporary files stored in the server and releases the memory occupied by the quantum key access process of the server, and accesses the quantum SDK through the quantum SDK deinitialization interface, so that the quantum SDK sends a communication link closing request message to the quantum key security service platform based on the communication link; after receiving the communication link closing request message, the quantum key security service platform can disconnect the communication link with the quantum SDK access interface and no longer receive the quantum key access request from the server. When the server accesses the quantum key again, it needs to re-execute the initialization process. By promptly cleaning up the stored temporary files and processes at the end of the access process, memory space can be effectively saved.

[0076] Figure 5 This is a schematic diagram of the structure of a quantum key access system provided in an embodiment of the present application. This embodiment is applicable to the case where multiple processes access quantum keys. Figure 5 As shown, the quantum key access system includes: a client 20, a server 10 and a quantum key management system 30; the client 20 is connected to the server 10 via a remote call protocol;

[0077] The client 20 includes a client key access interface 210, and the server 10 includes a server key access interface 110 and a quantum SDK 130 for accessing a quantum key management system. The client key access interface 210 is connected to the server key access interface 110 via a remote call protocol, and the server key access interface 110 supports multi-process quantum key access; the server key access interface 110 is encapsulated with a quantum SDK key access interface 120, and the quantum SDK key access interface 120 is used to call the quantum SDK 130 to access the quantum key management system 30;

[0078] The client 20 is used to initiate a key access request and send it to the server 10 through the client key access interface 210; and receive a quantum key access response message returned by the server 10 through the client key access interface 210;

[0079] The server 10 is used to receive a quantum key access request message sent by the client 20 through the server key access interface 110; call the quantum SDK key access interface 120 encapsulated in the server key access interface 110, request access to the quantum key from the quantum SDK 130 of the quantum key management system 30 based on the quantum key access request message, obtain the quantum key access response message returned by the quantum key management system 30 through the quantum SDK 130; and return the quantum key access response message to the client 20.

[0080] The present invention implements a quantum key access system, which connects a server and a client through a remote call protocol, and encapsulates a client key access interface inside the client, and encapsulates a server key access interface that supports multi-process quantum key access and has a quantum SDK access function and a quantum SDK for accessing a quantum key management system inside the server, so that the client can access the quantum key in multiple processes based on the remote call protocol, which solves the problem of being unable to access quantum key security media in multiple processes and achieves the beneficial effect of expanding the application scope of quantum keys.

[0081] Optionally, the server-side key access interface includes: a server-side key application interface, a server-side key acquisition interface, and a server-side key destruction interface; the server-side key application interface encapsulates the quantum SDK key application interface, the server-side key acquisition interface encapsulates the quantum SDK key acquisition interface, and the server-side key destruction interface encapsulates the quantum SDK key destruction interface;

[0082] Among them, the server-side key application interface is used to call the quantum SDK key application interface to request the quantum SDK to apply for a quantum key; the server-side key acquisition interface is used to call the SDK key acquisition interface to request the quantum SDK to obtain a quantum key; the server-side key destruction interface is used to call the quantum SDK key destruction interface to request the quantum SDK to destroy the quantum key.

[0083] Optionally, the server also includes: an initialization interface; the initialization interface encapsulates the quantum SDK initialization interface;

[0084] Among them, the initialization interface is used to call the quantum SDK initialization interface to access the quantum SDK, obtain the identity authentication information obtained by the quantum SDK from the quantum key security medium in the quantum key management system; establish a communication link between the quantum SDK and the quantum key security service platform in the quantum key management system based on the identity authentication information; call the quantum SDK initialization interface to access the quantum SDK, so that the quantum SDK sends a network access authentication request message to the quantum key security service platform based on the communication link, and obtain the authentication token returned by the quantum key security service platform.

[0085] Optionally, the server also includes: a deinitialization interface; the deinitialization interface encapsulates a quantum SDK deinitialization interface;

[0086] Among them, the deinitialization interface is used to call the quantum SDK deinitialization interface to clean up temporary files and release occupied memory after the quantum key access process on the server is completed, and access the quantum SDK, so that the quantum SDK sends a communication link closing request message to the quantum key security service platform. The communication link closing request message is used to request the quantum key security service platform to close the communication link.

[0087] Figure 6 The schematic diagram of the structure of the terminal device 60 that can be used to implement the embodiment of the present application is shown. The terminal device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The terminal device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples and are not intended to limit the implementation of the present application described and / or required herein.

[0088] like Figure 6As shown, the terminal device 60 includes at least one processor 61, and a memory connected to the at least one processor 61, such as a read-only memory (ROM) 62, a random access memory (RAM) 63, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 61 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 62 or the computer program loaded from the storage unit 68 to the random access memory (RAM) 63. In the RAM 63, various programs and data required for the operation of the terminal device 60 can also be stored. The processor 61, the ROM 62, and the RAM 63 are connected to each other through a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0089] A number of components in the terminal device 60 are connected to the I / O interface 65, including: an input unit 66, such as a keyboard, a mouse, etc.; an output unit 67, such as various types of displays, speakers, etc.; a storage unit 68, such as a disk, an optical disk, etc.; and a communication unit 69, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 69 allows the terminal device 60 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0090] The processor 61 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 61 performs the various methods and processes described above, such as a quantum key access method.

[0091] In some embodiments, the quantum key access method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on the terminal device 60 via the ROM 62 and / or the communication unit 69. When the computer program is loaded into the RAM 63 and executed by the processor 61, one or more steps of the quantum key access method described above may be performed. Alternatively, in other embodiments, the processor 61 may be configured to perform the quantum key access method in any other appropriate manner (e.g., by means of firmware).

[0092] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0093] In some embodiments, the quantum key access method may be implemented as a computer program, which is invisibly included in a computer program product. When the computer program is executed by a processor, the quantum key access method of the present application is implemented. The computer program product can be understood as a software product that implements its solution mainly through a computer program. The computer program for implementing the method of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as an independent software package and partially on a remote machine, or entirely on a remote machine or server.

[0094] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0095] To provide interaction with a user, the systems and techniques described herein may be implemented on a terminal device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball), through which the user can provide input to the terminal device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0096] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0097] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0098] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0099] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A quantum key access server, It is characterized in that The server is connected to the client via a remote call protocol; the server includes: a server key access interface and a quantum SDK for accessing a quantum key management system, wherein the server key access interface supports multi-process quantum key access of the client; a quantum SDK key access interface is encapsulated in the server key access interface, and the quantum SDK key access interface is used to call the quantum SDK to access the quantum key management system; Among them, the server-side key access interface is used to receive the quantum key access request message sent by the client; call the quantum SDK key access interface to request access to the quantum key from the quantum SDK based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK; return the quantum key access response message to the client.

2. The quantum key access server according to claim 1, It is characterized in that The server-side key access interface includes: a server-side key application interface, a server-side key acquisition interface, and a server-side key destruction interface; the server-side key application interface encapsulates a quantum SDK key application interface, the server-side key acquisition interface encapsulates a quantum SDK key acquisition interface, and the server-side key destruction interface encapsulates a quantum SDK key destruction interface; Among them, the server-side key application interface is used to call the quantum SDK key application interface to request the quantum SDK to apply for a quantum key; the server-side key acquisition interface is used to call the SDK key acquisition interface to request the quantum SDK to obtain a quantum key; the server-side key destruction interface is used to call the quantum SDK key destruction interface to request the quantum SDK to destroy the quantum key.

3. The quantum key access server according to claim 1, It is characterized in that The server also includes: an initialization interface; the initialization interface encapsulates a quantum SDK initialization interface; Among them, the initialization interface is used to call the quantum SDK initialization interface to access the quantum SDK, obtain the identity authentication information obtained by the quantum SDK from the quantum key security medium in the quantum key management system; establish a communication link between the quantum SDK and the quantum key security service platform in the quantum key management service system based on the identity authentication information; call the quantum SDK initialization interface to access the quantum SDK, so that the quantum SDK sends a network access authentication request message to the quantum key security service platform based on the communication link, and obtain the authentication token returned by the quantum key security service platform.

4. The quantum key access server according to claim 1, It is characterized in that The server also includes: a deinitialization interface; the deinitialization interface encapsulates a quantum SDK deinitialization interface; Among them, the deinitialization interface is used to call the quantum SDK deinitialization interface to clean up temporary files and release occupied memory after the server-side quantum key access process is completed, and access the quantum SDK, so that the quantum SDK sends a communication link closing request message to the quantum key security service platform, and the communication link closing request message is used to request the quantum key security service platform to close the communication link.

5. A quantum key access method, It is characterized in that The method applied to the quantum key access server according to any one of claims 1 to 4 comprises: Receiving, via the server key access interface, a quantum key access request message sent by the client; Through the server key access interface, the internally encapsulated quantum SDK key access interface is called to request the quantum SDK to access the quantum key based on the quantum key access request message, and obtain the quantum key access response message returned by the quantum key management system through the quantum SDK; The quantum key access response message is returned to the client through the server key access interface.

6. The quantum key access method according to claim 5, It is characterized in that Before the step of receiving the quantum key access request message sent by the client through the server key access interface, the method further includes: Through the initialization interface, the internally encapsulated quantum SDK initialization interface is called to access the quantum SDK, and the identity authentication information obtained by the quantum SDK from the quantum key security medium in the quantum key management system is obtained; based on the identity authentication information, a communication link is established between the quantum SDK and the quantum key security service platform in the quantum key management service system; Call the quantum SDK initialization interface to access the quantum SDK, so that the quantum SDK sends a network access authentication request message to the quantum key security service platform based on the communication link, and obtains the authentication token returned by the quantum key security service platform.

7. The quantum key access method according to claim 6, It is characterized in that The step of calling the internally encapsulated quantum SDK key access interface through the server key access interface to request access to the quantum key from the quantum SDK based on the quantum key access request message, and obtaining the quantum key access response message returned by the quantum key management system through the quantum SDK comprises: Through the server-side key access interface, call the internally encapsulated quantum SDK key access interface to access the quantum SDK; The quantum key access request message is sent to the quantum key security service platform in the quantum key management system through the quantum SDK, so that the quantum key security service platform verifies the service session identifier, the peer client device identifier and the authentication token contained in the quantum key access request message, and generates a quantum key access response message according to the verification result; Through the server-side key access interface, call the internally encapsulated quantum SDK key access interface to access the quantum SDK, and obtain the quantum key access response message generated by the quantum key security service platform received by the quantum SDK.

8. The quantum key access method according to claim 7, It is characterized in that Also includes: After the quantum key access process on the server is completed, the internally encapsulated quantum SDK deinitialization interface is called through the deinitialization interface to clean up temporary files and release occupied memory, and the quantum SDK is accessed, so that the quantum SDK sends a communication link closing request message to the quantum key security service platform, and the communication link closing request message is used to request the quantum key security service platform to close the communication link.

9. A quantum key access system, It is characterized in that include: Client, server and quantum key management system; the client and server are connected via a remote call protocol; The client includes a client key access interface, the server includes a server key access interface and a quantum SDK for accessing a quantum key management system, the client key access interface is connected to the server key access interface via a remote call protocol, and the server key access interface supports multi-process quantum key access; The server-side key access interface encapsulates a quantum SDK key access interface, and the quantum SDK key access interface is used to call the quantum SDK to access the quantum key management system; The client is used to initiate a key access request and send it to the server through the client key access interface; And receiving a quantum key access response message returned by the server through the client key access interface; The server is used to receive a quantum key access request message sent by the client through the server key access interface; The quantum SDK key access interface encapsulated in the server key access interface is called, and based on the quantum key access request message, the quantum SDK is requested to access the quantum key, and the quantum key access response message returned by the quantum key management system through the quantum SDK is obtained; and the quantum key access response message is returned to the client.

10. A terminal device, It is characterized in that The terminal device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the quantum key access method described in any one of claims 5 to 8.

Images