A key management method and device based on blockchain network and quantum security technology

Abstract

The present invention relates to the fields of key management, quantum security and blockchain, and in particular to a key management method and device based on blockchain network and quantum security technology. The method comprises: a KDC server generates a target key package in response to receiving a key generation request sent by a first device, and saves the target key package in a local storage, wherein the target key package has a target quantum key, a target quantum key metadata and a target quantum key identifier; sends a second transaction to a blockchain network, which is used to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network by calling a second function of a smart contract; sends the target key package to the first device; in response to receiving a key query request sent by a second device, searches for the corresponding target quantum key from the local storage; and sends the target quantum key to the second device.

Description

Technical Field

[0001] The present invention relates to the fields of key management, quantum security and blockchain, and in particular to a key management method and device based on blockchain network and quantum security technology. Background Art

[0002] In existing network security practices, the Key Distribution Center (KDC) plays a key role in generating, storing, and distributing keys. However, traditional KDC systems face challenges in source security and link credibility. The key generation and transmission process is vulnerable to attacks, resulting in key leakage or illegal use. In addition, the management and distribution of keys in traditional KDC systems lack transparency, and the generated keys are difficult to track and verify, which poses a risk of tampering.

[0003] Blockchain technology, with its tamper-proof and decentralized characteristics, provides new possibilities for solving the above problems. By applying blockchain technology to KDC and building transmission links using quantum-safe transmission protocols, a more secure, reliable and transparent key management system can be achieved. Summary of the invention

[0004] One or more embodiments of this specification describe a key management method and device based on a blockchain network and quantum security technology. By using a quantum random number generator (QRNG) to generate a quantum key with a high entropy value, and using a transmission protocol that supports quantum security to implement a quantum secure transmission link, the security of network communications is improved. At the same time, blockchain technology is used to enhance the security and credibility of key management, and to provide a secure and reliable key management mechanism, thereby maximizing the guarantee that the generation and transmission of quantum keys have a series of security enhancement capabilities such as credibility, verifiability, traceability, and controllability.

[0005] According to a first aspect, a key management method based on a blockchain network and quantum security technology is provided, wherein a smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading a quantum key to a chain, and a third function for destroying a quantum key. The method includes:

[0006] The key distribution center KDC server receives the key generation request sent by the first device, generates a target key package based on the key generation request, and saves the target key package in a local storage, where the target key package has a target quantum key, target quantum key metadata, and a target quantum key identifier;

[0007] The KDC server sends a second transaction to the blockchain network, the second transaction calls the second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network;

[0008] The KDC server sends the target key package to the first device;

[0009] The KDC server receives the key query request sent by the second device, and searches the local storage for the corresponding target quantum key according to the target quantum key identifier contained therein, where the target quantum key identifier is sent by the first device to the second device;

[0010] The KDC server sends the target quantum key to the second device;

[0011] The KDC server sends a third transaction to the blockchain network, the third transaction calls the third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

[0012] According to one embodiment, the smart contract further includes a first function for device registration; the method further includes:

[0013] The KDC server performs an on-chain registration operation on the first device in response to receiving a registration request sent by the first device; and performs an on-chain registration operation on the second device in response to receiving a registration request sent by the second device.

[0014] The on-chain registration operation specifically includes:

[0015] The KDC server extracts the public key of the corresponding target device from the registration request, and calculates its hash value to obtain a public key hash;

[0016] The KDC server sends a first transaction to the blockchain network, where the first transaction calls a first function of the smart contract and includes the public key hash as an input parameter to associate and store the target device and the public key hash in the blockchain network.

[0017] According to an implementation manner, the key generation request includes a first identity identifier of the first device, and the key query request includes a second identity identifier of the second device;

[0018] Before generating the target key package, the method further includes: the KDC server verifies the identity of the first device according to the first identity identifier, and if the verification fails, stops the execution of the method.

[0019] And, before searching the corresponding target quantum key from the local storage, the method further includes: the KDC server verifies the identity of the second device according to the second identity identifier, and if the verification fails, stops the execution of the method.

[0020] The identity verification includes: verifying the registration status of the corresponding device.

[0021] According to one embodiment, generating the target key package includes: using a quantum random number generator to generate the target quantum key.

[0022] According to one embodiment, the KDC server communicates with the first device, the second device, and the blockchain network via a quantum secure transmission link.

[0023] According to a scenario of the above implementation, the quantum secure transmission link is established based on one of the following protocols: HTTPS, TLS, KEMTLS.

[0024] According to one embodiment, after sending the target quantum key to the second device, the method further includes:

[0025] The first device and the second device use the target quantum key as a pre-shared key to establish a secure tunnel, and the secure tunnel is used for encrypted communication between the first device and the second device.

[0026] According to one embodiment, the smart contract further includes a fourth function for verifying the validity of the quantum key; before sending the target quantum key to the second device, the method further includes:

[0027] Sending a fourth transaction to the blockchain network, wherein the fourth transaction includes the target quantum key identifier, so as to query the validity of the corresponding target quantum key in the blockchain network; if the target quantum key has expired, stopping the further execution of the method.

[0028] In one embodiment of the above implementation manner, the expired includes that the target quantum key meets any of the following conditions:

[0029] The key has expired, the key was not found, or the key has been used.

[0030] According to the second aspect, the present invention also provides a key management device based on a blockchain network and quantum security technology, wherein a smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading a quantum key to a chain, and a third function for destroying a quantum key; the device includes:

[0031] A key generation unit: configured to receive a key generation request sent by the first device, generate a target key package based on the key generation request, and save the target key package in a local storage, wherein the target key package has a target quantum key, target quantum key metadata, and a target quantum key identifier;

[0032] A key on-chain unit: configured to send a second transaction to the blockchain network, wherein the second transaction calls a second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network;

[0033] A key package sending unit: configured to send the target key package to the first device;

[0034] A key query unit is configured to, upon receiving a key query request sent by a second device, search the local storage for a corresponding target quantum key according to the target quantum key identifier contained therein, wherein the target quantum key identifier is sent by the first device to the second device;

[0035] A key sending unit: configured to send the target quantum key to the second device;

[0036] A key destruction unit is configured to send a third transaction to the blockchain network, wherein the third transaction calls a third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

[0037] The present invention provides a key management method and device based on blockchain network and quantum security technology. Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0038] (1) In the scheme provided by the present invention, a quantum random number generator is used to generate a quantum key with a high entropy value. Compared with the pseudo-random number generation method in the traditional scheme, the present invention provides a quantum key with higher unpredictability and security.

[0039] (2) The present invention uses a transmission protocol that supports quantum security to build a transmission link, thereby improving the security of the data transmission process and enhancing the ability to resist quantum computing attacks.

[0040] (3) In the solution proposed by the present invention, the generation and use of keys are recorded through blockchain technology, providing a transparent and tamper-proof key activity log, thereby enhancing the security and credibility of key management.

[0041] (4) The present invention also applies smart contracts to the full life cycle management of keys, automatically processing the generation, use and destruction of keys, and ensuring that the use of keys complies with preset rules and management policies (for example, one-time use, non-reuse, etc.). BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a blockchain network architecture according to an exemplary embodiment;

[0043] Figure 2 A schematic diagram of a key management system architecture based on a blockchain network and quantum security technology provided by an embodiment of the present invention;

[0044] Figure 3 A flowchart of a key management method based on a blockchain network and quantum security technology provided by an embodiment of the present invention;

[0045] Figure 4 A schematic diagram of a key management device based on a blockchain network and quantum security technology provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] As mentioned above, currently, traditional KDC systems face two security risks.

[0047] On the one hand, the traditional KDC system is vulnerable to attacks during the key generation and transmission process, resulting in key leakage or illegal use. In order to address this risk, the inventor applied the quantum security mechanism to the KDC system, which can not only ensure that the keys generated by the system are quantum secure, but also ensure the security of the keys during transmission by using a transmission protocol that supports quantum security to build a transmission link.

[0048] On the other hand, in the traditional KDC system, the management and distribution of keys lack transparency, and the generated keys are difficult to track and verify, which may lead to the risk of tampering. In order to solve this risk, the inventor applies blockchain to the KDC system, and uses the characteristics of blockchain that cannot be tampered with and is decentralized to enhance the security and credibility of key management. At the same time, the inventor also implements automated key generation, use, and destruction by deploying smart contracts in the blockchain network. This provides a transparent and highly reliable key activity log for KDC key management, which enhances the security and credibility of key management.

[0049] Based on the technical concept described above, the present invention proposes a key management method and device based on blockchain network and quantum security technology, which combines the advantages of quantum security technology with blockchain network and is applied in KDC key distribution center to provide a new key distribution system. The system has quantum-level security and realizes a transparent and highly reliable key activity log.

[0050] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments.

[0051] The blockchain network is a distributed network built by multiple nodes. Any two nodes in it can achieve communication connection at the application layer through a peer-to-peer (P2P) network. Figure 1 As shown, Figure 1 A schematic diagram of a blockchain network architecture according to an exemplary embodiment is given. The blockchain network includes N nodes. Figure 1 Nodes 1 to 6 are shown in FIG. The connection lines (dashed lines) between nodes schematically represent P2P connections, and the connection may be, for example, a TCP connection, etc., for transmitting data between nodes.

[0052] Each block in the blockchain stores data records (i.e. transactions) within a specified time period, and builds a secure and reliable chain through cryptography to form a tamper-proof, distributed ledger shared by all members. In other words, the blockchain is a ledger that records all historical transactions, with each node holding a copy. The nodes use a consensus algorithm to ensure that the ledgers of all nodes are consistent with each other. Each block in the blockchain is a page of the ledger, recording the transaction entries in a transaction batch. In this way, all transaction details are recorded in a public ledger that can be seen by any node. If you want to modify a recorded transaction, all nodes holding the ledger need to modify it at the same time so that all nodes accept the modification. In the blockchain network, this will be a huge workload that is almost impossible to complete. It is from this perspective that the blockchain has the characteristic of being tamper-proof.

[0053] Based on the blockchain network, the introduction of smart contract technology makes the blockchain programmable and can support a wider range of applications. Smart contracts on the blockchain are contracts that can be triggered and executed by transactions on the blockchain network. The contracts can be defined in the form of code. Calling a smart contract in the blockchain network is a transaction initiated to the smart contract address, so that each node in the blockchain network runs the code of the called smart contract in a distributed manner.

[0054] The application of smart contracts in blockchain networks is divided into two scenarios: deploying smart contracts and calling smart contracts.

[0055] In the scenario of deploying a smart contract, for example, Alice sends a transaction containing information about creating a smart contract to Figure 1 In the blockchain network shown in the figure, the data field of the transaction includes the code of the smart contract to be created (usually bytecode), and the to field of the transaction is empty, indicating that the transaction is used to deploy the smart contract. The nodes in the blockchain network determine the address of the smart contract, for example: "0x6f8ae93...", and then each node adds the contract account corresponding to the smart contract address in its own database and stores the code of the smart contract, so that the smart contract is successfully created.

[0056] In the scenario of calling a smart contract, for example, Bob sends a transaction for calling a smart contract to Figure 1 In the blockchain network shown in the figure, the from field of the transaction is the account address of the transaction initiator Bob, and the to field is the address of the smart contract, for example: "0x6f8ae93..." The data field of the transaction includes the function / method name and the required input parameters in the smart contract. After the nodes in the blockchain network reach a consensus on the transaction, the nodes in the blockchain network can execute the transaction, that is, execute the smart contract, and update their respective databases based on the execution results, so that the smart contract call is completed.

[0057] The above is a brief introduction to blockchain networks and smart contracts. One or more embodiments of this specification provide a key management method and device based on blockchain networks and quantum security technology. On the one hand, the blockchain network is applied to the KDC system, and the immutable and decentralized characteristics of the blockchain are utilized to enhance the security and credibility of key management. On the other hand, smart contracts are also deployed in the blockchain network to realize automated key generation, use and destruction. A transparent and tamper-proof key activity log is provided for KDC key management. In addition, the quantum security mechanism is also applied to the KDC system to build a quantum-secure transmission link, improve the security of the data transmission process, and enhance the ability to resist quantum computing attacks.

[0058] For example, Figure 2 A schematic diagram of a key management system architecture based on a blockchain network and quantum security technology is provided according to an embodiment. Figure 2 The key management system includes: a blockchain network on which a smart contract is deployed, a key distribution center KDC server, and a first device and a second device that need to establish communication with each other.

[0059] The first device and the second device can be terminal devices or servers, which are not specifically limited in this specification. The KDC server can communicate with the blockchain network, and the first device and the second device respectively establish communication connections with the KDC server. All network communications in the system (KDC server and the first device, the second device and the blockchain network) are established on the quantum secure transmission link.

[0060] In one scenario of this embodiment, the quantum secure transmission link is established based on the quantum secure KEMTLS protocol. KEM (Key Encapsulation Mechanism) is an asymmetric cryptographic primitive that allows two parties to establish a shared key. It can be used to replace the traditional elliptic curve-based key exchange algorithm and can also be used for identity authentication. KEMTLS is a handshake protocol that replaces TLS 1.3. It uses KEM instead of signatures for server authentication. The main idea is to use KEM for authentication, which can reduce the amount of transmitted data, the amount of calculation, and the handshake time, while also reducing the trusted code base.

[0061] It can be understood that the security protocol used in the above-mentioned transmission link is only an example of an exemplary scenario. In other specific scenarios, quantum secure transmission links can also be built based on different protocols that support quantum security, such as HTTPS and TLS, so that data transmission in the system has quantum security. In this specification, specific security protocols are not given as examples one by one.

[0062] The above is Figure 2 The introduction of the transmission link construction in the key management system architecture shown in the figure can be further implemented based on the completion of the system link construction. The key management method based on the blockchain network and quantum security technology will be combined with Figure 2 , and give a general description of the implementation process.

[0063] Specifically, the key management method based on blockchain network and quantum security technology mainly includes two parts:

[0064] Part 1: Building blockchain infrastructure. The blockchain network includes N nodes. For the explanation of nodes and the composition of the blockchain, please refer to the relevant explanation in the previous article, which will not be repeated here. Write smart contracts and deploy them in the blockchain network, including designing the functions to be implemented by smart contracts: Taking Ethereum as an example, Ethereum is an open source public blockchain platform with smart contract functions, and uses the solidity language to write smart contract code. Write scripts for deploying smart contracts. You can use Ethereum client tools (such as Geth or Parity) to complete the deployment work.

[0065] Part 2: When exchanging keys between two devices that need to establish a secure tunnel with each other, the KDC server records the device registration, key generation, key use, and key destruction that occur during the key exchange process in the blockchain system by calling the functions provided by the smart contract, forming a transparent and tamper-proof log record. This includes:

[0066] Step 1: The first device and the second device respectively initiate device registration requests to the KDC server. When the KDC server completes the device registration, it calls the device registration function of the smart contract and synchronously records the device registration event in the blockchain network.

[0067] Step 2: The first device requests a key from the KDC server.

[0068] Step 3: After the KDC server generates the quantum key and the corresponding key ID (key identifier), it calls the key generation function of the smart contract and synchronously records the key generation event in the blockchain network. The quantum key and key ID are sent to the first device requesting the key.

[0069] Step 4: The first device passes the key ID to the second device with which it needs to establish quantum-secure encrypted communication.

[0070] Step 5: The second device sends the received key ID to the KDC server to request the corresponding quantum key from the KDC server. After receiving the key query request, the KDC server returns the quantum key corresponding to the key ID to the second device, and the quantum key will be used to build a secure tunnel between the first device and the second device. At the same time, the KDC server will call the key usage function of the smart contract and update the corresponding quantum key metadata to a used state in the blockchain network. The key usage function will also implicitly call the key destruction function, update the state of the corresponding quantum key metadata to inactive, and record the key destruction time in the blockchain network. The purpose of the key can only be used once is achieved.

[0071] Step 6: The first device and the second device establish a quantum-secure tunnel based on the obtained quantum key to encrypt subsequent communication data traffic.

[0072] Step 7: After the quantum key is used, the key destruction function of the smart contract is immediately called to mark the key as used and destroyed in the blockchain network, ensuring that the key is used only once.

[0073] Therefore, by utilizing the decentralized, tamper-proof, and information transparent characteristics of the blockchain network, a highly reliable key activity log is implemented, and a secure, trusted, and transparent key management system is built. In addition, the quantum keys generated by quantum technology and the quantum secure transmission links established in the system improve the security of the data transmission process, allowing the system to resist quantum computing attacks.

[0074] Next, based on the above brief description of the overall solution, a key management method based on blockchain network and quantum security technology proposed in this application will be introduced in detail in combination with the accompanying drawings and embodiments. The composition and preparation of the smart contract will be introduced first, and then the process of the key management method will be introduced.

[0075] In the solution of the present invention, a smart contract can be written by any node in the blockchain and published to the blockchain network for deployment. The deployment of smart contracts has been described in the previous article and will not be introduced in detail here.

[0076] In one embodiment, the smart contract is written in Solidity language. According to the functions to be implemented in this solution, the smart contract is designed as follows.

[0077] First, define the data structure in the smart contract, including the device structure for device registration and the key metadata structure for key metadata storage. An example is as follows:

[0078] Device structure definition: This structure definition contains the device's public key hash, registration timestamp, and a status flag indicating whether the device has been registered.

[0079] struct Node {

[0080] bytes32 publicKeyHash;

[0081] uint256 registrationTime;

[0082] bool isRegistered;

[0083] }

[0084] Key metadata structure definition: Contains status variables such as creation time, expiration time, and whether the key is in use.

[0085] struct QuantumKey {

[0086] uint256 creationTime;

[0087] uint256 expirationTime;

[0088] bool isUsed;

[0089] }

[0090] Device mapping: Map registered devices to the device array.

[0091] mapping(address =>Node) public nodes;

[0092] Key mapping. Since the data in the blockchain is transparent to the nodes, the key data should be a private variable:

[0093] mapping(bytes32 =>QuantumKey) private keys;

[0094] Secondly, the functions defined in the smart contract are used for device registration, key generation, key usage, and key destruction.

[0095] Device registration function: allows unregistered devices to register themselves by calling this function and providing their public key hash. After successful registration, the device's public key hash, registration timestamp, and registration status will be recorded on the blockchain. This function receives the public key hash as an input parameter, as shown below:

[0096] function registerNode(bytes32 publicKeyHash) public {

[0097] require(!nodes[msg.sender].isRegistered, "Node already registered.");

[0098] nodes[msg.sender] = Node(publicKeyHash, block.timestamp, true);

[0099] emit NodeRegistered(msg.sender, publicKeyHash);

[0100] }

[0101] Key generation function: A registered device can request the KDC server to generate a new key. The KDC server calls this function to create a new key entry, including non-sensitive key metadata, creation time, expiration time, and sets the state variable of whether it is used to unused. This function receives the key ID (key identifier) ​​and the key validity period as input parameters. The function example is as follows:

[0102] function generateKey(bytes32 keyId, uint256 duration) public {

[0103] require(nodes[msg.sender].isRegistered, "Node not registered.");

[0104] require(keys[keyId].creationTime == 0, "Key already exists.");

[0105] keys[keyId] = QuantumKey({creationTime: block.timestamp,expirationTime: block.timestamp + duration, isUsed: false});

[0106] emit KeyGenerated(keyId);

[0107] }

[0108] Key usage function: When devices need to use a key for a session, they call this function with the key ID as an input parameter. The function checks whether the corresponding key is valid and unused, marks it as used, and then immediately destroys the key to ensure that it will not be used again. An example of this function is as follows:

[0109] function useKey(bytes32 keyId) public {

[0110] require(keys[keyId].creationTime != 0, "Key does not exist.");

[0111] require(isKeyValid(keyId), "Key is not valid or already used.");

[0112] keys[keyId].isUsed = true;

[0113] emit KeyUsed(keyId);

[0114] destroyKey(keyId);

[0115] }

[0116] Key destruction function: This is an internal function used to remove the key from the contract's storage and update its status to inactive. This function is called by the useKey function after the key is used, with the key ID (key identifier) ​​as an input parameter. The function is as follows:

[0117] function destroyKey(bytes32 keyId) internal {

[0118] require(keys[keyId].isUsed, "Key not used or does not exist.");

[0119] delete keys[keyId];

[0120] emit KeyDestroyed(keyId);

[0121] }

[0122] In addition, a helper function is defined in the smart contract to check whether the key is valid. This function verifies that the key exists, has not been used, and is within its validity period. It takes the key ID as an input parameter. The function is as follows:

[0123] function isKeyValid(bytes32 keyId) public view returns (bool) {

[0124] QuantumKey memory key = keys[keyId];

[0125] return key.creationTime != 0&&!key.isUsed&&block.timestamp<=key.expirationTime;

[0126] }

[0127] Finally, in the smart contract, 4 events are defined. They are used to record important activities such as device registration, key generation, key usage, and key destruction. These events provide transparency for activities on the blockchain and allow external listeners (such as applications or services) to respond to these activities. Among them:

[0128] Device registration event: Whenever a device is registered, the smart contract will emit a device registration event, which contains the device address and the hash of the corresponding public key. Anyone can listen to this event or view it in a blockchain browser to verify whether a specific device has been registered.

[0129] The event definition is as follows:

[0130] eventNodeRegistered(address indexed nodeAddress,bytes32publicKeyHash);

[0131] For example, if a user wants to verify the public key of a specific device, he can first obtain the public key provided by the device, then hash it and compare it with the public key hash recorded by the smart contract. If the two hash values ​​match, it proves that the public key of the device is the public key recorded in the registration event.

[0132] Key generation event: When the KDC server generates a new key, it calls the smart contract to put the key on the chain. At the same time, the smart contract will issue a key generation event, which contains the key ID. By viewing this event, anyone can verify whether the key was generated at a specific point in time. The event definition is as follows:

[0133] event KeyGenerated(bytes32 indexed keyId);

[0134] Key usage event: When a key is used, the smart contract will issue a key usage event, which contains the corresponding key ID. By monitoring this event, you can understand which keys have been used by the device. The event definition is as follows:

[0135] event KeyUsed(bytes32 indexed keyId);

[0136] Key destruction event: When a key is no longer needed, the KDC calls the key destruction function of the smart contract; or when the key has been used, the key use function implicitly calls the key destruction function of the smart contract. The key destruction function will issue a key destruction event. Anyone can view the event to verify whether a specific key has been destroyed. The event definition is as follows:

[0137] event KeyDestroyed(bytes32 indexed keyId);

[0138] Including the definitions of the structure, functions, and events in the smart contract, we have completed the preparation of the smart contract. The smart contract provides function interfaces for device registration, key generation, key use, and key destruction. Correspondingly, it also provides events published after the execution of the above functions.

[0139] After completing the preparation of the smart contract, it is deployed in the aforementioned blockchain network, combined with the aforementioned quantum secure transmission link, and together with the KDC server, forms a key management system.

[0140] During the system initialization phase, each device independently generates its own key pair, which includes a public key and a private key. The private key is securely stored locally, while the public key is sent to the KDC server for device registration.

[0141] In one embodiment, a smart contract is deployed in the blockchain network, and the smart contract has a first function (device registration function) for device registration. The first device and the second device that need to establish a secure tunnel with each other respectively send registration requests to the KDC server. In response to the received registration request, the KDC server performs an on-chain registration operation on the first device and the second device.

[0142] The on-chain registration operation includes:

[0143] The KDC server extracts the public key of the corresponding target device from the registration request, and calculates its hash value to obtain a public key hash.

[0144] The KDC server sends a first transaction to the blockchain network, where the first transaction calls a first function of the smart contract and includes the public key hash as an input parameter to associate and store the target device and the public key hash in the blockchain network.

[0145] At this point, the device registration is completed, and the device registration event data recorded on the blockchain includes the public key hash and registration timestamp of the target device to protect the privacy of the device identity.

[0146] Based on the completion of the above preparatory work, a key management method based on a blockchain network and quantum security technology provided in an embodiment will be described in detail below in conjunction with the accompanying drawings. A smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading the quantum key to the chain, and a third function for destroying the quantum key.

[0147] The process of this method is as follows Figure 3 As shown, the method includes:

[0148] S301: The key distribution center KDC server receives a key generation request sent by a first device, generates a target key package based on the key generation request, and saves the target key package in a local storage, where the target key package has a target quantum key, target quantum key metadata, and a target quantum key identifier.

[0149] In one scenario of this embodiment, the key generation request includes a first identity identifier of the first device. Before generating the target key package, the method also includes, the KDC server verifying the identity of the first device based on the first identity identifier. If the verification fails, stopping the execution of the method.

[0150] In the scenario described above, the identity verification includes: verifying the registration status of the corresponding device.

[0151] In one example of the above scenario, in order to confirm the identity of the device and the validity of the request, the registration status of the device can be verified, and the timestamp and signature of the received key generation request can be checked. In other examples, other data verification methods can also be used to confirm the identity of the device and the validity of the request, such as certificate verification. It is understandable that the verification method can be designed according to actual needs, and this specification embodiment does not specifically limit this.

[0152] In one scenario of this embodiment, the target quantum key is generated using a quantum random number generator. The KDC server uses a quantum random number generator (QRNG) to generate a quantum key with a high entropy value and assigns a unique identifier (quantum key identifier) ​​and a timestamp to it.

[0153] A quantum random number generator is a device that uses quantum mechanical phenomena to generate random numbers. Unlike traditional random number generators that rely on predictable algorithms or physical processes, QRNG uses the inherent randomness of quantum mechanics to generate truly random numbers. In the method of the present invention, QRNG is integrated with KDC to generate high-entropy symmetric keys, which can improve the randomness and quality of the keys and provide higher unpredictability and security.

[0154] S303: The KDC server sends a second transaction to the blockchain network, the second transaction calls the second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network.

[0155] After the quantum key is generated, KDC calls the second function (key generation function) of the smart contract to record the metadata of the generated quantum key on the blockchain to ensure the transparency and traceability of the key generation event.

[0156] S305: The KDC server sends the target key package to the first device.

[0157] The KDC server securely transmits the quantum key to the first device through a quantum-secure transmission link and provides a quantum key identification, while ensuring the encryption and integrity of the transmission process.

[0158] S307: The KDC server receives the key query request sent by the second device, and searches the local storage for the corresponding target quantum key according to the target quantum key identifier contained therein, where the target quantum key identifier is sent by the first device to the second device.

[0159] In one embodiment, after receiving the quantum key and the quantum key identifier, the first device sends the quantum key identifier to the second device at the opposite end through a secure communication channel. After receiving the quantum key identifier, the second device requests the corresponding quantum key from the KDC server. The KDC server verifies the request sent by the second device. After the verification is passed, the KDC server finds the corresponding quantum key according to the quantum key identifier.

[0160] In one scenario of this embodiment, the key query request includes a second identity of the second device. Before searching the local storage for the corresponding target quantum key, the method further includes: the KDC server verifies the identity of the second device according to the second identity, and if the verification fails, stops the execution of the method. Regarding the identity authentication of the second device, reference can be made to the description of the identity authentication method of the first device in the previous text, which is applicable to the second device by analogy, and will not be repeated here.

[0161] S309: The KDC server sends the target quantum key to the second device.

[0162] In one embodiment, the KDC server transmits the quantum key to the second device via a secure communication protocol.

[0163] In one scenario of the above embodiment, the smart contract further includes a fourth function (isKeyValid function) for verifying the validity of the quantum key. Before sending the target quantum key to the second device, the method further includes: sending a fourth transaction to the blockchain network, the fourth transaction including the target quantum key identifier, for querying the validity of the corresponding target quantum key in the blockchain network, and stopping the execution of the method if the target quantum key has expired.

[0164] In an example of the above scenario, the key has expired, including that the target quantum key meets any of the following conditions: the key has expired, the key has not been found, and the key has been used.

[0165] In another scenario of the above embodiment, after sending the target quantum key to the second device, the method further includes: the first device and the second device use the target quantum key as a pre-shared key (PSK) to establish a secure tunnel, and the secure tunnel is used for encrypted communication between the first device and the second device. In other scenarios, the first device and the second device can also use the target quantum key as a pre-shared key and combine it with a variety of different encryption protocols to establish a quantum-safe secure tunnel. The encryption protocol and method used to establish the secure tunnel are not specifically limited in this specification.

[0166] S311: The KDC server sends a third transaction to the blockchain network, the third transaction calls the third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

[0167] After the key is used by a device, it is immediately marked as used and destroyed. If a device later initiates a request for validity verification or a request to use the key, the blockchain network will query the key status as invalid. This ensures that the quantum key will not be used again.

[0168] In another embodiment of the present invention, a key management device based on a blockchain network and quantum security technology is provided, which can be deployed on any device or platform with computing and processing capabilities. A smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading a quantum key to a chain, and a third function for destroying a quantum key.

[0169] Figure 4 A schematic diagram of a key management device based on a blockchain network and quantum security technology is shown according to an embodiment. Figure 4, the device 400 comprises:

[0170] The key generation unit 401 is configured to receive a key generation request sent by the first device, generate a target key package based on the key generation request, and save the target key package in a local storage, where the target key package has a target quantum key, target quantum key metadata, and a target quantum key identifier.

[0171] The key on-chain unit 402 is configured to send a second transaction to the blockchain network, wherein the second transaction calls the second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network.

[0172] The key package sending unit 403 is configured to send the target key package to the first device.

[0173] The key query unit 404 is configured to, upon receiving a key query request sent by the second device, search for a corresponding target quantum key from the local storage according to the target quantum key identifier contained therein, where the target quantum key identifier is sent by the first device to the second device.

[0174] The key sending unit 405 is configured to send the target quantum key to the second device.

[0175] The key destruction unit 406 is configured to send a third transaction to the blockchain network, wherein the third transaction calls the third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A key management method based on a blockchain network and quantum security technology, wherein a smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading a quantum key to a blockchain, and a third function for destroying a quantum key; the method comprises: The key distribution center KDC server receives the key generation request sent by the first device, generates a target key package based on the key generation request, and saves the target key package in a local storage, wherein the target key package has a target quantum key, a target quantum key metadata, and a target quantum key identifier, and the target quantum key is generated using a quantum random number generator; The KDC server sends a second transaction to the blockchain network, the second transaction calls the second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network; The KDC server sends the target key package to the first device; The KDC server receives the key query request sent by the second device, and searches the local storage for the corresponding target quantum key according to the target quantum key identifier contained therein, where the target quantum key identifier is sent by the first device to the second device; The KDC server sends the target quantum key to the second device; The KDC server sends a third transaction to the blockchain network, the third transaction calls the third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

2. The method according to claim 1, wherein the smart contract further comprises a first function for device registration; the method further comprises: In response to receiving the registration request sent by the first device, the KDC server performs an on-chain registration operation on the first device; and, in response to receiving a registration request sent by the second device, performing an uplink registration operation on the second device; The on-chain registration operation specifically includes: The KDC server extracts the public key of the corresponding target device from the registration request, and calculates its hash value to obtain a public key hash; The KDC server sends a first transaction to the blockchain network, where the first transaction calls a first function of the smart contract and includes the public key hash as an input parameter to associate and store the target device and the public key hash in the blockchain network.

3. The method according to claim 2, characterized in that The key generation request includes a first identity of the first device, and the key query request includes a second identity of the second device; Before generating the target key package, the method further includes: the KDC server verifies the identity of the first device according to the first identity identifier, and if the verification fails, stops the execution of the method; and Before searching the local storage for the corresponding target quantum key, the method further includes: the KDC server verifies the identity of the second device according to the second identity identifier, and if the verification fails, stops the execution of the method; The identity verification includes: verifying the registration status of the corresponding device.

4. The method according to claim 1, wherein: The KDC server communicates with the first device, the second device, and the blockchain network through a quantum secure transmission link.

5. The method according to claim 4, characterized in that The quantum secure transmission link is established based on one of the following protocols: HTTPS, TLS, KEMTLS.

6. The method according to claim 1, after sending the target quantum key to the second device, the method further comprises: The first device and the second device use the target quantum key as a pre-shared key to establish a secure tunnel, and the secure tunnel is used for encrypted communication between the first device and the second device.

7. The method according to claim 1, wherein the smart contract further comprises a fourth function for verifying the validity of the quantum key; before sending the target quantum key to the second device, the method further comprises: Sending a fourth transaction to the blockchain network, wherein the fourth transaction includes the target quantum key identifier, so as to query the validity of the corresponding target quantum key in the blockchain network; if the target quantum key has expired, stopping the further execution of the method.

8. The method according to claim 7, wherein the invalidation comprises that the target quantum key meets any of the following conditions: The key has expired, the key was not found, or the key has been used.

9. A key management device based on a blockchain network and quantum security technology, wherein a smart contract is deployed in the blockchain network, and the smart contract includes a second function for uploading a quantum key to a blockchain, and a third function for destroying the quantum key; The device is used to perform the method according to claim 1, and the device comprises: A key generation unit: configured to receive a key generation request sent by the first device, generate a target key package based on the key generation request, and save the target key package in a local storage, wherein the target key package has a target quantum key, target quantum key metadata, and a target quantum key identifier; A key on-chain unit: configured to send a second transaction to the blockchain network, wherein the second transaction calls a second function of the smart contract and includes the target quantum key metadata and the target quantum key identifier as input parameters, so as to associate and store the target quantum key metadata and the target quantum key identifier in the blockchain network; A key package sending unit: configured to send the target key package to the first device; A key query unit is configured to, upon receiving a key query request sent by a second device, search the local storage for a corresponding target quantum key according to the target quantum key identifier contained therein, wherein the target quantum key identifier is sent by the first device to the second device; A key sending unit: configured to send the target quantum key to the second device; A key destruction unit is configured to send a third transaction to the blockchain network, wherein the third transaction calls a third function of the smart contract and includes the target quantum key identifier as an input parameter, so that the blockchain network marks the key state corresponding to the target quantum key identifier as used and destroyed.

Images