Key management method, system and device, electronic equipment, storage medium and product

Abstract

The invention provides a key management method, system and device, electronic equipment, a storage medium and a product. Gateway equipment disclosed by the invention maintains an incidence relation table; the incidence relation table is used for maintaining the incidence relation among the application identifier, the module identifier, the wireless key and the quantum key; and performing key management based on the incidence relation table. In conclusion, according to the technical scheme provided by the invention, the association relation table can be maintained, and key management is directly carried out through the association relation table. Compared with the prior art that the wireless key and the quantum key need to be managed respectively, the interaction process of key management can be simplified. Meanwhile, when the quantum security module is replaced to different terminals, seamless migration of key management can be realized, the error rate of processing can be reduced, the processing efficiency can be improved, and objective requirements in the actual process can be met as long as the gateway equipment updates the association relation table.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a key management method, system, device, electronic device, storage medium and product. Background Art

[0002] At present, when quantum communication is carried out, the wireless key and quantum key on the terminal side are usually stored in the quantum security module and the quantum mobile phone communication module respectively. In this way, when quantum communication is carried out, the gateway side needs to manage the wireless key and quantum key separately, and the interaction process is relatively complicated. And if the quantum security module is replaced to a different terminal, the existing method has a high error rate and low efficiency, which is difficult to meet the objective needs in the actual process. Summary of the invention

[0003] The present disclosure provides a key management method, system, device, electronic device, storage medium and product, which are used to solve the problem that the interaction process is relatively complex, the existing methods have a high error rate, low efficiency, and are difficult to meet the objective needs in the actual process.

[0004] According to one aspect of the present disclosure, a key management method is provided, which is applied to a gateway device, and the method includes: maintaining an association table; the association table is used to maintain the association between application identifiers, module identifiers, wireless keys, and quantum keys; and performing key management based on the association table.

[0005] In addition, according to a method in one aspect of the present disclosure, maintaining an association table includes: receiving a first message from a first terminal, the first message carrying an application identifier and a module identifier; and establishing an association relationship between the application identifier and the module identifier in the association table based on the first message.

[0006] In addition, according to a method in one aspect of the present disclosure, maintaining an association table also includes: generating a first wireless key; receiving a second message from a first terminal, the second message carrying a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; verifying the consistency of the first wireless key and the second wireless key; when the first wireless key is consistent with the second wireless key, based on the second message, maintaining the association between the application identifier, the module identifier and the second wireless key in the association table.

[0007] In addition, according to a method in one aspect of the present disclosure, key management is performed based on an association table, including: receiving a third message from a first terminal, the third message is used to request a quantum key, the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; sending a first quantum key to the first terminal and the second terminal respectively; wherein the first quantum key is encrypted using a third wireless key respectively; receiving a fourth message from the first terminal and the second terminal respectively, the fourth message carries a verification result of the terminal on the first quantum key; and updating the association table based on the fourth message.

[0008] In addition, according to a method in one aspect of the present disclosure, before sending the first quantum key to the first terminal and the second terminal respectively, the method also includes: obtaining a third wireless key corresponding to the third message; using the third wireless key to encrypt the second quantum key corresponding to the third message to obtain the first quantum key.

[0009] In addition, according to a method in one aspect of the present disclosure, obtaining a third wireless key corresponding to a third message includes: verifying whether a second quantum key corresponding to the third message exists in a first quantum key pool; when the second quantum key exists in the first quantum key pool, querying a third wireless key corresponding to the third message based on the third message; when the second quantum key does not exist in the first quantum key pool, generating a third wireless key corresponding to the third message based on the third message.

[0010] In addition, according to a method of one aspect of the present disclosure, key management is performed based on an association table, and also includes: receiving a fifth message from the first terminal, the fifth message being used to request destruction of a target key; the target key is a wireless key and / or a quantum key; destroying the target key in a key pool to which the target key belongs, and updating the association table.

[0011] In addition, according to a method of one aspect of the present disclosure, key management is performed based on an association table, and also includes: obtaining a sixth message of the first terminal, the sixth message carrying a first application identifier, a first module identifier and a fourth wireless key corresponding to the first module identifier of the first terminal; obtaining a fifth wireless key corresponding to the first application identifier in the association table; deleting a sixth wireless key from the wireless key pool, the sixth wireless key being a wireless key that is inconsistent with the fourth wireless key and the fifth wireless key; and updating the association table.

[0012] In addition, according to a method in one aspect of the present disclosure, the first module identifier is a module identifier after the first terminal performs module replacement; the method further includes: receiving a seventh message from the first terminal, the seventh message carrying the first module identifier.

[0013] In addition, according to a method in one aspect of the present disclosure, obtaining the sixth message of the first terminal includes: sending an eighth message to the first terminal, where the eighth message is used to request a wireless key; and receiving the sixth message from the first terminal.

[0014] In addition, according to a method in one aspect of the present disclosure, the method further includes: sending a tenth message to the first terminal, the tenth message carrying a synchronization result of the wireless key by the gateway device.

[0015] According to another aspect of the present disclosure, a key management method is provided, which is applied to a first terminal, and the method includes: sending an eleventh message to a gateway device, the eleventh message is used to request the gateway device to maintain an association table, the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship between the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

[0016] In addition, according to another aspect of the method of the present disclosure, the method also includes: sending a first message to the gateway device, the first message carrying an application identifier and a module identifier.

[0017] In addition, according to a method in another aspect of the present disclosure, the method also includes: sending a second message to a gateway device, the second message carrying a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; receiving a thirteenth message from the gateway device, the thirteenth message carrying a first wireless key generated by the gateway device; verifying the consistency of the second wireless key and the first wireless key; when the second wireless key is consistent with the first wireless key, updating the second wireless key pool.

[0018] In addition, according to a method in another aspect of the present disclosure, the method also includes: sending a third message to a gateway device, the third message is used to request a quantum key, the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; receiving a first quantum key sent from the gateway device; wherein the first quantum key is encrypted using a third wireless key; verifying the first quantum key; and when the first quantum key verification succeeds, updating the second quantum key pool.

[0019] In addition, according to another aspect of the method of the present disclosure, the method also includes: sending a fifth message to the gateway device, the fifth message is used to request the destruction of the target key; the target key is a wireless key and / or a quantum key.

[0020] In addition, according to another aspect of the method of the present disclosure, the method further includes: sending a sixth message to the gateway device, the sixth message carrying the first application identifier of the first terminal, the first module identifier and a fourth wireless key corresponding to the first module identifier.

[0021] In addition, according to a method in another aspect of the present disclosure, the first module identifier is a module identifier after the first terminal performs module replacement; the method further includes: sending a seventh message to the gateway device, the seventh message carrying the first module identifier.

[0022] In addition, according to a method in another aspect of the present disclosure, sending a sixth message to a gateway device includes: receiving an eighth message from the gateway device, where the eighth message is used to request a wireless key; and sending the sixth message to the gateway device.

[0023] In addition, according to another aspect of the method of the present disclosure, the method further includes: receiving a tenth message from the gateway device, the tenth message carrying a synchronization result of the wireless key by the gateway device; and updating the second wireless key pool.

[0024] According to another aspect of the present disclosure, a key management system is provided, including: a gateway device, used to execute and maintain an association table; the association table is used to maintain the association between application identification, module identification, wireless key, and quantum key; based on the association table, key management is performed; at least one terminal, in which a communication module and a security module are deployed, used to execute sending an eleventh message to the gateway device, the eleventh message is used to request the gateway device to maintain the association table, the eleventh message carries at least one of the application identification, module identification, wireless key, and quantum key, the association table is used to maintain the association between the application identification, module identification, wireless key, and quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

[0025] According to another aspect of the present disclosure, a key management device is provided, which is arranged in a gateway device, and the device includes: a maintenance unit, which is used to maintain an association table; the association table is used to maintain the association between application identifiers, module identifiers, wireless keys, and quantum keys; and a management unit, which is used to manage keys based on the association table.

[0026] According to another aspect of the present disclosure, a key management device is provided, which is arranged at a first terminal, and the device includes: a sending unit, which sends an eleventh message to a gateway device, the eleventh message is used to request the gateway device to maintain an association table, the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship between the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

[0027] According to another aspect of the present disclosure, an electronic device is provided, comprising: a memory for storing computer-readable instructions; and a processor for executing the computer-readable instructions so that the electronic device executes the method as described in any embodiment of the first aspect.

[0028] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is provided for storing computer-readable instructions. When the computer-readable instructions are executed by a processor, the processor executes the method according to any one of the embodiments of the first aspect.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the method according to any one of the embodiments of the first aspect is implemented.

[0030] The present disclosure provides a key management method, system, device, electronic device, storage medium and product. The gateway device of the present disclosure maintains an association table and performs key management directly through the association table. Among them, the association table maintains the association between the application identifier, the module identifier, the wireless key and the quantum key. In summary, the technical solution gateway device provided by the present disclosure can achieve unified management of wireless keys and quantum keys by maintaining the association table. In layman's terms, because the association table stores the association between the application identifier, the module identifier, the wireless key and the quantum key. The gateway device can query the corresponding key information in the association table based on the application identifier and / or the module identifier. And because all the key information is stored in the association table instead of being scattered in different places, the gateway device only needs to query the association table to obtain all the required key information, without querying different storage locations separately. Compared with the existing need to manage wireless keys and quantum keys separately, the interactive process of key management can be simplified. At the same time, when the quantum security module is replaced to a different terminal, the gateway device can achieve seamless migration of key management by simply updating the association table, reducing the error rate of processing, improving processing efficiency, and meeting the objective needs in the actual process.

[0031] It is to be understood that both the foregoing general description and the following detailed description are exemplary, and are intended to provide further explanation of the technology as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0033] Figure 1 An architectural diagram of a key management system provided in an embodiment of the present disclosure.

[0034] Figure 2A schematic diagram of an interactive process of a key management method provided in an embodiment of the present disclosure.

[0035] Figure 3 A flowchart of an optimal maintenance association relationship table provided in an embodiment of the present disclosure.

[0036] Figure 4 A flowchart of another preferred maintenance association table provided in an embodiment of the present disclosure.

[0037] Figure 5 A flowchart of distributing quantum keys provided in an embodiment of the present disclosure.

[0038] Figure 6 A flowchart of a preferred method for destroying a wireless key provided by an embodiment of the present disclosure.

[0039] Figure 7 A flowchart of a preferred method for destroying a quantum key provided for an embodiment of the present disclosure.

[0040] Figure 8 A flowchart of a preferred method for synchronizing wireless keys provided by an embodiment of the present disclosure.

[0041] Fig. 9 A structural block diagram of a key management device provided in an embodiment of the present disclosure.

[0042] Fig.10 A structural block diagram of another key management device provided in an embodiment of the present disclosure.

[0043] Fig.11 A hardware block diagram of an electronic device provided in an embodiment of the present disclosure;

[0044] Fig.12 A schematic diagram of a computer-readable storage medium provided for an embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present disclosure more obvious, the exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the exemplary embodiments described here.

[0046] At present, when quantum communication is carried out, the wireless key and quantum key on the terminal side are usually stored in the quantum security module and the quantum mobile phone communication module respectively. In this way, when quantum communication is carried out, the gateway side needs to manage the wireless key and quantum key separately, and the interaction process is relatively complicated. And if the quantum security module is replaced to a different terminal, the existing method has a high error rate and low efficiency, which is difficult to meet the objective needs in the actual process.

[0047] Therefore, this application proposes a key management method. By maintaining an association table, the gateway device can achieve unified management of wireless keys and quantum keys, simplifying the interactive process of key management. Figure 1 , Figure 1 This is an architecture diagram of a key management system provided by an embodiment of the present disclosure. Figure 1 As shown, the key management system includes at least: a terminal and a gateway device.

[0048] The terminal, which may also be referred to as a terminal device, user equipment, mobile station, mobile terminal, etc., is a mobile device that can use quantum communication technology for data encryption and protection. The terminal disclosed in the present invention includes at least a communication module and a security module module. The communication module is mainly responsible for data transmission and reception in the terminal. Specifically, the communication module of the terminal is mainly composed of core components such as quantum key reception, wireless key generation algorithm, and key management. The communication module can receive the quantum key issued by the gateway device and store it in its own quantum key pool. The communication module can also generate a wireless key and send the wireless key to the security module module of the terminal for the security module module to store the quantum key. The security module module is mainly responsible for security management and protection in the terminal. Specifically, the security module module of the terminal is mainly composed of core components such as wireless key reception and key management. The security module module can receive the wireless key sent by the communication module and safely store the wireless key in its own wireless key pool. It should be noted that the communication module disclosed in the present invention may have an application identifier, and the security module module may have a module identifier. However, the application identification and module identification of the present disclosure are not fixedly set or fixedly corresponded, that is, the identification relationship between the two may also change, which may involve the problem of module replacement. For example, when the Subscriber Identity Module (SIM) card is used as a security module, when it is replaced with another terminal, the module identification and application identification are not fixedly corresponded.

[0049] The number of terminals disclosed in the present invention is not limited here. The terminals disclosed in the present invention include but are not limited to at least one of the following: a mobile phone, a tablet computer, and a computer with wireless transceiver function. An exemplary preferred terminal disclosed in the present invention can be a quantum secure mobile communication terminal.

[0050] The gateway device can be understood as a bridge connecting the terminal and the core network (or backend system), which is not only responsible for data forwarding, but also for the unified management and distribution of keys. An exemplary preferred gateway device of the present disclosure is a WLAN quantum wireless gateway.

[0051] The embodiments of the present application have no particular restrictions on the specific technology and specific device form adopted by the terminal or gateway device.

[0052] Please refer to Figure 2, Figure 2 The following is a schematic diagram of an interactive process of a key management method provided by an embodiment of the present disclosure. Figure 2 As shown, the method includes:

[0053] In step S201, the gateway device maintains an association table; the association table is used to maintain the association between the application identifier, the module identifier, the wireless key, and the quantum key.

[0054] In the present disclosure, the application identifier can be understood as the unique identifier of the terminal application. An exemplary application identifier can be in the form of Q_APPID_1234, or in the form of other specific identifiers, which is not limited here. The module identifier can be understood as the unique identifier of a specific module (such as a hardware module, software component, etc.) on the terminal. Exemplarily, the module identifier can be in the form of E_ID_1234, or in the form of other specific identifiers, which is not limited here. The wireless key can be understood as a wireless key generated by the above-mentioned communication module, which can be stored in the wireless key pool of the security module module, or it can be a hash value of the wireless key, which can be flexibly adjusted according to actual conditions. The quantum key can be understood as the quantum key issued by the gateway device received by the above-mentioned communication module, or it can be a quantum key hash value, which can be flexibly adjusted according to actual conditions. It should be noted that the quantum key of the present disclosure can also be encrypted according to the wireless key corresponding to the application identifier and / or module identifier.

[0055] In the present disclosure, an association relationship can be understood as a connection or dependency relationship between different entities or virtual entities, which can be application identifiers, module identifiers, wireless keys, quantum keys, etc. Specifically, the association relationship includes but is not limited to at least one of the following: association between an application identifier and a module identifier, association between a module identifier and a wireless key, indirect association between an application identifier and a wireless key, and association between a quantum key and an application or module.

[0056] Specifically, the association between the application identifier and the module identifier can be understood as the application needs to use or rely on one or more specific modules on the terminal. For example, an application (identified by Q_APPID_1234) may need to interact with a security module (identified by E_ID_1234) that stores sensitive data. The association between the module identifier and the wireless key can be understood as a module is assigned one or more wireless keys for encrypting or decrypting data transmitted wirelessly. For example, a security module (identified by E_ID_1234) may store one or more wireless keys (or their hash values) to protect its communication with other devices. The indirect association between the application identifier and the wireless key can be understood as although the application identifier itself does not directly contain wireless key information, the application can be indirectly associated with the wireless key through the module it depends on. This means that when an application communicates through a module, it is actually using the wireless key associated with the module. The association of the quantum key with the application or module can be that the application or module needs a quantum key to encrypt or decrypt data. For example, an application that relies on a specific security module requires the use of quantum keys to ensure the absolute security of its communications.

[0057] In the present disclosure, the association table can store associations between multiple dimensions, including but not limited to at least one of the associations between application and module, module and wireless key, application and wireless key (indirect), and application / module and quantum key. Each entry in the association table represents a one-to-one association, which can achieve the uniqueness of the application identifier, module identifier, wireless key, and quantum key.

[0058] In the present disclosure, the gateway device can use the above-mentioned association table to maintain the association between the application identifier, module identifier, wireless key, and quantum key. The association table is the core of key management. It can realize the correct allocation and use of various types of keys, and also supports key management operations. In this way, by using a carefully designed association table, the gateway device can effectively manage and control the complex relationship between key elements such as application identifier, module identifier, wireless key, quantum key, etc. This management method not only ensures the correct allocation and use of keys, but also greatly enhances the security and flexibility of the system.

[0059] The gateway device can maintain the association table with the help of the terminal's request (the eleventh message); the gateway device can also periodically maintain the association table. The specific triggering of the gateway device to maintain the association table can be flexibly adjusted according to the actual system or user needs, and is not limited here.

[0060] In step S202, the gateway device performs key management based on the association table.

[0061] In the present disclosure, the gateway device can perform various key management operations based on this association table, including but not limited to at least one of the following operations: key update, key synchronization, key distribution, and key destruction, which will be explained in conjunction with specific embodiments below.

[0062] In summary, the technical solution gateway device provided by the present disclosure can achieve unified management of wireless keys and quantum keys by maintaining an association table. In layman's terms, because the association table stores the association between application identification, module identification, wireless key and quantum key. The gateway device can query the corresponding key information in the association table based on the application identification and / or module identification. And because all key information is stored in the association table instead of being scattered in different places, the gateway device only needs to query the association table to obtain all required key information without querying different storage locations separately. Compared with the existing need to manage wireless keys and quantum keys separately, the interactive process of key management can be simplified. At the same time, when the quantum security module is replaced to a different terminal, the gateway device can achieve seamless migration of key management by updating the association table, reducing the error rate of processing, improving the efficiency of processing, and meeting the objective needs in the actual process.

[0063] As mentioned above, the gateway device can maintain an association table to manage multiple types of keys. The following will specifically describe how the gateway device establishes an association between an application identifier and a module identifier in the association table:

[0064] For the gateway, the following processing is performed:

[0065] The gateway device receives a first message from the first terminal, where the first message carries an application identifier and a module identifier.

[0066] The gateway device establishes an association relationship between the application identifier and the module identifier in the association relationship table based on the first message.

[0067] Correspondingly, for the terminal, there are the following processing:

[0068] A first message is sent to the gateway device, where the first message carries an application identifier and a module identifier.

[0069] In the present disclosure, a gateway device may receive a first message sent by a first terminal via a communication protocol (such as TCP / IP, MQTT, etc., not exhaustive). This first message may carry an application identifier and a module identifier. These two identifiers are used to uniquely identify the application and security module of the terminal, respectively. Next, the gateway device may check whether corresponding records of the application identifier and the module identifier already exist in the association table. If there are corresponding records, the existing records are updated to ensure that the association between the application identifier and the module identifier is the latest. If there are no corresponding records, this can be achieved by creating a one-to-one record between the application identifier and the module identifier. In this way, the management of the application identifier and the module identifier can be unified in an association table, which is convenient for centralized management and query.

[0070] The correspondence between the application identifier and the module identifier in the exemplary association relationship table is shown in Table 1 below:

[0071]

[0072] Table 1

[0073] From Table 1 above, it can be seen from the association table that the exemplary application identifier (APP ID) Q_APPID_1234 corresponds one-to-one to the module identifier (module ID) E_ID_1234. The application identifier (APP ID) Q_APPID_5678 corresponds one-to-one to the module identifier (module ID) E_ID_5678. In this way, the correspondence between the application identifier and the module identifier can be determined in the association relationship.

[0074] It should be noted that, in actual use, the gateway device can also receive the first message in the manner that the gateway device can first receive the application identifier sent by the first terminal, and then receive the application identifier and module identifier sent by the first terminal. In this way, the gateway device can first receive the application identifier to know in advance which application the data to be received belongs to, so as to prepare the processing logic or resources related to the application. At the same time, by first receiving the application identifier, the gateway device can more accurately maintain this complex association relationship and ensure the correct allocation and processing of data.

[0075] It is worth noting that in the above embodiment, if there are other terminals, the first terminal can also send the application identifier of the first terminal to the other terminals, so that the other terminals record the application identifier of the first terminal, etc. The specific information received by the gateway device can be flexibly adjusted according to the actual system architecture and user needs.

[0076] Exemplary Figure 3 A flowchart of the preferred maintenance association table provided in the embodiment of the present disclosure. Figure 3As shown, the association relationship established between the quantum mobile phone communication module APPID (i.e., the application identifier of the present disclosure) and the quantum security module device ID (i.e., the module identifier of the present disclosure) is as follows:

[0077] First, when the quantum confidentiality service application software in the quantum mobile phone communication module (i.e., the communication module of the terminal disclosed in the present invention) is initialized, an APPID is generated, and a mobile phone application APPID message is sent to the default WLAN quantum wireless gateway (i.e., the gateway device disclosed in the present invention) address set in the software, which carries the APPID of the quantum mobile phone communication module A.

[0078] After receiving the reported APPID message, the WLAN quantum wireless gateway will create an association between the gateway and the APPID. This association enables the gateway to track and manage each quantum mobile phone communication module that has reported the APPID. The gateway will then query the addresses of all quantum mobile phone communication modules that have reported the APPID through the device management function. This is to ensure that the gateway has the information of all active modules in the network. The gateway will send a notification application APPID message to all reported quantum mobile phone communication modules. This message contains the APPID and address of the newly added quantum mobile phone communication module A, as well as all other reported module information. In this way, the quantum mobile phone communication module and the WLAN quantum wireless gateway can notify each other of each other's messages. In this way, each module of the terminal or gateway device can obtain the existence and status of other modules in the network, realize global information sharing, and provide a solid foundation for the establishment of associations for subsequent gateway devices.

[0079] Next, after completing the APPID registration of the quantum mobile phone communication module A, connect the quantum security module A (i.e., the module module of the terminal disclosed in the present invention) to the mobile phone to trigger the module registration and binding process. After the module is connected to the mobile phone, the module device identification ID is reported to the quantum mobile phone communication module A by first reporting the module device ID message. After the quantum mobile phone communication module A receives the message, it records the device ID of the quantum security module A locally, and sends a reporting module device ID message (i.e., the first message in the previous text) to the WLAN quantum wireless gateway, which carries the APPID of the quantum mobile phone communication module A and the device ID of the quantum security module A. After the WLAN quantum wireless gateway receives the reporting module device ID message, the association relationship between the WLAN quantum wireless gateway maintained locally and the APPID of the quantum mobile phone communication module A and the device ID of the quantum security module A can be established.

[0080] As described above, it is specifically described how the gateway device establishes the association relationship between the application identifier and the module identifier in the association relationship table. Further, the following will specifically describe how the gateway device maintains the association relationship between the application identifier, the module identifier and the wireless key in the association relationship table. At this time, the method of maintaining the association relationship table includes:

[0081] For gateway devices, the following processing is performed:

[0082] The gateway device generates a first wireless key.

[0083] The gateway device receives a second message from the first terminal, where the second message carries a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier.

[0084] The gateway device verifies the consistency of the first wireless key and the second wireless key.

[0085] When the first wireless key is consistent with the second wireless key, the gateway device maintains the association relationship between the application identifier, the module identifier and the second wireless key in the association relationship table based on the second message.

[0086] Correspondingly, for the terminal device, there are the following processing:

[0087] Sending a second message to the gateway device, the second message carrying a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier;

[0088] receiving a thirteenth message from the gateway device, the thirteenth message carrying a first wireless key generated by the gateway device;

[0089] Verifying the consistency of the second wireless key and the first wireless key;

[0090] When the second wireless key is consistent with the first wireless key, the second wireless key pool is updated.

[0091] In the present disclosure, both the gateway device and the first terminal can generate wireless keys, and the ways in which the two generate wireless keys can be completely consistent or partially the same, which is not limited here.

[0092] In the present disclosure, if the gateway device wants to establish a relationship between a wireless key and an application identifier and a module identifier in a relationship association table, it is necessary to verify whether the wireless keys generated by the gateway side and / or the terminal side are consistent. When the gateway device verifies that the first wireless key generated by itself is consistent with the second wireless key received by the first terminal side, the association relationship between the second wireless key and the corresponding application identifier and module identifier can be directly established in the association relationship table.

[0093] Specifically, the gateway device can generate a first wireless key with the help of its own wireless key. At the same time, the gateway device can receive a second message sent by the first terminal. This second message contains a first identifier (application identifier and / or module identifier of the first terminal) and a second wireless key. The second wireless key can be the wireless key currently held by the terminal. The gateway device then compares the received second wireless key with the first wireless key generated by itself to confirm whether the two are consistent. If the first wireless key and the second wireless key are inconsistent, it can trigger the continued generation of wireless keys until they are consistent. If the first wireless key and the second wireless key are consistent, the gateway device will update or maintain the association between the application identifier, the module identifier and the second wireless key (or update it to the first wireless key) in its internal association table. In this way, the gateway device knows which terminals or applications use which keys to communicate.

[0094] Furthermore, while the gateway device verifies the consistency of the wireless key and updates the association table, it can also notify the first terminal of the consistency verification result of the gateway device or the generated first wireless key, and the first terminal performs further processing. The following is a specific description:

[0095] In one embodiment of the present disclosure, the first terminal may receive the verification consistency result sent by the gateway device, and store the second wireless key generated by itself or the received first wireless key in the wireless key pool through its own wireless key management.

[0096] In another embodiment of the present disclosure, the first terminal may also receive a thirteenth message from the gateway device, the thirteenth message carrying the first wireless key generated by the gateway device. The first terminal verifies the consistency of the second wireless key and the first wireless key. When the second wireless key is consistent with the first wireless key, the first terminal updates the second wireless key pool.

[0097] Specifically, the first terminal can receive the thirteenth message from the gateway device, which carries the first wireless key generated by the gateway device. The first terminal compares the received first wireless key with the second wireless key it holds to confirm whether the two are consistent. If the second wireless key is inconsistent with the first wireless key, it can trigger the continued generation of wireless keys until they are consistent. If the second wireless key is consistent with the first wireless key, the first terminal will update its internal wireless key pool (add the second wireless key or the first wireless key to the key pool). In this way, the terminal has the latest key, which can be used for subsequent encrypted communications. It should be noted that the terminal side can determine whether to perform verification based on the actual system or user needs, and there is no restriction here.

[0098] In this way, the establishment and dynamic update of the association relationship table can be realized, and the timeliness and accuracy of communication can be achieved.

[0099] Exemplarily, the corresponding relationship between the wireless key, the application identifier and the module identifier is maintained in the association relationship table as shown in Table 2 below:

[0100]

[0101]

[0102] Table 2

[0103] It can be seen from Table 2 above that once the gateway device verifies that the wireless key generated by itself is consistent with the wireless key sent by the first terminal, it can add row data of the wireless key according to the application identifier and / or module identifier of the first terminal, so that the association relationship between the wireless key, application identifier, and module identifier can be maintained in the relationship association table.

[0104] For example, Figure 4 Another preferred flowchart of maintaining the association relationship table provided by the embodiment of the present disclosure. Figure 4 As shown, both the quantum secure mobile communication terminal and the WLAN quantum wireless gateway can be verified. When the verification passes, the verified wireless key can be added to the association table.

[0105] Specifically, after the quantum mobile phone communication module (i.e., the communication module of the terminal disclosed in the present invention) generates a usable wireless key through a wireless key generation algorithm, a wireless key consistency verification request message (i.e., the second message described above) is sent to the WLAN quantum wireless gateway (i.e., the gateway device disclosed in the present invention), which carries the quantum mobile phone communication module APPID, quantum security module device ID, and wireless key hash value parameters.

[0106] After receiving the request message for verifying the consistency of the wireless key, the WLAN quantum wireless gateway compares the wireless key hash value in the message with the wireless key hash value generated by itself in real time, and returns the comparison result to the quantum mobile phone communication module through the wireless key consistency verification response message. The message carries the verification result flag (Y / N), where Y represents the verification passing, indicating that the wireless keys generated by both sides are consistent, and N represents the verification failure, indicating that the wireless keys generated by both sides are inconsistent. If the verification result flag is Y, the newly generated wireless key and its hash value are encrypted and stored in the wireless key pool of the gateway itself through its own wireless key management function. For security reasons, the wireless key pool should be stored in an encrypted storage chip. After the wireless key is stored, the APPID identifier and the module ID identifier correspondence table should be updated immediately, and the hash value of the wireless key should be written into the wireless key hash value column of the corresponding APPID. If there is relevant data in the column, a new row of data should be added. If the verification result flag is N, the WLAN quantum wireless gateway and the quantum secure mobile communication terminal are re-triggered to generate a new wireless key.

[0107] At the same time, after receiving the response message for verifying the consistency of the wireless key, the quantum mobile phone communication module determines the wireless key verification result to confirm whether the wireless keys generated by both sides are consistent. If the verification result flag is Y, the quantum mobile phone communication module sends a wireless key storage notification to the quantum security module through wireless key management, which carries the newly generated wireless key and wireless key hash value parameters. After receiving the notification, the quantum security module encrypts the received wireless key and its hash value and stores it in the module's own wireless key pool. For security reasons, the wireless key pool should be stored in an encrypted storage chip. If the verification result flag is N, the quantum secure mobile communication terminal and the WLAN quantum wireless gateway are re-triggered to generate a new wireless key.

[0108] It should be noted that the first terminal can correspond to one or more wireless keys, and the number of stored wireless keys is not limited here. Exemplarily, the wireless keys generated by the quantum secure mobile communication terminal and the WLAN quantum wireless gateway and stored after verification can reach the maximum storable wireless key threshold set by default on both sides (such as 20 groups, 30 groups, etc.), and then stop generating new wireless keys; until it is monitored that the available wireless keys stored on both sides are lower than the minimum wireless key threshold that needs to be supplemented (such as 5 groups, 10 groups, etc.), continue to trigger both sides to generate new wireless keys.

[0109] As mentioned above, the above specifically describes how the gateway device maintains the association relationship between the application identifier, the module identifier and the wireless key in the association relationship table. The following specifically describes how the gateway device maintains the association relationship between the application identifier, the module identifier, the wireless key and the quantum key in the association relationship table:

[0110] In the present disclosure, the method for generating the quantum key can be to reuse the existing technology for generation, which is not specifically limited here. When maintaining the association relationship between the application identifier, the module identifier, the wireless key and the quantum key in the association relationship table, the above-mentioned method for establishing the association relationship between the application identifier, the module identifier and the wireless key can be referred to, and the association relationship can also be established in a hierarchical association manner in other ways, which is not limited here.

[0111] Exemplarily, the corresponding relationship between the application identifier, the module identifier, the wireless key and the quantum key is maintained in the association relationship table as shown in Table 3 below:

[0112]

[0113]

[0114] Table 3

[0115] It can be seen from Table 3 that after the quantum key is generated and stored, a complete association relationship between the APPID identifier (i.e., the application identifier of the present disclosure), the module ID identifier (i.e., the module identifier of the present disclosure), the wireless key hash value (i.e., the wireless key of the present disclosure) and the quantum key hash value (i.e., the quantum key of the present disclosure) will be established in the association table.

[0116] As described above, how the gateway device maintains the association relationship table is specifically described.

[0117] The following will specifically describe how the gateway device manages multiple keys based on the association table.

[0118] The first management method is that the gateway device can distribute quantum keys to multiple terminals upon request from the terminal side, and update the association table based on this management method. At this time, the method for key management includes:

[0119] For gateway devices, the following processing is performed:

[0120] The gateway device receives a third message from the first terminal, where the third message is used to request a quantum key, and the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal.

[0121] The gateway device sends a first quantum key to the first terminal and the second terminal respectively; wherein the first quantum key is encrypted using a third wireless key respectively.

[0122] The gateway device receives fourth messages from the first terminal and the second terminal respectively, and the fourth message carries the verification result of the terminal on the first quantum key.

[0123] The gateway device updates the association table based on the fourth message.

[0124] Correspondingly, for the terminal device, there are the following processing:

[0125] Sending a third message to the gateway device, where the third message is used to request a quantum key, and the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal;

[0126] Receiving a first quantum key sent from a gateway device; wherein the first quantum key is encrypted using a third wireless key;

[0127] Verifying the first quantum key;

[0128] When the first quantum key verification succeeds, the second quantum key pool is updated.

[0129] In the present disclosure, the gateway device will determine to send the corresponding first quantum key to the corresponding terminal based on the application identifiers of the multiple terminals received. The gateway device may receive the application identifiers of the multiple terminals in the form of all application identifiers sent by one terminal or in the form of application identifiers sent by multiple terminals. The gateway device determines the correspondence based on the application identifiers corresponding to the multiple terminals and sends the first quantum key. It should be noted that the first quantum key is encrypted by the wireless key corresponding to the application identifier. The gateway device will receive the verification results of the distributed quantum keys from multiple terminals, and determine whether to update the association table based on the results of the verified first quantum key.

[0130] Specifically, the gateway device can receive application identification messages from each terminal. And the gateway device searches for the corresponding record in the association table according to the application identification, finds the matching terminal, and prepares to send the first quantum key. If the first quantum key of the corresponding terminal already exists in the gateway device, it is sent directly; if not, the first quantum key can be encrypted according to the wireless key (i.e., the third wireless key) corresponding to the application identification. This is encrypted to obtain the first quantum key through a key derivation function or other key encryption algorithm, which is not limited here. The gateway device can receive verification messages from the quantum keys corresponding to each terminal respectively, and determine to update the association table based on the verification message. In this way, the gateway device can realize the security of the quantum key and the dynamic update of the association table, maintain the latest and most accurate association table, thereby simplifying management. At the same time, the gateway device can quickly encrypt and distribute quantum keys, reduce waiting time, and improve the response speed of the system.

[0131] After receiving the quantum key sent by the above-mentioned gateway device, the terminal can decrypt the received quantum key according to the wireless key in its own wireless key pool, determine whether the quantum key sent by the received gateway device is consistent with the requested quantum key, and then determine to update the quantum key pool.

[0132] Specifically, taking the first terminal as an example, the first terminal can receive the first quantum key sent from the gateway device. The first terminal verifies the first quantum key. When the first quantum key verification succeeds, the first terminal updates the second quantum key pool.

[0133] In this way, the gateway device encrypts the quantum key using a wireless key, and the terminal device uses the wireless key to decrypt the quantum key through a double verification mechanism, which can ensure the security of the quantum key during transmission and enhance the flexibility of the system.

[0134] Exemplarily, after the gateway device completes distributing quantum keys to multiple terminals, the updated association table is shown in Table 4 below:

[0135]

[0136] Table 4

[0137] As can be seen from Table 4 above, once the gateway device receives the verification message sent by each terminal, it can fill in the updated quantum key in the association table according to the message. After the update is completed, a one-to-one correspondence between the quantum mobile phone communication module APPID, module ID, wireless key, and quantum key will be established.

[0138] As shown above, the gateway device needs to determine whether the quantum key is successfully distributed in the first management mode, and then update the relationship association table. Among them, if the gateway device itself has the quantum key corresponding to the terminal identifier, it can be distributed directly. However, if the quantum key corresponding to the terminal identifier does not exist, the corresponding quantum key can also be encrypted using the wireless key corresponding to the terminal identifier. At this time, the method of obtaining the corresponding quantum key includes:

[0139] For gateway devices, the following processing is performed:

[0140] Acquire a third wireless key corresponding to the third message;

[0141] The second quantum key corresponding to the third message is encrypted using the third wireless key to obtain the first quantum key.

[0142] In the present disclosure, the gateway device can query whether there is a corresponding wireless key (i.e., the third wireless key of the present disclosure) in the local wireless key pool through a third message containing an application identifier and / or a module identifier sent by the terminal. When there is a corresponding wireless key, the first quantum key corresponding to the third message can be encrypted with the wireless key. When there is no corresponding wireless key, the wireless key can be triggered to obtain the wireless key. For details, please refer to the above, which will not be repeated here.

[0143] In this way, the quantum key can be encrypted by using a wireless key to ensure the security of the quantum key during transmission. At the same time, the gateway device can dynamically obtain or use existing wireless keys as needed, which enhances the flexibility of the system and centrally manages the key acquisition and encryption process, simplifying the complexity of key management.

[0144] As mentioned above, in the first management mode, the gateway device can obtain the corresponding quantum key by encrypting the wireless key corresponding to the application identifier. There are many ways to obtain the wireless key corresponding to the application identifier. The present disclosure exemplarily proposes the following method for obtaining the wireless key:

[0145] Verifying whether there is a second quantum key corresponding to the third message in the first quantum key pool;

[0146] When the second quantum key exists in the first quantum key pool, querying a third wireless key corresponding to the third message based on the third message;

[0147] When the second quantum key does not exist in the first quantum key pool, a third wireless key corresponding to the third message is generated based on the third message.

[0148] In the present disclosure, if the gateway device wants to obtain the third wireless key corresponding to the third message, it can first check whether there is a quantum key corresponding to the application identification and / or module identification of the terminal in the local quantum key pool through the quantum key management module. If there is a quantum key corresponding to the application identification and / or module identification of the terminal, the wireless key can be directly determined and queried according to the application identification and / or module identification of the terminal. If there is no quantum key corresponding to the application identification and / or module identification of the terminal, the process of quantum key generation can be triggered. This can be obtained by reusing the existing technology. In this way, by checking the local key pool and triggering the key generation process only when necessary, the gateway device can efficiently manage key resources and reduce unnecessary communications.

[0149] In summary, the gateway device can check and manage quantum keys through the quantum key management module with the help of the association table. The above method can combine the advancement of quantum key distribution (QKD) with the flexibility of traditional key management, simplify the key management interaction process, and can also adapt well to the existing quantum key distribution process, improving processing efficiency.

[0150] For example, Figure 5 The flowchart of distributing quantum keys provided by the embodiment of the present disclosure. Figure 5 As shown:

[0151] The secure communication component in the quantum secure service application software (i.e., the communication module of the terminal disclosed in the present invention) receives a request to use the quantum key and sends a quantum key request message (i.e., the third message in the previous text) to the WLAN quantum wireless gateway (i.e., the gateway device disclosed in the present invention). The message carries the APPID of the quantum mobile phone communication module A and the quantum mobile phone communication module B that communicates with it.

[0152] After receiving the quantum key request message, the WLAN quantum wireless gateway determines whether there is an available quantum key in the local quantum key pool through the quantum key management function. If not, the process of obtaining the quantum key will be triggered. If so, the available wireless key (i.e., the third wireless key in the previous text) will be queried through the wireless key management according to all the APPIDs carried in the message. If there is no available wireless key for the corresponding APPID in the local wireless key pool, the WLAN quantum wireless gateway and the quantum secure mobile communication terminal corresponding to the APPID will be triggered to generate a wireless key process. After the available wireless key is queried through the wireless key management according to all APPIDs, the quantum key is encrypted by the queried wireless key to obtain the quantum key corresponding to the message (i.e., the first quantum key in the previous text).

[0153] The WLAN quantum wireless gateway sends a quantum key distribution request message to the corresponding quantum mobile phone communication module through quantum key management according to the APPID. The message carries the wireless key hash value corresponding to the APPID of the quantum mobile phone communication module used to encrypt the quantum key, the encrypted quantum key, and the hash value of the quantum key before encryption.

[0154] After the corresponding quantum mobile phone communication module receives the quantum key distribution request message, the quantum key management function in the quantum mobile phone communication module requests the wireless key from the wireless key management function. The wireless key management obtains the wireless key corresponding to the hash value from the wireless key pool in the quantum security module according to the wireless key hash value carried in the message, and decrypts the encrypted quantum key carried in the quantum key distribution request message through the wireless key to obtain the unencrypted quantum key, and uses the obtained unencrypted quantum key to calculate the hash value and compare and verify the hash value parameter of the quantum key before encryption carried in the quantum key distribution request message. If the verification is successful, the decrypted quantum key is stored in the quantum key pool, and the wireless key destruction process is triggered. If the verification fails, a quantum key distribution response message is sent to the WLAN quantum wireless gateway. The message carries a distribution identification parameter, where Y represents successful distribution and N represents failed distribution. In addition, after the quantum key distributed on the quantum mobile phone communication module side is successfully verified, a quantum key distribution response message will also be sent to the WLAN quantum wireless gateway.

[0155] The WLAN quantum wireless gateway receives the key distribution response message from each terminal respectively. If the distribution fails, it determines whether the quantum key is successfully distributed to other quantum mobile phone communication modules. If the quantum key is successfully distributed to other quantum mobile phone communication modules, the quantum key destruction process for the quantum mobile phone communication module is triggered. If the quantum key distribution to other quantum mobile phone communication modules fails, the WLAN quantum wireless gateway will re-trigger the distribution of quantum keys to each quantum mobile phone communication module that has established a quantum confidentiality service.

[0156] The second management method is that the gateway device destroys the wireless key or quantum key upon request from the terminal side, and updates the association table according to the management method. In this case, the key management method includes:

[0157] For gateway devices, the following processing is performed:

[0158] The gateway device receives a fifth message from the first terminal, where the fifth message is used to request destruction of a target key; the target key is a wireless key and / or a quantum key.

[0159] The gateway device destroys the target key in the key pool to which the target key belongs, and updates the association table.

[0160] Correspondingly, for the terminal, there are the following processing:

[0161] A fifth message is sent to the gateway device, where the fifth message is used to request destruction of a target key; the target key is a wireless key and / or a quantum key.

[0162] In the present disclosure, the gateway device can also destroy the wireless key or quantum key according to the association table. The instruction to destroy the wireless key or quantum key can be triggered by the first terminal. Exemplarily, when the first terminal determines that the wireless key is generated, the destruction of the wireless key can be triggered. When at least one terminal determines that the quantum key distributed by the gateway device is successful, the destruction of the quantum key can be triggered. When the gateway device receives a message triggered by the terminal to destroy the target key (wireless key and / or quantum key), the gateway device can directly destroy the key indicated by the terminal message in the local key pool, and can delete the key indicated by the message in the association table of the local storage record.

[0163] In this way, the gateway device can destroy no longer needed keys in a timely manner, which can effectively reduce potential security risks. At the same time, it can determine the destruction of keys for multiple terminals, simplify the interaction process, and improve system efficiency.

[0164] Exemplarily, the association table updated after deleting the wireless key is shown in Table 5 below:

[0165]

[0166]

[0167] Table 5

[0168] From Table 5 above, it can be seen that when the terminal determines that the wireless key needs to be destroyed, the wireless key hash value column in the table is cleared, but the entry will not be deleted. The entry will only be deleted when both the wireless key hash value column and the quantum key hash value column in the entry are cleared.

[0169] Exemplarily, the updated association table after deleting the quantum key is shown in Table 6 below:

[0170]

[0171] Table 6

[0172] It can be seen from Table 6 above that when the terminal determines that the quantum key needs to be destroyed, the quantum key hash value column in the quantum mobile phone communication module APPID and quantum security module device ID association table will be cleared and the entry will be deleted.

[0173] Figure 6 The flowchart of the preferred destruction of wireless keys provided by the embodiment of the present disclosure. Figure 6 As shown:

[0174] After receiving the notification of wireless key destruction, the quantum mobile phone communication module (i.e., the communication module of the terminal disclosed in the present invention) notifies the quantum security module through the wireless key management to delete the wireless key corresponding to the hash value in the quantum key pool; after receiving the information that the quantum security module has successfully deleted the wireless key, the quantum mobile phone communication module sends a wireless key destruction request message (i.e., the fifth message in the previous text) to the WLAN quantum wireless gateway (i.e., the gateway device disclosed in the present invention).

[0175] WLAN quantum wireless gateway request message, which carries the quantum mobile phone communication module APPID, quantum security module device ID, and the wireless key hash value parameters destroyed on the mobile phone side. The destruction operation can be performed through wireless key management, and the wireless key corresponding to the wireless key hash value carried in the message is found from the local wireless key pool and deleted. After successfully deleting the corresponding wireless key in the local wireless key pool, the WLAN quantum wireless gateway returns a wireless key destruction response message to the quantum mobile phone communication module. The message carries a destruction result flag, which can be set to Y or N, representing the success or failure of the wireless key destruction on the WLAN quantum wireless gateway side.

[0176] When the WLAN quantum wireless gateway successfully destroys the wireless key, the quantum mobile phone communication module ends the destruction process; when the WLAN quantum wireless gateway fails to destroy the wireless key, the quantum mobile phone communication module will re-trigger the destruction process of the wireless key corresponding to the hash value.

[0177] Figure 7 The flowchart of the preferred destruction of quantum key provided by the embodiment of the present disclosure. Figure 7 As shown:

[0178] After receiving the notification of quantum key destruction, the quantum mobile phone communication module A (i.e., the communication module of the first terminal disclosed in the present invention) sends a quantum key destruction request message (i.e., the fifth message in the previous text) to the WLAN quantum wireless gateway through quantum key management.

[0179] The WLAN quantum wireless gateway receives the request message, which carries the APPID and quantum key hash value parameters of quantum mobile phone communication module A. According to the quantum key hash value carried in the message, the corresponding association table of APPID identification and module ID identification can be searched to find the APPID and address of all other quantum mobile phone communication modules that have distributed the quantum key hash value, and through the WLAN quantum wireless gateway quantum key management, a quantum key destruction request message is sent to each quantum mobile phone communication module, which carries the APPID of each quantum mobile phone communication module and the quantum key hash value to be destroyed.

[0180] After receiving the request message, other quantum mobile phone communication modules perform the quantum key destruction operation, delete the quantum key with the hash value carried in the received message from the quantum key pool, and return a quantum key destruction response message to the WLAN quantum wireless gateway. The message carries a destruction result flag, which can be set to Y or N, representing the success or failure of the quantum key destruction respectively; when the destruction fails, the WLAN quantum wireless gateway will re-initiate the quantum key destruction operation on the quantum mobile phone communication module that failed to be destroyed; when all other quantum mobile phone communication modules are destroyed and all return the success of the quantum key destruction, the WLAN quantum wireless gateway will send a quantum key destruction success response message to the quantum mobile phone communication module A that actively initiated the quantum key destruction. After receiving the quantum key destruction success response message, quantum mobile phone communication module A performs the quantum key destruction operation and deletes the corresponding quantum key from the local quantum key pool.

[0181] The third management method is that when the security module of the terminal is replaced with another terminal, the gateway device updates the association table upon request from the terminal side. At this time, the method for managing the key by the gateway device includes:

[0182] For gateway devices, the following processing is performed:

[0183] The gateway device obtains a sixth message from the first terminal, where the sixth message carries the first application identifier, the first module identifier, and a fourth wireless key corresponding to the first module identifier of the first terminal.

[0184] The gateway device obtains the fifth wireless key corresponding to the first application identifier in the association relationship table.

[0185] The gateway device deletes a sixth wireless key from the wireless key pool, where the sixth wireless key is a wireless key that is inconsistent with the fourth wireless key and the fifth wireless key.

[0186] The gateway device updates the association relationship table.

[0187] Correspondingly, for the terminal, there are the following processing:

[0188] A sixth message is sent to the gateway device, where the sixth message carries the first application identifier of the first terminal, the first module identifier, and a fourth wireless key corresponding to the first module identifier.

[0189] In the present disclosure, the first terminal notifies the module replacement by sending a sixth message to the gateway device, and carries its first application identifier, the first module identifier of the new module, and the corresponding fourth wireless key. After receiving the sixth message, the gateway device can search for the original wireless key (fifth wireless key) corresponding to the first application identifier in the association table stored in it. This is to verify the current terminal application identity or verify whether the previously assigned key is still valid. The gateway device compares the fourth wireless key with the fifth wireless key in the association table. If the two are found to be inconsistent, the gateway device can delete all wireless keys (sixth wireless keys) that are no longer valid and related to the previous module of the first terminal in the wireless key pool it manages to ensure the security of communication. The gateway device will update the association table, associate the first application identifier with the first module identifier of the new module and the new fourth wireless key, and complete the key update operation.

[0190] Further, after completing the update of the association table, the gateway device can send a synchronization result (i.e., whether the update is completed) to the terminal device, and the terminal can perform the next step after receiving the key synchronization result sent by the above-mentioned gateway device, as described below: The terminal can directly update the second wireless key pool according to the internal wireless key management module. This may include but is not limited to at least one of the following: adding new keys, deleting old keys, etc. If the synchronization result fails, the first terminal can take action, which is not limited here.

[0191] The first terminal receives a tenth message from the gateway device, the tenth message carrying a synchronization result of the wireless key by the gateway device;

[0192] The first terminal updates the second wireless key pool.

[0193] In the present disclosure, after completing the update of the key information in the association table (i.e., the synchronization of the wireless key), the gateway device can generate a synchronization result message, i.e., the tenth message. This message contains a clear indication of whether the wireless key synchronization is successful. After the first terminal receives the tenth message from the gateway device, it can parse the message to obtain the synchronization result. If the tenth message indicates that the wireless key synchronization is successful, the first terminal directly updates the second wireless key pool according to the internal wireless key management module. This may include but is not limited to at least one of the following: adding new keys, deleting old keys, etc. If the synchronization result fails, the first terminal can take further action, which is not limited here.

[0194] In this way, the synchronization result (the tenth message) is sent by the gateway device and received by the first terminal, which updates its second wireless key pool accordingly. This process ensures the synchronization and consistency of the wireless key between the terminal and the gateway. The first terminal can timely understand the status of key synchronization and take corresponding measures to implement a complete key management process.

[0195] In this way, the first terminal and the gateway device can effectively prevent key errors caused by module replacement through mutual verification, and directly perform key management based on the updated association table, which can effectively reduce the probability of key management errors.

[0196] Exemplarily, the updated association table after the module is replaced is shown in Table 7 below:

[0197]

[0198] Table 7

[0199] In Table 7, the quantum security module with module ID E_ID_1234 was previously connected to the quantum mobile phone communication module with APPID Q_APPID_1234 and generated a usable wireless key. The quantum security module with module ID E_ID_5678 was previously connected to the quantum mobile phone communication module with APPID Q_APPID_5678 and generated a usable wireless key.

[0200] When the module ID E_ID_5678 is changed to the APPID Q_APPID_1234 (i.e. the module is replaced), the quantum security module with the module ID E_ID_5678 needs to be reconnected to the quantum mobile phone communication module with the APPID Q_APPID_1234. The APPID of the original module E_ID_1234 will not be updated until the new APPID appears to update the association table.

[0201] As mentioned above, in the third management mode, the gateway device can use the sixth message to determine whether to update the association table. It should be noted that the first module identifier contained in the sixth message can be understood as the module identifier after the first terminal replaces the module. Specifically, in actual use, when the terminal module is replaced and the gateway device updates the association table, it can only accept the sixth message, or it can first receive the seventh message and then the sixth message. The following is a detailed description:

[0202] For gateway devices, the following processing is performed:

[0203] The first terminal sends a seventh message to the gateway device, where the seventh message carries the first module identifier.

[0204] The gateway device receives the seventh message from the first terminal.

[0205] Accordingly, for the terminal, there are the following processing:

[0206] A seventh message is sent to the gateway device, where the seventh message carries the first module identifier.

[0207] In the present disclosure, when the first terminal module is replaced, the first terminal can first send the seventh message (i.e., the replaced module identifier) ​​to the gateway device. This message mainly carries the replaced module identifier, i.e., the new first module identifier. In this way, the gateway device can be notified that the first terminal has replaced the module, and the identification information of the new module is provided so that the gateway device can identify and prepare for subsequent key updates or verification operations, and prepare conditions for receiving the sixth message. In this way, by sending the seventh message to promptly notify the gateway device of the module replacement, the speed at which the gateway device receives the sixth message is increased, and the efficiency of the communication system is improved.

[0208] As described above, in the third management mode, after the module is replaced, the gateway device needs to obtain the sixth message sent by the first terminal when updating the association table. The present disclosure also provides a preferred method for obtaining the sixth message, as shown below:

[0209] For gateway devices, the following processing is performed:

[0210] The gateway device sends an eighth message to the first terminal, where the eighth message is used to request a wireless key.

[0211] The gateway device receives a sixth message from the first terminal.

[0212] Accordingly, for the terminal, there are the following processing:

[0213] receiving an eighth message from the gateway device, the eighth message being used to request a wireless key;

[0214] A sixth message is sent to the gateway device.

[0215] In the present disclosure, when it is detected that the first terminal may have replaced the module or needs to update the wireless key for other security considerations, the gateway device can actively send the eighth message to the first terminal. The main purpose of this message is to request the first terminal to provide the current wireless key information. After receiving the eighth message from the gateway device, the first terminal parses the message content to confirm the legitimacy and purpose of the request. After confirming the request, the first terminal can determine the sixth message, which contains necessary information, such as the first application identifier, the first module identifier of the new module, and the corresponding fourth wireless key. Then, the first terminal sends the sixth message to the gateway device. The gateway device can receive the sixth message.

[0216] In this way, by actively sending a request (the eighth message) through the gateway device and receiving a response (the sixth message) from the first terminal, this method can ensure that during the module replacement or key update process, the communication between the two parties is secure, orderly and verifiable, and can provide the security of key management.

[0217] Figure 8 A flowchart of a preferred synchronization wireless key provided by an embodiment of the present disclosure. Figure 8 As shown:

[0218] When the quantum security module is replaced to a new mobile phone (i.e., the module replacement disclosed in the present invention), the module device identification ID is reported to the quantum mobile phone communication module (i.e., the terminal disclosed in the present invention) by reporting the module device ID (i.e., the module identification disclosed in the present invention) message; after the quantum mobile phone communication module receives the message, the device ID of the connected quantum security module is updated locally, and a module device ID reporting message (i.e., the sixth message disclosed in the present invention) is sent to the WLAN quantum wireless gateway, which carries the APPID of the quantum mobile phone communication module and the device ID of the new quantum security module.

[0219] After the WLAN quantum wireless gateway (i.e., the gateway device disclosed in the present invention) receives the module device ID reporting message, it immediately updates the association relationship between the WLAN quantum wireless gateway and the quantum mobile phone communication module APPID and the quantum security module device ID maintained locally, so as to update the three correspondence tables of the WLAN quantum wireless gateway, the mobile phone application, and the module device. The update operation disassociates the module device originally associated with the mobile phone APPID in the association table and the wireless key hash value in the module device, that is, the mobile phone APPID is completely deleted from the APPID identification column in the existing relationship table; then, according to the quantum security module device ID carried in the module device ID reporting message, the entry information of all the module IDs in the association table is searched, and the original identification information in the corresponding entry information APPID identification column is modified to the quantum mobile phone communication module APPID carried in the message, so as to complete the establishment of a new association relationship between the WLAN quantum wireless gateway and the mobile phone application, the module device, and the wireless key hash value in the module device. After the WLAN quantum wireless gateway completes the connection of the quantum security module to the new quantum mobile phone communication module and updates the association table, it sends a wireless key request message to the new quantum mobile phone communication module through the wireless key management function.

[0220] After receiving the wireless key reporting request message, the new quantum mobile phone communication module obtains the wireless key from the quantum security module, and the quantum security module feeds back the wireless key hash value list it stores to the quantum mobile phone communication module; after receiving the information returned by the quantum security module, the quantum mobile phone communication module returns a wireless key reporting response message to the WLAN quantum wireless gateway, which carries the quantum mobile phone communication module APPID, the quantum security module device ID, and the wireless key hash value list parameters returned by the quantum security module to the quantum mobile phone communication module.

[0221] After receiving the reported wireless key response message, the WLAN quantum wireless gateway searches for the wireless key hash value corresponding to the device ID in the association table according to the quantum security module device ID, and compares it with each wireless key hash value in the wireless key hash value list carried in the response message. The hash values ​​that are inconsistent with the comparison are put into the inconsistent wireless key hash value list, and after the comparison is completed, the wireless key management function on the WLAN quantum wireless gateway side sends a synchronization wireless key notification message to the wireless key management function on the quantum mobile phone communication module side through the wireless key management function on the WLAN quantum wireless gateway side. The message carries a synchronization identifier. If all hash values ​​are the same, the synchronization identifier is Y; if there are inconsistent wireless keys after the comparison, the synchronization identifier is N, and it carries inconsistent wireless key hash value list parameters.

[0222] After receiving the synchronization wireless key notification message, the quantum mobile phone communication module determines whether there is an inconsistent wireless key. If the synchronization flag is Y, a wireless key deletion message is sent to the quantum security module, which carries an inconsistent wireless key hash value list. After receiving the wireless key deletion message, the quantum security module deletes the corresponding wireless key in the wireless key pool according to the hash value recorded in the inconsistent wireless key hash value list. If the synchronization flag is N, the wireless key management function in the quantum mobile phone communication module does not need to perform further operations.

[0223] After the WLAN quantum wireless gateway compares the wireless key hash value recorded by the module ID in the association table with each wireless key hash value in the wireless key hash value list carried in the response message, for any inconsistent wireless keys, the wireless key management function on the WLAN quantum wireless gateway side will delete the inconsistent wireless keys found from the association table and the wireless key pool. The operation on the association table is to delete the entire entry information, rather than just deleting the value information in the wireless key hash value column.

[0224] The present disclosure also provides a key management system, comprising:

[0225] The gateway device is used to execute and maintain the association relationship table; the association relationship table is used to maintain the association relationship between the application identifier, the module identifier, the wireless key, and the quantum key; based on the association relationship table, the key is managed;

[0226] At least one terminal is provided with a communication module and a security module, and is used to execute sending an eleventh message to a gateway device, wherein the eleventh message is used to request the gateway device to maintain an association table, and the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship among the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

[0227] The present disclosure also provides a key management device, which is applied to a gateway device. Fig. 9 A structural block diagram of a key management device provided in an embodiment of the present disclosure, such as Fig. 9 As shown, the key management device 900 includes:

[0228] The maintenance unit 901 is used to maintain the association table; the association table is used to maintain the association between the application identifier, the module identifier, the wireless key, and the quantum key.

[0229] The management unit 902 is used to manage the key based on the association relationship table.

[0230] In an exemplary embodiment, maintaining an association table includes: receiving a first message from a first terminal, the first message carrying an application identifier and a module identifier; and establishing an association between the application identifier and the module identifier in the association table based on the first message.

[0231] In an exemplary embodiment, maintaining an association table also includes: generating a first wireless key; receiving a second message from a first terminal, the second message carrying a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; verifying the consistency of the first wireless key and the second wireless key; when the first wireless key is consistent with the second wireless key, based on the second message, maintaining the association between the application identifier, the module identifier and the second wireless key in the association table.

[0232] In an exemplary embodiment, key management is performed based on an association table, including: receiving a third message from a first terminal, the third message is used to request a quantum key, the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; sending a first quantum key to the first terminal and the second terminal respectively; wherein the first quantum key is encrypted using a third wireless key respectively; receiving a fourth message from the first terminal and the second terminal respectively, the fourth message carries a verification result of the terminal on the first quantum key; and updating the association table based on the fourth message.

[0233] In an exemplary embodiment, before sending the first quantum key to the first terminal and the second terminal respectively, the method also includes: obtaining a third wireless key corresponding to the third message; and encrypting the second quantum key corresponding to the third message using the third wireless key to obtain the first quantum key.

[0234] In an exemplary embodiment, obtaining a third wireless key corresponding to a third message includes: verifying whether a second quantum key corresponding to the third message exists in a first quantum key pool; when the second quantum key exists in the first quantum key pool, querying a third wireless key corresponding to the third message based on the third message; when the second quantum key does not exist in the first quantum key pool, generating a third wireless key corresponding to the third message based on the third message.

[0235] In an exemplary embodiment, key management is performed based on an association table, and also includes: receiving a fifth message from the first terminal, the fifth message being used to request destruction of a target key; the target key is a wireless key and / or a quantum key; destroying the target key in a key pool to which the target key belongs, and updating the association table.

[0236] In an exemplary embodiment, key management is performed based on an association table, and also includes: obtaining a sixth message from the first terminal, the sixth message carrying a first application identifier, a first module identifier, and a fourth wireless key corresponding to the first module identifier of the first terminal; obtaining a fifth wireless key corresponding to the first application identifier in the association table; deleting a sixth wireless key from the wireless key pool, the sixth wireless key being a wireless key that is inconsistent with the fourth wireless key and the fifth wireless key; and updating the association table.

[0237] In an exemplary embodiment, the first module identifier is a module identifier of the first terminal after the module is replaced; the method further includes: receiving a seventh message from the first terminal, the seventh message carrying the first module identifier.

[0238] In an exemplary embodiment, obtaining the sixth message of the first terminal includes: sending an eighth message to the first terminal, where the eighth message is used to request a wireless key; and receiving the sixth message from the first terminal.

[0239] In an exemplary embodiment, the method further includes: sending a tenth message to the first terminal, the tenth message carrying a synchronization result of the wireless key by the gateway device.

[0240] The present disclosure also provides a key management device, which is applied to a first terminal. Fig.10 A structural block diagram of another key management device provided in an embodiment of the present disclosure, such as Fig.10 As shown, the key management device 1000 includes:

[0241] The sending unit 1001 sends an eleventh message to the gateway device, where the eleventh message is used to request the gateway device to maintain an association table. The eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key. The association table is used to maintain an association relationship among the application identifier, the module identifier, the wireless key, and the quantum key. The association table is maintained by the gateway device and key management is performed accordingly.

[0242] In an exemplary embodiment, the method further includes: sending a first message to the gateway device, the first message carrying an application identifier and a module identifier.

[0243] In an exemplary embodiment, the method also includes: sending a second message to the gateway device, the second message carrying a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; receiving a thirteenth message from the gateway device, the thirteenth message carrying a first wireless key generated by the gateway device; verifying the consistency of the second wireless key and the first wireless key; when the second wireless key is consistent with the first wireless key, updating the second wireless key pool.

[0244] In an exemplary embodiment, the method also includes: sending a third message to a gateway device, the third message is used to request a quantum key, the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; receiving a first quantum key sent from the gateway device; wherein the first quantum key is encrypted using a third wireless key; verifying the first quantum key; and when the first quantum key verification succeeds, updating the second quantum key pool.

[0245] In an exemplary embodiment, the method further includes: sending a fifth message to the gateway device, the fifth message being used to request destruction of a target key; the target key being a wireless key and / or a quantum key.

[0246] In an exemplary embodiment, the method further includes: sending a sixth message to the gateway device, the sixth message carrying the first application identifier of the first terminal, the first module identifier, and a fourth wireless key corresponding to the first module identifier.

[0247] In an exemplary embodiment, the first module identifier is a module identifier after the first terminal performs module replacement; the method further includes: sending a seventh message to the gateway device, the seventh message carrying the first module identifier.

[0248] In an exemplary embodiment, sending the sixth message to the gateway device includes: receiving an eighth message from the gateway device, where the eighth message is used to request a wireless key; and sending the sixth message to the gateway device.

[0249] In an exemplary embodiment, the method further includes: receiving a tenth message from the gateway device, the tenth message carrying a synchronization result of the wireless key by the gateway device; and updating the second wireless key pool.

[0250] Fig.11 A hardware block diagram of an electronic device provided in an embodiment of the present disclosure. The electronic device 1100 according to an embodiment of the present disclosure includes at least a processor; and a memory for storing computer-readable instructions. When the computer-readable instructions are loaded and executed by the processor, the processor executes the key management method described in any of the above embodiments of the present disclosure.

[0251] Fig.11The electronic device 1100 shown specifically includes: a central processing unit (CPU) 1101, a graphics processing unit (GPU) 1102 and a memory 1103. These units are interconnected via a bus 1104. The central processing unit (CPU) 1101 and / or the graphics processing unit (GPU) 1102 can be used as the above-mentioned processor, and the memory 1103 can be used as the above-mentioned memory storing computer-readable instructions. In addition, the electronic device 1100 may also include a communication unit 1105, a storage unit 1106, an output unit 1107, an input unit 1108 and an external device 1109, which are also connected to the bus 1104.

[0252] Fig.12 A schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure. Fig.12 As shown, a computer-readable storage medium 1200 according to an embodiment of the present disclosure has computer-readable instructions 1201 stored thereon. When the computer-readable instructions 1201 are executed by a processor, the key management method described with reference to the above figures according to any of the foregoing embodiments of the present disclosure is executed. The computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may, for example, include random access memory (RAM) and / or cache memory (cache), etc. Non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0253] The present disclosure further provides a computer program product, including a computer program, which, when executed by a processor, implements the key management method described in any of the foregoing embodiments of the present disclosure.

[0254] As described above, the present disclosure provides a key management method, system, device, electronic device, storage medium and product. The gateway device of the present disclosure maintains an association table and performs key management directly through the association table. Among them, the association table maintains the association between the application identifier, the module identifier, the wireless key and the quantum key. In summary, the technical solution gateway device provided by the present disclosure can achieve unified management of wireless keys and quantum keys by maintaining an association table. In layman's terms, because the association table stores the association between the application identifier, the module identifier, the wireless key and the quantum key. The gateway device can query the corresponding key information in the association table based on the application identifier and / or the module identifier. And because all the key information is stored in the association table instead of being scattered in different places, the gateway device only needs to query the association table to obtain all the required key information, without having to query different storage locations separately. Compared with the existing need to manage wireless keys and quantum keys separately, the interactive process of key management can be simplified. At the same time, when the quantum security module is replaced to a different terminal, the gateway device can achieve seamless migration of key management by simply updating the association table, reducing the error rate of processing, improving processing efficiency, and meeting the objective needs in the actual process.

[0255] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0256] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0257] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0258] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0259] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0260] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0261] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0262] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A key management method, characterized in that: Applied to a gateway device, the method comprises: Maintaining an association table; the association table is used to maintain the association between the application identifier, the module identifier, the wireless key, and the quantum key; Key management is performed based on the association table.

2. The method according to claim 1, characterized in that: The maintenance association relationship table includes: receiving a first message from a first terminal, where the first message carries the application identifier and the module identifier; Based on the first message, an association relationship between the application identifier and the module identifier is established in the association relationship table.

3. The method according to claim 1, characterized in that The maintenance association relationship table also includes: generating a first wireless key; receiving a second message from the first terminal, wherein the second message carries a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; Verifying the consistency of the first wireless key and the second wireless key; When the first wireless key is consistent with the second wireless key, based on the second message, the association relationship between the application identifier, the module identifier and the second wireless key is maintained in the association relationship table.

4. The method according to claim 1, characterized in that The managing of the key based on the association table includes: receiving a third message from the first terminal, where the third message is used to request a quantum key, and the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; Sending a first quantum key to the first terminal and the second terminal respectively; wherein the first quantum key is encrypted using a third wireless key; Receiving fourth messages from the first terminal and the second terminal respectively, where the fourth messages carry verification results of the first quantum key by the terminals; Based on the fourth message, the association table is updated.

5. The method according to claim 4, characterized in that Before sending the first quantum key to the first terminal and the second terminal respectively, the method further includes: Acquire a third wireless key corresponding to the third message; The second quantum key corresponding to the third message is encrypted using the third wireless key to obtain the first quantum key.

6. The method according to claim 5, characterized in that The obtaining of a third wireless key corresponding to the third message includes: Verifying whether there is a second quantum key corresponding to the third message in the first quantum key pool; When the second quantum key exists in the first quantum key pool, querying a third wireless key corresponding to the third message based on the third message; When the second quantum key does not exist in the first quantum key pool, a third wireless key corresponding to the third message is generated based on the third message.

7. The method according to any one of claims 1 or 4, characterized in that: The managing of the key based on the association table further includes: receiving a fifth message from the first terminal, wherein the fifth message is used to request destruction of a target key; the target key is a wireless key and / or a quantum key; The target key is destroyed in the key pool to which the target key belongs, and the association table is updated.

8. The method according to claim 1, characterized in that The managing of the key based on the association table further includes: Acquire a sixth message from the first terminal, where the sixth message carries a first application identifier, a first module identifier, and a fourth wireless key corresponding to the first module identifier of the first terminal; Acquire a fifth wireless key corresponding to the first application identifier in the association relationship table; Deleting a sixth wireless key from the wireless key pool, wherein the sixth wireless key is a wireless key that is inconsistent between the fourth wireless key and the fifth wireless key; The association relationship table is updated.

9. The method according to claim 8, characterized in that The first module identifier is a module identifier after the first terminal performs module replacement; the method further includes: A seventh message is received from the first terminal, where the seventh message carries the first module identifier.

10. The method according to claim 8, characterized in that The obtaining the sixth message of the first terminal includes: Sending an eighth message to the first terminal, where the eighth message is used to request a wireless key; A sixth message is received from the first terminal.

11. The method according to claim 8, characterized in that The method further comprises: A tenth message is sent to the first terminal, where the tenth message carries a synchronization result of the wireless key by the gateway device.

12. A key management method, characterized in that: Applied to a first terminal, the method includes: An eleventh message is sent to the gateway device, where the eleventh message is used to request the gateway device to maintain an association table, where the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship among the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

13. The method according to claim 12, characterized in that The method further comprises: A first message is sent to the gateway device, where the first message carries the application identifier and the module identifier.

14. The method according to claim 12, characterized in that The method further comprises: Sending a second message to the gateway device, wherein the second message carries a first identifier and a second wireless key; the first identifier is at least one of an application identifier and a module identifier; receiving a thirteenth message from the gateway device, wherein the thirteenth message carries a first wireless key generated by the gateway device; Verifying the consistency of the second wireless key and the first wireless key; When the second wireless key is consistent with the first wireless key, the second wireless key pool is updated.

15. The method according to claim 12, characterized in that The method further comprises: Sending a third message to the gateway device, where the third message is used to request a quantum key, and the third message carries a first application identifier of the first terminal and a second application identifier of the second terminal; Receiving a first quantum key sent from the gateway device; wherein the first quantum key is encrypted using a third wireless key; Verifying the first quantum key; When the first quantum key verification succeeds, the second quantum key pool is updated.

16. The method according to claim 12, characterized in that The method further comprises: A fifth message is sent to the gateway device, where the fifth message is used to request destruction of a target key; the target key is a wireless key and / or a quantum key.

17. The method according to claim 12, characterized in that The method further comprises: A sixth message is sent to the gateway device, where the sixth message carries the first application identifier, the first module identifier, and a fourth wireless key corresponding to the first module identifier of the first terminal.

18. The method according to claim 17, characterized in that The first module identifier is a module identifier after the first terminal performs module replacement; the method further includes: A seventh message is sent to the gateway device, where the seventh message carries the first module identifier.

19. The method according to claim 16, characterized in that The sending a sixth message to the gateway device includes: receiving an eighth message from the gateway device, wherein the eighth message is used to request a wireless key; The sixth message is sent to the gateway device.

20. The method according to claim 12, characterized in that The method further comprises: receiving a tenth message from the gateway device, the tenth message carrying a synchronization result of the wireless key by the gateway device; The second wireless key pool is updated.

21. A key management system, characterized in that: include: A gateway device, used to execute and maintain an association table; the association table is used to maintain an association relationship between an application identifier, a module identifier, a wireless key, and a quantum key; Based on the association table, managing the key; At least one terminal, in which a communication module and a security module are deployed, is used to execute sending an eleventh message to a gateway device, wherein the eleventh message is used to request the gateway device to maintain an association table, wherein the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship among the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

22. A key management device, characterized in that: Set in a gateway device, the device includes: A maintenance unit, used to maintain an association table; the association table is used to maintain the association between the application identifier, the module identifier, the wireless key, and the quantum key; A management unit is used to manage the key based on the association table.

23. A key management device, characterized in that: Set at the first terminal, the device includes: A sending unit sends an eleventh message to a gateway device, wherein the eleventh message is used to request the gateway device to maintain an association table, wherein the eleventh message carries at least one of an application identifier, a module identifier, a wireless key, and a quantum key, and the association table is used to maintain an association relationship among the application identifier, the module identifier, the wireless key, and the quantum key; the association table is maintained by the gateway device and key management is performed accordingly.

24. An electronic device, characterized in that: include: a memory for storing computer readable instructions; as well as A processor is used to run the computer-readable instructions so that the electronic device performs the method according to any one of claims 1 to 20.

25. A non-transitory computer-readable storage medium for storing computer-readable instructions, characterized in that: When the computer-readable instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 20.

26. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 20 when being executed by a processor.

Images