Data transmission method, system, and device based on quantum key storage medium

Abstract

An embodiment of the present invention provides a data transmission method, system, apparatus, device and storage medium based on a quantum key storage medium. The method includes, when a calling terminal establishes communication with a called terminal, obtaining an encrypted session key sent by a quantum key distribution network; querying a first charging key corresponding to a calling terminal identifier in a first charging key storage medium, the first charging key storage medium including charging keys corresponding to multiple terminal identifiers; decrypting the encrypted session key according to the first charging key to obtain a first session key; encrypting first audio and video data using the first session key to obtain encrypted first audio and video data, and transmitting the encrypted first audio and video data to the called terminal; receiving encrypted second audio and video data sent by the called terminal; and decrypting the encrypted second audio and video data using the first session key to obtain second audio and video data, thereby improving the security of communication.

Description

Technical Field

[0001] The present invention relates to the field of quantum secure communication technology, and in particular to a data transmission method, system, device, equipment and storage medium based on a quantum key storage medium. Background Art

[0002] With the continuous advancement and innovation of science and technology, the security mechanisms of traditional network audio and video applications are also gradually evolving to meet the growing security challenges and performance requirements. In existing technologies, the server is responsible for key negotiation, forwarding, and forwarding of encrypted audio and video data. The server decrypts the received encrypted audio and video data using the key it holds, and then encrypts it with the corresponding key before forwarding it to the corresponding client. Since the key is transmitted over the public network and the link is long, this increases the risk of the key being stolen during transmission. Summary of the Invention

[0003] In order to solve the above problems, the embodiments of the present invention disclose a data transmission method, system, device, equipment and storage medium based on a quantum key storage medium.

[0004] In a first aspect, an embodiment of the present invention provides a data transmission method based on a quantum key storage medium, applied to a calling terminal, wherein the calling terminal includes a first charged key storage medium; the method includes:

[0005] When the calling terminal establishes communication with the called terminal, obtaining an encrypted session key sent by the quantum key distribution network;

[0006] querying the first charging key storage medium for a corresponding first charging key according to the calling terminal identifier, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0007] decrypting the encrypted session key according to the first charging key to obtain a first session key;

[0008] Encrypting the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmitting the encrypted first audio and video data to the called terminal;

[0009] receiving the encrypted second audio and video data sent by the called terminal;

[0010] The encrypted second audio and video data is decrypted using the first session key to obtain the second audio and video data.

[0011] Optionally, before the step of establishing communication between the calling terminal and the called terminal, the method further includes:

[0012] Sending a call request to a server, wherein the call request is used to establish communication between the calling terminal and the called terminal;

[0013] Receiving a unique communication identifier sent by the server;

[0014] According to the communication unique identifier, join the target conversation room corresponding to the communication unique identifier, and establish communication with the called terminal when the called terminal joins the target conversation room.

[0015] Optionally, obtaining the encrypted session key sent by the quantum key distribution network includes:

[0016] Sending a first key acquisition request to the quantum key distribution network, where the first key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers;

[0017] Receive the encrypted session key sent by the quantum key distribution network.

[0018] Optionally, the first key storage medium includes one of a quantum security shield and a quantum SIM card.

[0019] In a second aspect, an embodiment of the present invention provides a data transmission method based on a quantum key storage medium, applied to a called terminal, wherein the called terminal includes a second prime key storage medium, the method comprising:

[0020] When the calling terminal establishes communication with the called terminal, receiving the encrypted first audio and video data sent by the calling terminal;

[0021] Obtain the encrypted session key sent by the quantum key distribution network;

[0022] querying a corresponding second charging key in the second charging key storage medium according to the called terminal identification, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifications;

[0023] decrypting the encrypted session key according to the second charging key to obtain a second session key;

[0024] Decrypting the encrypted first audio and video data using the second session key to obtain the first audio and video data;

[0025] The second audio and video data is encrypted using the second session key to obtain encrypted second audio and video data, and the encrypted second audio and video data is transmitted to the calling terminal.

[0026] Optionally, before the step of establishing communication between the calling terminal and the called terminal, the method further includes:

[0027] receiving a call request sent by the server, wherein the call request is used to establish communication between the calling terminal and the called terminal;

[0028] Sending a call response to the server, and receiving a communication unique identifier sent by the server when the server receives the call response;

[0029] According to the communication unique identifier, join the target conversation room corresponding to the communication unique identifier, and establish communication with the calling terminal when the calling terminal joins the target conversation room.

[0030] Optionally, obtaining the encrypted session key sent by the quantum key distribution network includes:

[0031] Sending a second key acquisition request to the quantum key distribution network, where the second key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers;

[0032] Receive the encrypted session key sent by the quantum key distribution network.

[0033] Optionally, the second key storage medium includes one of a quantum security shield and a quantum SIM card.

[0034] In a third aspect, the present invention provides a data transmission system based on a quantum key storage medium, the system comprising a calling terminal, a called terminal, and a quantum key distribution network; the calling terminal comprises a first primed key storage medium; the called terminal comprises a second primed key storage medium;

[0035] The calling terminal is configured to obtain the encrypted session key sent by the quantum key distribution network when the calling terminal establishes communication with the called terminal; query the first charging key corresponding to the calling terminal identifier in the first charging key storage medium, where the first charging key storage medium includes charging keys corresponding to multiple terminal identifiers; decrypt the encrypted session key according to the first charging key to obtain the first session key; encrypt first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal; receive encrypted second audio and video data sent by the called terminal; and decrypt the encrypted second audio and video data using the first session key to obtain second audio and video data;

[0036] The called terminal is used to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal; obtain the encrypted session key sent by the quantum key distribution network; query the corresponding second charging key in the second charging key storage medium according to the called terminal identifier, the second charging key storage medium including charging keys corresponding to multiple terminal identifiers; decrypt the encrypted session key according to the second charging key to obtain the second session key; decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data; encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

[0037] In a fourth aspect, the present invention discloses a data transmission device based on a quantum key storage medium, which is applied to a calling terminal, wherein the calling terminal includes a first filling key storage medium; the device includes:

[0038] A first acquisition module is configured to acquire an encrypted session key sent by a quantum key distribution network when the calling terminal establishes communication with the called terminal;

[0039] a first query module, configured to query the first charging key storage medium for a corresponding first charging key according to the calling terminal identifier, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0040] a first decryption module, configured to decrypt the encrypted session key according to the first charging key to obtain a first session key;

[0041] a first encryption module, configured to encrypt the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal;

[0042] A first receiving module, configured to receive the encrypted second audio and video data sent by the called terminal;

[0043] The second decryption module is configured to decrypt the encrypted second audio and video data using the first session key to obtain the second audio and video data.

[0044] Optionally, the device further comprises:

[0045] A first sending module, configured to send a call request to a server, wherein the call request is used to establish communication between the calling terminal and the called terminal;

[0046] A first identification receiving module, configured to receive a unique communication identification sent by the server;

[0047] The first session joining module is configured to join a target session room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the called terminal when the called terminal joins the target session room.

[0048] Optionally, the first acquisition module includes:

[0049] A first sending submodule is configured to send a first key acquisition request to the quantum key distribution network, where the first key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers;

[0050] The first receiving submodule is used to receive the encrypted session key sent by the quantum key distribution network.

[0051] Optionally, the first key storage medium includes one of a quantum security shield and a quantum SIM card.

[0052] In a fifth aspect, the present invention discloses a data transmission device based on a quantum key storage medium, which is applied to a called terminal, wherein the called terminal includes a second filled key storage medium; the device includes:

[0053] A second receiving module is configured to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal;

[0054] A second acquisition module is used to obtain the encrypted session key sent by the quantum key distribution network;

[0055] a second query module, configured to query the second charging key storage medium for a corresponding second charging key according to the called terminal identifier, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0056] a third decryption module, configured to decrypt the encrypted session key according to the second charging key to obtain a second session key;

[0057] a fourth decryption module, configured to decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data;

[0058] The second encryption module is configured to encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

[0059] Optionally, the device further comprises:

[0060] a third receiving module, configured to receive a call request sent by the server, wherein the call request is used to establish communication between the calling terminal and the called terminal;

[0061] a second sending module, configured to send a call response to the server, and receive a communication unique identifier sent by the server when the server receives the call response;

[0062] The second session joining module is configured to join a target session room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the calling terminal when the calling terminal joins the target session room.

[0063] Optionally, the second acquisition module includes:

[0064] A second sending submodule is configured to send a second key acquisition request to the quantum key distribution network, where the second key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers;

[0065] The second receiving submodule is used to receive the encrypted session key sent by the quantum key distribution network.

[0066] Optionally, the second key storage medium includes one of a quantum security shield and a quantum SIM card.

[0067] In a sixth aspect, the present invention shows an electronic device, comprising: a memory, a processor, and a computer program stored on the memory and runnable on the processor, wherein the processor implements the steps of the above-mentioned data transmission method based on quantum key storage medium when executing the computer program.

[0068] In a ninth aspect, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned data transmission method based on a quantum key storage medium.

[0069] The embodiments of the present invention include the following advantages:

[0070] An embodiment of the present invention discloses a data transmission method based on a quantum key storage medium. The present invention can obtain an encrypted session key sent by a quantum key distribution network when a calling terminal establishes communication with a called terminal, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end encryption and decryption of audio and video data through the first session key, thereby avoiding the possibility of the key being stolen in the network and thus improving the security of communication. In the present invention, the server does not participate in the negotiation and distribution of the session key, thereby avoiding the possibility of the session key being leaked, reducing the resource consumption of the intermediate server and potential security risks. The present invention obtains the charging key through the charging key storage medium. Due to the characteristics of the secure medium, the charging key used to decrypt the encrypted session key is unlikely to be leaked. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0072] Figure 1 This is a flowchart of a data transmission method based on a quantum key storage medium according to an embodiment of the present invention;

[0073] Figure 2 is a flowchart of another method for data transmission based on a quantum key storage medium according to an embodiment of the present invention;

[0074] Figure 3 1 is a flow chart of a data transmission method based on a quantum key storage medium according to an embodiment of the present invention;

[0075] Figure 4 This is a logical framework diagram of an audio and video data transmission method provided by an embodiment of the present invention;

[0076] Figure 5 This is a structural block diagram of a data transmission device based on a quantum key storage medium according to an embodiment of the present invention;

[0077] Figure 6 This is a structural block diagram of another data transmission device based on a quantum key storage medium according to an embodiment of the present invention. DETAILED DESCRIPTION

[0078] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0079] One of the core concepts of the embodiments of the present invention is that the present invention can obtain the encrypted session key sent by the quantum key distribution network when the calling terminal establishes communication with the called terminal, ensure the secure transmission of the session key through the quantum key distribution network, use the first injection key obtained by the calling terminal to decrypt the encrypted session key to obtain the first session key, and realize end-to-end audio and video data encryption and decryption through the first session key, avoiding the possibility of the key being stolen in the network, thereby improving the security of communication, and reducing the resource consumption of the intermediate server and potential security risks.

[0080] Reference Figure 1 , shows a flowchart of the steps of a data transmission method based on a quantum key storage medium according to an embodiment of the present invention, which is applied to a calling terminal, and the calling terminal includes a first charged key storage medium; the method includes:

[0081] Step 101: When the calling terminal establishes communication with the called terminal, the encrypted session key sent by the quantum key distribution network is obtained.

[0082] In an embodiment of the present invention, a QKD (Quantum Key Distribution) network is a network security communication system built on the principles of quantum physics. It allows two or more communicating parties to securely share keys, which can then be used in traditional encryption algorithms, such as AES (Advanced Encryption Standard), to encrypt and decrypt data. The core of the QKD network is to use the characteristics of quantum mechanics to ensure the security of key distribution. The quantum key distribution network can send an encrypted session key to the calling terminal. The encrypted session key is generated by a quantum random number generator.

[0083] In one embodiment of the present invention, before the steps of establishing communication between the calling terminal and the called terminal, it also includes: sending a call request to the server, the call request is used to establish communication between the calling terminal and the called terminal; receiving a communication unique identifier sent by the server; according to the communication unique identifier, joining the target session room corresponding to the communication unique identifier, and establishing communication with the called terminal when the called terminal joins the target session room.

[0084] In the embodiment of the present invention, the calling terminal first sends a call request to the server. The call request includes the calling terminal's intention to establish communication with the called terminal. The call request typically includes the identification information of the called terminal and other parameters that may be required, such as the session type (audio, video, or both) and bandwidth requirements.

[0085] After receiving a call request and forwarding it to the called terminal, the server generates a unique identifier for this communication when it receives a call response from the called terminal. This identifier is unique on the server and is used to distinguish different communication sessions. The server sends this unique identifier back to the calling terminal.

[0086] The calling terminal joins the corresponding target conversation room on the server according to the received unique communication identifier. This room is a virtual space for gathering all terminals participating in the communication, that is, pulling the calling terminal and the called terminal into the target conversation room.

[0087] After receiving the call notification, the called terminal will also join the same target conversation room according to the communication unique identifier. Once the called terminal joins the room, the server will know that both parties are ready to communicate.

[0088] After both the calling and called terminals join the target conversation room, the server assists them in establishing a direct communication connection. This may involve using the ICE (Interactive Connectivity Establishment) protocol to traverse NAT and firewalls, or using TURN (Traversal Using Relays around NAT) and STUN (Session Traversal Utilities for NAT) servers to help establish a P2P connection.

[0089] After the two communicating parties (the calling terminal and the called terminal) establish communication, the calling terminal will obtain the encrypted session key from the quantum key distribution network. This key will be used for subsequent audio and video data encryption and decryption to ensure the security of communication.

[0090] In one embodiment of the present invention, obtaining the encrypted session key sent by the quantum key distribution network includes: sending a first key acquisition request to the quantum key distribution network, the first key acquisition request including a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to multiple communication unique identifiers; and receiving the encrypted session key sent by the quantum key distribution network.

[0091] In an embodiment of the present invention, after joining the target session room, the calling terminal will send a first key acquisition request to the quantum key distribution network. The first key acquisition request may include a communication unique identifier previously received from the server. The communication unique identifier is used to locate the corresponding encrypted session key in the quantum key distribution network. The quantum key distribution network is a system specifically used for secure key distribution. It may be composed of multiple nodes, each node is responsible for managing the encrypted session keys corresponding to a part of the communication unique identifiers. When the quantum key distribution network receives the first key acquisition request, it will find the corresponding encrypted session key according to the communication unique identifier in the request. When the quantum key distribution network finds the corresponding encrypted session key, it will send the encrypted key back to the calling terminal. The encrypted key is generated using quantum key distribution technology, which enhances the security of communication.

[0092] Step 102: querying a first charging key corresponding to a calling terminal identifier in a first charging key storage medium, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0093] In an embodiment of the present invention, the calling terminal includes a first charging key storage medium, which can store charging keys corresponding to multiple terminal identifiers. After the calling terminal obtains the encrypted session key, it can query the corresponding first charging key in the first charging key storage medium according to the calling terminal identifier. This first charging key is pre-assigned to the calling terminal and is used to ensure that only authorized terminals can decrypt the session key. The first charging key is used to decrypt the encrypted session key.

[0094] In one embodiment of the present invention, the first key storage medium includes a quantum security shield or a quantum SIM card.

[0095] In an embodiment of the present invention, when the calling terminal is a mobile phone terminal or other device, the first key storage medium is a quantum SIM card; when the calling terminal is a computer or other terminal device, the first key storage medium is a quantum security shield.

[0096] Step 103: Decrypt the encrypted session key according to the first charging key to obtain the first session key.

[0097] In an embodiment of the present invention, since the encrypted session key is obtained by encrypting the quantum random number through the injection key in the quantum key distribution network, the original session key can be obtained by decrypting the first injection key in the first injection storage medium. That is, after obtaining the first injection key, the calling terminal can decrypt the encrypted session key through the first injection key to obtain the first session key, that is, the original session key; the calling terminal can securely obtain and use the session key to ensure the security of audio and video data during transmission.

[0098] Step 104: Encrypt the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal.

[0099] In an embodiment of the present invention, after decrypting and obtaining the first session key, the calling terminal can encrypt the first audio and video data using the first session key to obtain encrypted first audio and video data, and then transmit the first audio and video data to the called terminal, thereby ensuring the security of the first audio and video data during the transmission process.

[0100] Step 105: receiving the encrypted second audio and video data sent by the called terminal;

[0101] In the embodiment of the present invention, the calling terminal may receive the encrypted second audio and video data sent by the called terminal, where the encrypted second audio and video data is obtained by the called terminal by encrypting the second audio and video data.

[0102] Step 106: Decrypt the encrypted second audio and video data using the first session key to obtain the second audio and video data.

[0103] In an embodiment of the present invention, by using the first session key, the calling terminal can decrypt the encrypted second audio and video data into the original audio and video data. This decryption process is the inverse operation of the encryption process. It converts the data from the unreadable encrypted form back to the original format that can be played and displayed; the decrypted second audio and video data will then be processed by the audio and video processing software or hardware components of the calling terminal to display the video content on the screen of the calling terminal and play the audio content through the speaker; through this process, the calling terminal can securely receive, decrypt and process the encrypted audio and video data from the called terminal, ensuring the integrity and privacy protection of the communication content. The session key generated using the quantum key distribution network greatly enhances the security of the communication because it provides theoretically unconditional security and prevents the data from being eavesdropped or tampered with during transmission.

[0104] The present invention discloses a data transmission method based on a quantum key storage medium. The present invention can obtain an encrypted session key sent by a quantum key distribution network when a calling terminal establishes communication with a called terminal, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end audio and video data encryption and decryption through the first session key, thereby avoiding the possibility of the key being stolen in the network, thereby improving the security of communication and reducing the resource consumption of the intermediate server and potential security risks.

[0105] Reference Figure 2 , shows a flowchart of the steps of another data transmission method based on a quantum key storage medium according to an embodiment of the present invention, which is applied to a called terminal, and the called terminal includes a second key storage medium; the method includes:

[0106] Step 201: When a calling terminal establishes communication with a called terminal, the calling terminal receives encrypted first audio and video data sent by the calling terminal.

[0107] In the embodiment of the present invention, when the calling terminal and the called terminal establish communication, data can be transmitted between the calling terminal and the called terminal, and the called terminal can receive the encrypted first audio and video data sent by the calling terminal.

[0108] The encryption process of the first audio and video data has been described above and will not be repeated here.

[0109] In one embodiment of the present invention, before the steps of establishing communication between the calling terminal and the called terminal, it also includes: receiving a call request sent by the server, the call request is used to establish communication between the calling terminal and the called terminal; sending a call response to the server, and receiving a communication unique identifier sent by the server when the server receives the call response; according to the communication unique identifier, joining the target session room corresponding to the communication unique identifier, and establishing communication with the calling terminal when the calling terminal joins the target session room.

[0110] In the embodiment of the present invention, the called terminal first receives a call request forwarded by the server. The call request includes the calling terminal's intention to establish communication with the called terminal. The call request typically includes the identification information of the called terminal and other parameters that may be required, such as the session type (audio, video, or both) and bandwidth requirements.

[0111] After receiving the call request, the called terminal can send a call response to the server to indicate that the called terminal agrees to establish communication with the calling terminal. When the server receives the call response from the called terminal, it will generate a unique identifier for this communication, namely the communication unique identifier. This identifier is unique on the server and is used to distinguish different communication sessions. The server sends this communication unique identifier back to the calling terminal and the called terminal.

[0112] The calling terminal joins the corresponding target conversation room on the server according to the received unique communication identifier. This room is a virtual space for gathering all terminals participating in the communication, that is, pulling the calling terminal and the called terminal into the target conversation room.

[0113] After receiving the unique communication identifier, the called terminal will also join the same target conversation room according to the unique communication identifier. Once the called terminal joins the room, the server will know that both parties are ready to communicate.

[0114] After both the calling and called terminals join the target conversation room, the server assists them in establishing a direct communication connection. This may involve using the ICE (Interactive Connectivity Establishment) protocol to traverse NAT and firewalls, or using TURN (Traversal Using Relays around NAT) and STUN (Session Traversal Utilities for NAT) servers to help establish a P2P connection.

[0115] After the two communicating parties (the calling terminal and the called terminal) establish communication, the called terminal will obtain the encrypted session key from the quantum key distribution network. This key will be used for subsequent audio and video data encryption and decryption to ensure the security of communication.

[0116] Step 202: Obtain the encrypted session key sent by the quantum key distribution network.

[0117] In one embodiment of the present invention, obtaining an encrypted session key sent by a quantum key distribution network includes: sending a second key acquisition request to the quantum key distribution network, the second key acquisition request including a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to multiple communication unique identifiers; and receiving the encrypted session key sent by the quantum key distribution network.

[0118] In an embodiment of the present invention, after joining the target session room, the called terminal will send a second key acquisition request to the quantum key distribution network. The second key acquisition request may include a communication unique identifier previously received from the server. The communication unique identifier is used to locate the corresponding encrypted session key in the quantum key distribution network. The quantum key distribution network is a system specifically used for secure key distribution. It may be composed of multiple nodes, each node is responsible for managing the encrypted session keys corresponding to a part of the communication unique identifiers. When the quantum key distribution network receives the second key acquisition request, it will find the corresponding encrypted session key according to the communication unique identifier in the request. When the quantum key distribution network finds the corresponding encrypted session key, it will send the encrypted key back to the called terminal. The encrypted key is generated using quantum key distribution technology, which enhances the security of communication.

[0119] Step 203: query the second charging key storage medium for the corresponding second charging key according to the called terminal identifier, where the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers.

[0120] In an embodiment of the present invention, the called terminal includes a second charging key storage medium, which can store charging keys corresponding to multiple terminal identifiers. After the called terminal obtains the encrypted session key, it can query the corresponding second charging key in the second charging key storage medium according to the called terminal identifier. This second charging key is pre-assigned to the called terminal and is used to ensure that only authorized terminals can decrypt the session key. The second charging key is used to decrypt the encrypted session key.

[0121] In one embodiment of the present invention, the second key storage medium includes a quantum security shield or a quantum SIM card.

[0122] In an embodiment of the present invention, when the called terminal is a mobile phone terminal or other device, the second key storage medium is a quantum SIM card; when the called terminal is a computer or other terminal device, the second key storage medium is a quantum security shield.

[0123] Step 204: Decrypt the encrypted session key according to the second charging key to obtain a second session key.

[0124] In an embodiment of the present invention, the called terminal uses the second charging key to decrypt the encrypted session key to obtain a second session key. This decryption process is the inverse operation of the encryption process. It converts the encrypted session key into a session key that can be used for actual data encryption and decryption. Once the called terminal obtains the second session key, it can use this key to encrypt audio and video data sent to the calling terminal, or decrypt audio and video data received from the calling terminal.

[0125] Since the encrypted session key is obtained by encrypting the quantum random number through the injection key in the quantum key distribution network, the original session key can be obtained by decrypting the second injection key in the second injection storage medium. That is, after obtaining the second injection key, the called terminal can decrypt the encrypted session key through the second injection key to obtain the second session key, that is, the original session key; the called terminal can safely obtain and use the session key to ensure the security of audio and video data during transmission.

[0126] Step 205: Decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data.

[0127] In an embodiment of the present invention, after decrypting and obtaining the second session key, the called terminal can decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data, so as to display the video content on the screen of the called terminal and play the audio content through the speaker.

[0128] Step 206: Encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

[0129] In this embodiment of the present invention, the second audio and video data is the audio and video data that the called terminal intends to send to the calling terminal. This data may include an audio stream, a video stream, or a combination of the two. It is generated in real time and needs to be transmitted to the calling terminal via the network. The called terminal encrypts the second audio and video data using the second session key. The encryption process converts the original audio and video data into an unreadable format that can only be decrypted and restored by the recipient (i.e., the calling terminal) with the correct session key. After receiving the encrypted second audio and video data, the calling terminal uses the previously acquired first session key to decrypt the data, thereby restoring the original audio and video content.

[0130] Reference Figure 3, showing a flow chart of a data transmission method based on a quantum key storage medium provided by an embodiment of the present invention, the calling terminal is a mobile phone client, the called terminal is a computer client, the calling client sends a call request to the server, the server forwards the call request to the computer client, the computer client sends a call response to the server, and after receiving the call response, the server creates a target session room and forwards the communication unique identifier of the target session room to the mobile phone client and the computer client. The mobile phone client and the computer client join the target session room to establish a communication session, the mobile phone client sends a first key acquisition request to the quantum key distribution network, the quantum key distribution network returns the encrypted session key, the computer client sends a second key acquisition request to the quantum key distribution network, and the quantum key distribution network returns the encrypted session key.

[0131] The mobile phone client decrypts the encrypted session key from the first charging key in the quantum SIM card to obtain the first session key, uses the first session key to encrypt the audio and video data to obtain encrypted audio and video data, and transmits the encrypted audio and video data to the computer client through the network. The computer client decrypts the encrypted session key using the second charging key to obtain the second session key, and uses the second session key to decrypt the encrypted audio and video data to obtain the original audio and video data, thereby realizing the secure transmission of audio and video and reducing the resource consumption and potential security risks of the intermediate server.

[0132] Reference Figure 4 A logical framework diagram of audio and video data transmission provided by an embodiment of the present invention is shown. The architecture includes a mobile phone client with a built-in quantum SIM, a PC client equipped with a quantum security shield, a server, and a quantum key distribution network. The calling terminal can be a mobile phone or a PC, responsible for initiating a call, and the called terminal can be a mobile phone or a PC, responsible for responding to the call. The quantum SIM card and the quantum security shield store a charging key that can be used to decrypt the encrypted session key issued by the quantum key distribution network. The quantum key distribution network is responsible for distributing the encrypted session key based on the communication unique identifier SessionID. Both the calling terminal and the called terminal need to receive the SessionID issued by the server and obtain the encrypted session key through the quantum key distribution network. They then use the charging key stored in the quantum SIM card or the quantum security shield to decrypt the encrypted session key to obtain the real session key. Finally, the session key is used to encrypt and decrypt audio and video data. The server is responsible for negotiating the calls between the calling and called terminals and distributing the SessionID and encrypted audio and video data.

[0133] The present invention discloses a data transmission method based on a quantum key storage medium. The present invention can obtain an encrypted session key sent by a quantum key distribution network when a calling terminal establishes communication with a called terminal, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end audio and video data encryption and decryption through the first session key, thereby avoiding the possibility of the key being stolen in the network, thereby improving the security of communication and reducing the resource consumption of the intermediate server and potential security risks.

[0134] It should be noted that for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0135] The embodiment of the present invention also discloses a data transmission system based on a quantum key storage medium, the system comprising a calling terminal, a called terminal, and a quantum key distribution network; the calling terminal comprises a first charged key storage medium; the called terminal comprises a second charged key storage medium;

[0136] The calling terminal is used to obtain an encrypted session key sent by a quantum key distribution network when the calling terminal establishes communication with the called terminal; query a first charging key corresponding to the calling terminal identifier in a first charging key storage medium, the first charging key storage medium including charging keys corresponding to multiple terminal identifiers; decrypt the encrypted session key according to the first charging key to obtain a first session key; encrypt first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal; receive encrypted second audio and video data sent by the called terminal; and decrypt the encrypted second audio and video data using the first session key to obtain second audio and video data;

[0137] The called terminal is used to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal; obtain the encrypted session key sent by the quantum key distribution network; query the corresponding second charging key in the second charging key storage medium according to the called terminal identifier, the second charging key storage medium including charging keys corresponding to multiple terminal identifiers; decrypt the encrypted session key according to the second charging key to obtain the second session key; decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data; encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

[0138] In one embodiment of the present invention, the calling terminal is used to send a call request to a server, and the call request is used to establish communication between the calling terminal and the called terminal; receive a communication unique identifier sent by the server; join the target conversation room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the called terminal when the called terminal joins the target conversation room.

[0139] In one embodiment of the present invention, the called terminal is used to receive a call request sent by the server, and the call request is used to establish communication between the calling terminal and the called terminal; send a call response to the server, and receive a communication unique identifier sent by the server when the server receives the call response; join the target conversation room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the calling terminal when the calling terminal joins the target conversation room.

[0140] In one embodiment of the present invention, the calling terminal is used to send a first key acquisition request to the quantum key distribution network, where the first key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to multiple communication unique identifiers; and receives the encrypted session key sent by the quantum key distribution network.

[0141] In one embodiment of the present invention, the called terminal is used to send a second key acquisition request to the quantum key distribution network, where the second key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to multiple communication unique identifiers; and receives the encrypted session key sent by the quantum key distribution network.

[0142] In one embodiment of the present invention, the server is used to receive a call request sent by a calling terminal, forward the call request to the called terminal, receive a call response sent by the called terminal, create a target conversation room based on the call response, and pull the calling terminal and the called terminal into the target conversation room.

[0143] The present invention discloses a data transmission system. When a calling terminal establishes communication with a called terminal, the present invention can obtain an encrypted session key sent by a quantum key distribution network, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end audio and video data encryption and decryption through the first session key, thereby avoiding the possibility of the key being stolen in the network, thereby improving the security of communication and reducing the resource consumption of the intermediate server and potential security risks.

[0144] Reference Figure 5 , shows a structural block diagram of a data transmission device based on a quantum key storage medium provided by an embodiment of the present invention, which is applied to a calling terminal. The calling terminal includes a first filling key storage medium; the device includes:

[0145] A first acquisition module 301 is configured to acquire an encrypted session key sent by a quantum key distribution network when a calling terminal establishes communication with a called terminal;

[0146] A first query module 302 is configured to query a first charging key corresponding to a calling terminal identifier in a first charging key storage medium, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0147] A first decryption module 303, configured to decrypt the encrypted session key according to the first charging key to obtain a first session key;

[0148] The first encryption module 304 is configured to encrypt the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal;

[0149] The first receiving module 305 is used to receive the encrypted second audio and video data sent by the called terminal;

[0150] The second decryption module 306 is configured to decrypt the encrypted second audio and video data using the first session key to obtain the second audio and video data.

[0151] In one embodiment of the present invention, the device further includes:

[0152] A first sending module is used to send a call request to the server, where the call request is used to establish communication between the calling terminal and the called terminal;

[0153] A first identification receiving module, configured to receive a unique communication identification sent by a server;

[0154] The first session joining module is configured to join a target session room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the called terminal when the called terminal joins the target session room.

[0155] In one embodiment of the present invention, the first acquisition module includes:

[0156] A first sending submodule is configured to send a first key acquisition request to a quantum key distribution network, where the first key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers;

[0157] The first receiving submodule is used to receive the encrypted session key sent by the quantum key distribution network.

[0158] In one embodiment of the present invention, the first key storage medium includes a quantum security shield or a quantum SIM card.

[0159] The present invention discloses a data transmission device based on a quantum key storage medium. The present invention can obtain an encrypted session key sent by a quantum key distribution network when a calling terminal establishes communication with a called terminal, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end audio and video data encryption and decryption through the first session key, thereby avoiding the possibility of the key being stolen in the network, thereby improving the security of communication and reducing the resource consumption of the intermediate server and potential security risks.

[0160] Reference Figure 6 , shows a structural block diagram of another data transmission device based on a quantum key storage medium provided by an embodiment of the present invention, which is applied to a called terminal. The called terminal includes a second key storage medium. The device includes:

[0161] The second receiving module 401 is used to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal;

[0162] A second acquisition module 402 is used to obtain the encrypted session key sent by the quantum key distribution network;

[0163] A second query module 403 is configured to query a second charging key corresponding to a called terminal identifier in a second charging key storage medium, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers;

[0164] A third decryption module 404 is configured to decrypt the encrypted session key according to the second charging key to obtain a second session key;

[0165] A fourth decryption module 405 is configured to decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data;

[0166] The second encryption module 406 is configured to encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

[0167] In one embodiment of the present invention, the device further includes:

[0168] A third receiving module is used to receive a call request sent by the server, where the call request is used to establish communication between the calling terminal and the called terminal;

[0169] A second sending module is used to send a call response to the server and receive a communication unique identifier sent by the server when the server receives the call response;

[0170] The second session joining module is configured to join a target session room corresponding to the communication unique identifier according to the communication unique identifier, and establish communication with the calling terminal when the calling terminal joins the target session room.

[0171] In one embodiment of the present invention, the second acquisition module includes:

[0172] A second sending submodule is configured to send a second key acquisition request to the quantum key distribution network, where the second key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to multiple communication unique identifiers;

[0173] The second receiving submodule is used to receive the encrypted session key sent by the quantum key distribution network.

[0174] In one embodiment of the present invention, the second key storage medium includes a quantum security shield or a quantum SIM card.

[0175] The present invention discloses a data transmission device based on a quantum key storage medium. The present invention can obtain an encrypted session key sent by a quantum key distribution network when a calling terminal establishes a communication session with a called terminal, ensure the secure transmission of the session key through the quantum key distribution network, decrypt the encrypted session key using a first charging key obtained by the calling terminal to obtain a first session key, and implement end-to-end audio and video data encryption and decryption through the first session key, thereby avoiding the possibility of the key being stolen in the network, thereby improving the security of communication and reducing the resource consumption of the intermediate server and potential security risks.

[0176] As for the system and device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0177] An embodiment of the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the above-mentioned method for data transmission based on a quantum key storage medium are implemented.

[0178] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data transmission method based on the quantum key storage medium are implemented.

[0179] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0180] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, embodiments of the present invention may take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware. Furthermore, embodiments of the present invention may take the form of a computer program product implemented on one or more machine-readable media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0181] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0182] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0184] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic creative concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0185] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0186] The above is a detailed introduction to the data transmission method, system, device, equipment and storage medium based on a quantum key storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the method and core concept of the present invention. At the same time, for those skilled in the art, according to the concept of the present invention, there may be changes in the specific implementation methods and application scope. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A data transmission method based on a quantum key storage medium, characterized in that: Applied to a calling terminal, the calling terminal includes a first charging key storage medium; the method includes: When the calling terminal establishes communication with the called terminal, obtaining an encrypted session key sent by the quantum key distribution network; querying the first charging key storage medium for a corresponding first charging key according to the calling terminal identifier, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers; decrypting the encrypted session key according to the first charging key to obtain a first session key; Encrypting the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmitting the encrypted first audio and video data to the called terminal; receiving the encrypted second audio and video data sent by the called terminal; The encrypted second audio and video data is decrypted using the first session key to obtain the second audio and video data.

2. The method according to claim 1, characterized in that Before the step of establishing communication between the calling terminal and the called terminal, the method further includes: Sending a call request to a server, wherein the call request is used to establish communication between the calling terminal and the called terminal; Receiving a unique communication identifier sent by the server; According to the communication unique identifier, join the target conversation room corresponding to the communication unique identifier, and establish communication with the called terminal when the called terminal joins the target conversation room.

3. The method according to claim 2, characterized in that The obtaining of the encrypted session key sent by the quantum key distribution network includes: Sending a first key acquisition request to the quantum key distribution network, where the first key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers; Receive the encrypted session key sent by the quantum key distribution network.

4. The method according to claim 1, wherein The first key storage medium includes one of a quantum security shield and a quantum SIM card.

5. A data transmission method based on a quantum key storage medium, characterized in that: Applied to a called terminal, the called terminal including a second charging key storage medium, the method comprising: When the calling terminal establishes communication with the called terminal, receiving the encrypted first audio and video data sent by the calling terminal; Obtain the encrypted session key sent by the quantum key distribution network; querying a corresponding second charging key in the second charging key storage medium according to the called terminal identification, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifications; decrypting the encrypted session key according to the second charging key to obtain a second session key; Decrypting the encrypted first audio and video data using the second session key to obtain the first audio and video data; The second audio and video data is encrypted using the second session key to obtain encrypted second audio and video data, and the encrypted second audio and video data is transmitted to the calling terminal.

6. The method according to claim 5, characterized in that Before the step of establishing communication between the calling terminal and the called terminal, the method further includes: receiving a call request sent by a server, wherein the call request is used to establish communication between the calling terminal and the called terminal; Sending a call response to the server, and receiving a communication unique identifier sent by the server when the server receives the call response; According to the communication unique identifier, join the target conversation room corresponding to the communication unique identifier, and establish communication with the calling terminal when the calling terminal joins the target conversation room.

7. The method according to claim 6, characterized in that The obtaining of the encrypted session key sent by the quantum key distribution network includes: Sending a second key acquisition request to the quantum key distribution network, where the second key acquisition request includes a communication unique identifier; the quantum key distribution network includes encrypted session keys corresponding to a plurality of communication unique identifiers; Receive the encrypted session key sent by the quantum key distribution network.

8. The method according to claim 5, characterized in that The second key storage medium includes one of a quantum security shield and a quantum SIM card.

9. A data transmission system based on a quantum key storage medium, characterized in that: The system includes a calling terminal, a called terminal, and a quantum key distribution network; the calling terminal includes a first key storage medium; the called terminal includes a second key storage medium; The calling terminal is configured to obtain an encrypted session key sent by the quantum key distribution network when establishing communication with the called terminal; query a first charging key corresponding to the calling terminal identifier in the first charging key storage medium, the first charging key storage medium including charging keys corresponding to a plurality of terminal identifiers; and decrypt the encrypted session key according to the first charging key to obtain a first session key; Encrypting the first audio and video data using the first session key to obtain encrypted first audio and video data, transmitting the encrypted first audio and video data to the called terminal; and receiving the encrypted second audio and video data sent by the called terminal; Decrypting the encrypted second audio and video data using the first session key to obtain the second audio and video data; The called terminal is configured to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal; Obtaining an encrypted session key sent by the quantum key distribution network; querying a corresponding second charging key in the second charging key storage medium according to the called terminal identification, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifications; decrypting the encrypted session key according to the second charging key to obtain a second session key; Decrypting the encrypted first audio and video data using the second session key to obtain the first audio and video data; The second audio and video data is encrypted using the second session key to obtain encrypted second audio and video data, and the encrypted second audio and video data is transmitted to the calling terminal.

10. A data transmission device based on a quantum key storage medium, characterized in that: Applied to a calling terminal, the calling terminal includes a first charging key storage medium; the device includes: A first acquisition module is configured to acquire an encrypted session key sent by a quantum key distribution network when the calling terminal establishes communication with the called terminal; a first query module, configured to query the first charging key storage medium for a corresponding first charging key according to the calling terminal identifier, wherein the first charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers; a first decryption module, configured to decrypt the encrypted session key according to the first charging key to obtain a first session key; a first encryption module, configured to encrypt the first audio and video data using the first session key to obtain encrypted first audio and video data, and transmit the encrypted first audio and video data to the called terminal; A first receiving module, configured to receive the encrypted second audio and video data sent by the called terminal; The second decryption module is configured to decrypt the encrypted second audio and video data using the first session key to obtain the second audio and video data.

11. A data transmission device based on a quantum key storage medium, characterized in that: Applied to a called terminal, the called terminal includes a second charging key storage medium; the device includes: A second receiving module is used to receive the encrypted first audio and video data sent by the calling terminal when the calling terminal establishes communication with the called terminal; A second acquisition module is used to obtain the encrypted session key sent by the quantum key distribution network; a second query module, configured to query the second charging key storage medium for a corresponding second charging key according to the called terminal identifier, wherein the second charging key storage medium includes charging keys corresponding to a plurality of terminal identifiers; a third decryption module, configured to decrypt the encrypted session key according to the second charging key to obtain a second session key; a fourth decryption module, configured to decrypt the encrypted first audio and video data using the second session key to obtain the first audio and video data; The second encryption module is configured to encrypt the second audio and video data using the second session key to obtain encrypted second audio and video data, and transmit the encrypted second audio and video data to the calling terminal.

12. An electronic device, characterized in that: The device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the data transmission method based on the quantum key storage medium according to any one of claims 1 to 4 or 5 to 8.

13. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, which, when executed by a processor, implement the data transmission method based on a quantum key storage medium as described in any one of claims 1 to 4 or 5 to 8.

Images