Connection method for SDP gateway

Abstract

The invention provides a connection method for an SDP gateway. At an SDP client side, the method comprises the following steps: calling an SIM card of local mobile equipment to obtain a target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters. And generating a quantum key ciphertext based on the target quantum key. Initiating a connection request carrying the quantum key ciphertext to an SDP gateway; wherein the connection request is used for requesting the SDP gateway to perform authorization authentication on the quantum key ciphertext, so that the SDP gateway establishes connection with the SDP client after the authorization authentication is passed. According to the invention, the connection security of the SDP client for the SDP gateway can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a connection method for an SDP gateway. Background Art

[0002] With the development of network technology, the boundaries of network security have become increasingly blurred, and internal and external threats have become increasingly serious. Traditional perimeter security architectures are struggling to cope with these new challenges, so the zero-trust security architecture of software-defined perimeter (SDP) technology has emerged. In this architecture, authentication based on authentication keys has become a key security measure.

[0003] In the current SDP zero-trust security architecture, before the SDP client establishes a connection with the SDP gateway, it needs to interact with the control center in the SDP gateway through a public authentication key. During this process, the SDP client will obtain a private authentication key from the control center of the SDP gateway. After that, the SDP client will use this private authentication key for authorization authentication, and finally establish a secure connection with the SDP gateway. The use of such a mechanism design can improve the security of network communications, enabling the SDP zero-trust security architecture to better cope with the current complex and ever-changing network security threats.

[0004] In current SDP applications, the control center in the SDP gateway uses the relevant device identifier to randomly generate authentication keys through soft implementation, and uses the end-side storage method to store the authentication keys in the database, configuration file or registry of the SDP client. Strictly speaking, the authentication keys generated by the soft implementation are pseudo-random and may be cracked. In addition, the security of the end-side storage method depends on the status of the system environment. As the usage scenarios diversify, the problems of the system environment become prominent, which can easily lead to the leakage of authentication keys.

[0005] The above factors will affect the connection security of the SDP client to the SDP gateway. Summary of the invention

[0006] The purpose of this application is to provide a connection method for an SDP gateway, which can improve the connection security of an SDP client to an SDP gateway.

[0007] In order to achieve the above purpose, the embodiment of the present application is implemented as follows: In a first aspect, a connection method for an SDP gateway is provided, which is applied to an SDP client, including: Calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters; Generate a quantum key ciphertext based on the target quantum key; A connection request carrying the quantum key ciphertext is initiated to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

[0008] In a second aspect, a connection method for an SDP gateway is provided, which is applied to the SDP gateway, including: Receiving a connection request sent by an SDP client and carrying a quantum key ciphertext; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters; Sending an authorization and authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to perform authorization and authentication on the quantum key ciphertext based on the target quantum key; Receive the authorization and authentication result fed back by the quantum security service platform, and if the authorization and authentication result indicates that the authorization and authentication is passed, establish a connection with the SDP client.

[0009] In a third aspect, a connection method for an SDP gateway is provided, which is applied to a quantum security service platform, including: Receiving an authorization and authentication request carrying a quantum key ciphertext sent by an SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters; Authorizing and authenticating the quantum key ciphertext based on the target quantum key; Feedback the authorization and authentication result to the SDP gateway; wherein the authorization and authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

[0010] In the embodiment of the present application, the SDP client prepares to apply to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as an authentication key to call the SIM card for storage. When the SDP client subsequently needs to connect to the SDP gateway, it generates a quantum key ciphertext based on the target quantum key, and then initiates a connection request carrying the quantum key ciphertext to the SDP gateway; correspondingly, after receiving the connection request, the SDP gateway sends an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform, so that the quantum security service platform can authorize and authenticate the quantum key ciphertext based on the created target quantum key, and feed back the authorization authentication result to the SDP gateway, so that the SDP gateway decides whether to establish a connection with the SDP client based on the authorization authentication result. Compared with the traditional connection scheme for the SDP gateway, the target quantum key of the embodiment of the present application, as a true random key, has a higher cracking difficulty than a pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0012] Figure 1 This is a flow chart of the SDP gateway connection method according to an embodiment of the present application applied to the SDP client side.

[0013] Figure 2 This is a flow chart of the connection method for the SDP gateway according to an embodiment of the present application applied to the SDP gateway side.

[0014] Figure 3 This is a flow chart of the connection method for the SDP gateway according to an embodiment of the present application applied to the quantum security service platform side.

[0015] Figure 4 This is a schematic diagram of the architecture of the connection method for the SDP gateway according to an embodiment of the present application.

[0016] Figure 5 This is a flow chart of the connection method for the SDP gateway in a specific application scenario according to an embodiment of the present application.

[0017] Figure 6 This is a schematic diagram of the structure of the SDP client of an embodiment of the present application.

[0018] Figure 7 This is a schematic diagram of the structure of the SDP gateway of an embodiment of the present application.

[0019] Figure 8 This is a schematic diagram of the structure of the quantum security service platform of an embodiment of the present application.

[0020] Fig. 9 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] As mentioned above, the control center in the prior art SDP gateway uses relevant device identification to randomly generate authentication keys through soft implementation, and uses end-side storage to store the authentication keys in the client's database, configuration file or registry. Strictly speaking, the authentication keys generated by the soft implementation are pseudo-random and may be cracked. In addition, the security of the end-side storage method depends on the status of the system environment. As the usage scenarios diversify, problems with the system environment become more prominent, which can easily lead to the leakage of authentication keys. The above factors will affect the connection security of the SDP client to the SDP gateway.

[0022] In view of this, the present application aims to propose a connection solution for the SDP gateway, which can improve the connection security of the SDP client to the SDP gateway.

[0023] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0024] Figure 1 This is a flow chart of the connection method for the SDP gateway in an embodiment of the present application applied to the SDP client side, including the following steps: S102, calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated based on true random parameters.

[0025] In this embodiment, the SDP client can apply to the trusted quantum security service platform to obtain the scalar quantum key. That is, the quantum key is generated by the quantum security service platform based on true random parameters and is a true random key, which is more difficult to crack than a pseudo-random key.

[0026] In one implementation, the SDP client requests the quantum security service platform to distribute quantum keys to obtain the coding information fed back by the quantum security service platform; wherein the coding information is obtained by the quantum security service platform encoding true random parameters based on multiple intensities of light; the multiple intensities of light include signal state light and weak decoy state light; the signal state light corresponds to the same basis vector (basis vector refers to the vector in the quantum field); the weak decoy state light corresponds to the first basis vector or the second basis vector selected with different probabilities. Next, the SDP client selects to measure the coding information under the first basis vector or the second basis vector with different probabilities to obtain the original code. Afterwards, the SDP client selects the target quantum key from the original code according to the basis vector and light intensity selected by the quantum security service platform, as well as the first basis vector or the second basis vector selected and measured locally.

[0027] For ease of understanding, the SDP client is defined as Alice and the quantum security service platform is defined as Bob. The specific distribution details of the above stream key distribution are as follows: 1. There is a quantum channel (such as optical fiber) and a classical channel between two people, Alice (a mobile device as the receiver) and Bob (a quantum security service platform as the sender).

[0028] 2. Alice generates a string of 01 numbers randomly and encodes them in different intensities with a certain probability. Specifically, they are the three intensities of light: signal state, weak decoy state and vacuum state.

[0029] 3. Asymmetric basis vector selection: ①For the signal state, Alice encodes all states on a basis vector, such as the Z basis vector.

[0030] ② For the weak decoy state, Alice encodes it on the X basis with a certain probability and on the Z basis with a certain probability. Generally speaking, these two probabilities are not the same.

[0031] ③For the vacuum state, Alice does not need to perform encoding.

[0032] Furthermore, Alice sends these coded states to Bob, and Bob chooses to use the X basis vector for measurement with a certain probability and the Z basis vector for measurement with a certain probability.

[0033] 4. Alice and Bob perform post-processing to obtain the final target quantum key from the original quantum key. Specifically, the following steps are included: ① Alice and Bob publish their own basis vectors for encoding and measurement. Alice also publishes the intensity of the light she chooses for encoding, and screens and post-processes the original code. Only when they choose the same basis for encoding and measurement, Alice and Bob get the screened key from the original code.

[0034] ② Alice and Bob use error correction steps to ensure that their keys are exactly the same. They estimate the maximum amount of information that the other party can obtain. They then use the confidentiality amplification method to obtain the final security key.

[0035] In this embodiment, Alice and Bob asymmetrically select the basis vectors for preparation and measurement, thereby achieving the purpose of simplifying the system and improving the coding rate. In addition, selecting the light of the decoy state of the asymmetric basis vector for encoding can improve the coding rate while ensuring security.

[0036] After obtaining the target quantum key, a quantum key management application can be created. The quantum key management application is configured with an application protocol data unit (APDU) protocol for interacting with the SIM card. In this embodiment, the SDP client calls the SIM card of the mobile device to store the target quantum key through the quantum key management application.

[0037] Correspondingly, the APDU protocol is configured with a first command for instructing the SIM card to provide a target quantum key; when the target quantum key needs to be used (connected to the SDP gateway), the first command can be issued to the SIM card of the mobile device based on the quantum key management application to call the SIM card to provide the locally stored target quantum key.

[0038] S104, generating a quantum key ciphertext based on the target quantum key.

[0039] In this embodiment, the SDP client applies to the quantum security service platform for a temporary session key and an identifier corresponding to the temporary session key (such as the ID of the temporary session key); thereafter, the SDP client encrypts the target quantum key based on the temporary session key to obtain a quantum key ciphertext; wherein the connection request also carries the identifier of the temporary session key, and the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext through the quantum security service platform based on the temporary session key corresponding to the identifier.

[0040] Still taking the APDU protocol calling the SIM card as an example, in the relevant application, the APDU protocol of this embodiment is also configured with a second command for instructing the SIM card to encrypt the target quantum key; correspondingly, this step can issue a second command to the SIM card of the mobile device based on the quantum key management application to call the SIM card to encrypt the target quantum key based on the temporary session key to obtain the quantum key ciphertext.

[0041] S106, initiate a connection request carrying the quantum key ciphertext to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

[0042] The SDP gateway authorization and authentication process can be referred to Figure 2 shown.

[0043] Figure 2 1 is a flow chart of the connection method for the SDP gateway in an embodiment of the present application applied to the SDP gateway terminal side, including the following steps: S202, receiving a connection request carrying a quantum key ciphertext sent by an SDP client; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated based on a true random parameter.

[0044] S204, sending an authorization and authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to authorize and authenticate the quantum key ciphertext based on the target quantum key.

[0045] Based on the foregoing, the quantum key ciphertext of this embodiment is obtained by the SDP client encrypting the target quantum key based on the temporary session key; the temporary session key is obtained by the SDP client applying for the quantum security service platform; the connection request also carries the identifier of the temporary session key. Correspondingly, the SDP gateway sends an authorization and authentication request carrying the quantum key ciphertext and the identifier to the quantum security service platform; the authorization and authentication request is used to request the quantum security service platform to decrypt the quantum key ciphertext based on the temporary session key matching the identifier, and then authorize and authenticate the decryption result based on the target quantum key.

[0046] S206, receiving the authorization authentication result fed back by the quantum security service platform. If the authorization authentication result indicates that the authorization authentication is successful, establishing a connection with the SDP client.

[0047] The authorization and authentication process of the quantum security service platform can be referred to Figure 3 shown.

[0048] Figure 3 This is a flow chart of the connection method for the SDP gateway in an embodiment of the present application applied to the quantum security service platform side, including the following steps: S302, receiving an authorization and authentication request carrying a quantum key ciphertext sent by an SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters.

[0049] In one implementation, the quantum security service platform receives a quantum key distribution request sent by the SDP client, and encodes the true random parameters based on multiple intensities of light to obtain coded information; wherein the multiple intensities of light include signal state light and weak decoy state light; the signal state light encodes the true random parameters corresponding to the same basis vector; the weak decoy state light encodes the true random parameters corresponding to the first basis vector or the second basis vector selected based on different probabilities. Afterwards, the quantum security service platform feeds back the coded information to the SDP client, and the coded information is used by the SDP client to screen the target quantum key.

[0050] S304: Authorize and authenticate the quantum key ciphertext based on the target quantum key.

[0051] Based on the foregoing, it can be known that the quantum key ciphertext of this embodiment is obtained by the SDP client encrypting the target quantum key based on the temporary session key; the temporary session key is obtained by the SDP client applying to the quantum security service platform; the authorization authentication request also carries an identifier of the temporary session key.

[0052] Correspondingly, in this step, the quantum security service platform determines the matching temporary session key based on the identifier in the authorization and authentication request; next, the quantum security service platform decrypts the quantum key ciphertext based on the temporary session key to obtain the decryption result; thereafter, the quantum security service platform performs authorization and authentication on the decryption result based on the target quantum key. If the target quantum key is consistent with the decryption result, the authorization and authentication result indicates a pass; if the target quantum key is consistent with the decryption result, the authorization and authentication result indicates a fail.

[0053] S306, feeding back the authorization and authentication result to the SDP gateway; wherein the authorization and authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

[0054] In summary, based on the method of this embodiment, the SDP client prepares to apply to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as an authentication key to call the SIM card for storage. When the SDP client needs to connect to the SDP gateway later, it generates a quantum key ciphertext based on the target quantum key, and then initiates a connection request carrying the quantum key ciphertext to the SDP gateway; correspondingly, after receiving the connection request, the SDP gateway sends an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform, so that the quantum security service platform can authorize and authenticate the quantum key ciphertext based on the created target quantum key, and feed back the authorization authentication result to the SDP gateway, so that the SDP gateway decides whether to establish a connection with the SDP client based on the authorization authentication result. Compared with the traditional connection scheme for the SDP gateway, the target quantum key of the method of this embodiment is a true random key, which has a higher cracking difficulty than a pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen.

[0055] The application scenario of the method of this embodiment is introduced below.

[0056] 1. Overall architecture of application scenarios refer to Figure 4 As shown, the overall architecture of this application scenario includes: quantum security service platform, SDP client, SDP gateway, and business system.

[0057] Quantum Security Service Platform: The quantum security service platform injects quantum keys into quantum key management applications through the quantum key distribution protocol.

[0058] SDP client: The SDP client is used to connect the quantum key management application and the quantum security service platform, and is the data "transfer station" between the quantum key management application and the quantum security service platform.

[0059] SDP Gateway: As a business logic processing module, the SDP gateway implements functions such as business data forwarding, seed verification and authentication, and traffic release.

[0060] Business system: The system that users need to access or interact with after passing the seed knocking authentication.

[0061] 2. Implementation process of application scenarios Step 1: The SDP client connects to the quantum security service platform. The quantum security service platform generates a quantum key and sends it to the SDP client through the quantum key distribution mechanism. The SDP client calls the SIM card to store the quantum key.

[0062] Specifically, after the SDP client obtains the quantum key from the quantum security service platform, it uses a custom APDU command to send a seed storage command to the SIM card. After receiving the command sent by the SDP client, the SIM card analyzes and obtains the card application (quantum key management application) to be called, the encryption method for cryptographic operations on the quantum key, the key index, etc. The quantum key management application first calls the cryptographic operation capability of the SIM card to encrypt the quantum key, and then the quantum key management application creates a file to store the quantum key data and assigns the user's read permission to the file.

[0063] Step 2: The SDP client reads the quantum key in the SIM card and performs a knock authentication to the SDP gateway.

[0064] refer to Figure 5 As shown, the process of this step is as follows: S1: The user triggers authorization authentication on the SDP client. The SDP client customizes the APDU command to send a command to read the quantum key to the SIM card, and at the same time applies for a temporary session key and temporary session key ID from the quantum security service platform.

[0065] After the user triggers authorization authentication on the SDP client, the SDP client sends a quantum key reading command to the SIM card according to the APDU protocol and the custom SIM card application interface.

[0066] To ensure convenient data usage, the data format of the quantum key can be customized, including LZMY-DATA and LZMY_PACK.

[0067] The LZMY-DATA data format is shown in Table 1:

[0068] Table 1 The LZMY_PACK data format is shown in Table 2:

[0069] Table 2 In addition, the SDP client defines a unique reporting command data format according to the ISO7816-4 specification, and reports relevant identity information to the SIM through the APDU protocol. The data format of the reporting command is shown in Table 3:

[0070] Table 3 S2: When reading the quantum key, the SDP client asynchronously applies for a temporary session key and temporary session key ID (identifier) ​​from the quantum security service platform.

[0071] The temporary session key is used to encrypt the quantum key to form a quantum key ciphertext for transmission in the network. The temporary session key ID is required for door knock authentication.

[0072] S3: The SDP client uses the temporary session key to encrypt the quantum key to form a quantum key ciphertext. The SDP client sends the quantum key ciphertext and the temporary session key ID to the SDP gateway for knocking authentication of the connection request.

[0073] During the communication process, in order to ensure the secure transmission of quantum keys, the SDP client can use the temporarily generated session key to encrypt the quantum key to generate quantum key ciphertext, and then send the quantum key ciphertext together with the temporary session key ID to the SDP gateway. This step not only protects the quantum key from potential security threats, but also enhances the reliability and security of communication between the SDP client and the SDP gateway by sending the temporary session key ID for knock authentication.

[0074] S4: After receiving the quantum key ciphertext and temporary key ID, the SDP gateway sends the quantum key ciphertext and temporary key ID to the quantum security service platform for verification through an authorization authentication request.

[0075] In this application scenario, when the SDP gateway receives the quantum key ciphertext and temporary key ID sent by the SDP client, in order to ensure the security and reliability of communication, it will forward the received quantum key ciphertext and temporary key ID to the quantum security service platform, which will use its own powerful computing resources for verification. Through this verification mechanism, the SDP architecture can provide a higher level of data protection and effectively prevent potential security threats and malicious attacks.

[0076] S5: The quantum security service platform feeds back the authorization and authentication results to the SDP gateway. The SDP gateway analyzes and processes the authorization and authentication results and notifies the SDP client whether to accept the connection.

[0077] Whether the authentication succeeds or fails, the notification sent by the SDP gateway to the SDP client contains the authentication result and any relevant details (such as the reason for the failure). If the SDP gateway accepts the connection request from the SDP client, refer to Figure 4 As shown, the SDP gateway then establishes a connection channel for the SDP gateway to securely access the business system.

[0078] Corresponds to Figure 1 The method shown, another embodiment of the present application provides an SDP client. Figure 6 6 is a schematic diagram of the structure of the SDP client 600, including: The key storage module 610 calls the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters.

[0079] In this embodiment, the SDP client can apply to the trusted quantum security service platform to obtain the scalar quantum key. That is, the quantum key is generated by the sub-security service platform based on true random parameters, and is a true random key, which is more difficult to crack than the traditional pseudo-random key.

[0080] The ciphertext generation module 620 generates a quantum key ciphertext based on the target quantum key.

[0081] The connection request module 630 initiates a connection request carrying the quantum key ciphertext to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

[0082] Optionally, the ciphertext generation module 620 generates a quantum key ciphertext based on the target quantum key, including: applying for a temporary session key from the quantum security service platform, the temporary session key corresponding to an identifier; encrypting the target quantum key based on the temporary session key to obtain a quantum key ciphertext; wherein the connection request also carries an identifier of the temporary session key, and the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext through the quantum security service platform based on the temporary session key corresponding to the identifier.

[0083] Optionally, before calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card, the key storage module 610 is further used to: create a quantum key management application on the local mobile device, the quantum key management application is configured with an application protocol data unit APDU protocol for interacting with the SIM card, and the APDU protocol is configured with a first command for instructing the SIM card to provide the target quantum key. Correspondingly, the key storage module 610 calls the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card, including: issuing a first command to the SIM card of the mobile device based on the quantum key management application to call the SIM card to provide the locally stored target quantum key.

[0084] Optionally, the APDU protocol is also configured with a second command for instructing the SIM card to encrypt the target quantum key; the ciphertext generation module 620 encrypts the target quantum key based on the temporary session key to obtain a quantum key ciphertext, including: issuing a second command to the SIM card of the mobile device based on the quantum key management application to call the SIM card to encrypt the target quantum key based on the temporary session key to obtain a quantum key ciphertext.

[0085] Optionally, before calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card, the key storage module 610 is further used to: send a quantum key distribution request to the quantum security service platform to obtain the coding information fed back by the quantum security service platform; wherein the coding information is obtained by encoding true random parameters based on multiple intensities of light; the multiple intensities of light include signal state light and weak decoy state light; the quantum security service platform selects to encode the true random parameters under the same basis vector for the signal state light; the quantum security service platform selects to encode the true random parameters under the first basis vector or the second basis vector with different probabilities for the weak decoy state light; the coding information is measured under the first basis vector or the second basis vector with different probabilities to obtain the original code; and the target quantum key is screened out from the original code according to the basis vector corresponding to the coding information and the intensity of light, and the first basis vector or the second basis vector selected to be measured locally.

[0086] It should be noted that the SDP client of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions in the method shown are not repeated here.

[0087] Corresponds to Figure 2 The method shown, another embodiment of the present application provides an SDP gateway. Figure 7 : is a schematic diagram of the structure of the SDP gateway 700, including: The connection receiving module 710 receives a connection request carrying a quantum key ciphertext sent by the SDP client; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters.

[0088] The authentication request module 720 sends an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization authentication request is used to request the quantum security service platform to perform authorization authentication on the quantum key ciphertext based on the target quantum key.

[0089] The authentication receiving module 730 receives the authorization authentication result fed back by the quantum security service platform, and if the authorization authentication result indicates that the authorization authentication is passed, establishes a connection with the SDP client.

[0090] Optionally, the quantum key ciphertext is obtained by the SDP client encrypting the target quantum key based on a temporary session key; the temporary session key is obtained by the SDP client applying for the quantum security service platform; the connection request also carries an identifier of the temporary session key; the authentication request module 720 sends an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform, including: sending an authorization authentication request carrying the quantum key ciphertext and the identifier to the quantum security service platform; wherein the authorization authentication request is used to request the quantum security service platform to decrypt the quantum key ciphertext based on a temporary session key matching the identifier, and then authorize and authenticate the decryption result based on the target quantum key.

[0091] It should be noted that the SDP gateway of this embodiment can be used as Figure 2 The execution subject of the method shown can thus realize Figure 2 The steps and functions in the method shown are not repeated here.

[0092] Corresponds to Figure 3 The method shown, another embodiment of the present application provides a quantum security service platform. Figure 8 It is a schematic diagram of the structure of the quantum security service platform 800, including: The authorization receiving module 810 receives an authorization authentication request carrying a quantum key ciphertext sent by the SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on the target quantum key, and the target quantum key is generated by the quantum security service platform based on true random parameters.

[0093] The authorization execution module 820 performs authorization authentication on the quantum key ciphertext based on the target quantum key.

[0094] The authorization feedback module 830 feeds back the authorization authentication result to the SDP gateway; wherein the authorization authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

[0095] Optionally, the quantum key ciphertext is obtained by the SDP client encrypting the target quantum key based on a temporary session key; the temporary session key is obtained by the SDP client applying for the quantum security service platform; the authorization authentication request also carries an identifier of the temporary session key; the authorization execution module 820 performs authorization authentication on the quantum key ciphertext based on the target quantum key, including: determining the matching temporary session key based on the identifier in the authorization authentication request; decrypting the quantum key ciphertext based on the temporary session key to obtain a decryption result; performing authorization authentication on the decryption result based on the target quantum key; wherein, if the target quantum key is consistent with the decryption result, the authorization authentication result indicates a pass; if the target quantum key is consistent with the decryption result, the authorization authentication result indicates a fail.

[0096] Optionally, before receiving the authorization authentication request sent by the SDP gateway, the authorization receiving module 810 is also used to: receive a quantum key distribution request sent by the SDP client; encode true random parameters based on multiple intensities of light to obtain coding information; wherein the multiple intensities of light include signal state light and weak decoy state light; the signal state light encodes the true random parameters corresponding to the same basis vector; the weak decoy state light encodes the true random parameters corresponding to the first basis vector or the second basis vector selected based on different probabilities; and feed back the coding information to the SDP client; wherein the coding information is used by the SDP client to screen out the target quantum key.

[0097] It should be noted that the quantum security service platform of this embodiment can be used as Figure 3 The execution subject of the method shown can thus realize Figure 3 The steps and functions in the method shown are not repeated here.

[0098] Fig. 9 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Fig. 9 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0099] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0100] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0101] Among them, the processor reads the corresponding computer program from the non-volatile memory into the internal memory and then runs it, forming the above-mentioned image transmission device at the logical level.

[0102] In one implementation, the processor executes a program stored in the memory and is specifically configured to perform the following operations: The SIM card of the local mobile device is called to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters.

[0103] A quantum key ciphertext is generated based on the target quantum key.

[0104] A connection request carrying the quantum key ciphertext is initiated to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

[0105] In one implementation, the processor executes a program stored in the memory and is specifically configured to perform the following operations: Receive a connection request carrying a quantum key ciphertext sent by an SDP client; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters.

[0106] Sending an authorization and authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to authorize and authenticate the quantum key ciphertext based on the target quantum key.

[0107] Receive the authorization and authentication result fed back by the quantum security service platform, and if the authorization and authentication result indicates that the authorization and authentication is passed, establish a connection with the SDP client.

[0108] In one implementation, the processor executes a program stored in the memory and is specifically configured to perform the following operations: Receiving an authorization and authentication request carrying a quantum key ciphertext sent by an SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters; The quantum key ciphertext is authorized and authenticated based on the target quantum key.

[0109] Feedback the authorization and authentication result to the SDP gateway; wherein the authorization and authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

[0110] Based on the electronic device of this embodiment, the SDP client prepares to apply to the quantum security service platform for the target quantum key generated based on the true random parameters, and uses the target quantum key as the authentication key to call the SIM card for storage. When the SDP client needs to connect to the SDP gateway later, it generates a quantum key ciphertext based on the target quantum key, and then initiates a connection request carrying the quantum key ciphertext to the SDP gateway; correspondingly, after receiving the connection request, the SDP gateway sends an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform, so that the quantum security service platform can authorize and authenticate the quantum key ciphertext based on the created target quantum key, and feed back the authorization authentication result to the SDP gateway, so that the SDP gateway decides whether to establish a connection with the SDP client based on the authorization authentication result. Compared with the traditional connection scheme for the SDP gateway, the target quantum key of this embodiment, as a true random key, has a higher cracking difficulty than the pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen.

[0111] The above application Figures 1 to 3The method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in one or more embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in combination with one or more embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0112] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0113] An embodiment of the present application further provides a computer program product, which includes a computer-readable storage medium storing a computer program.

[0114] In one implementation, the computer program is operable to cause a computer to perform the following operations: The SIM card of the local mobile device is called to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters.

[0115] A quantum key ciphertext is generated based on the target quantum key.

[0116] A connection request carrying the quantum key ciphertext is initiated to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

[0117] In one implementation, the computer program is operable to cause a computer to perform the following operations: Receive a connection request carrying a quantum key ciphertext sent by an SDP client; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters.

[0118] Sending an authorization and authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to authorize and authenticate the quantum key ciphertext based on the target quantum key.

[0119] Receive the authorization and authentication result fed back by the quantum security service platform, and if the authorization and authentication result indicates that the authorization and authentication is passed, establish a connection with the SDP client.

[0120] In one implementation, the computer program is operable to cause a computer to perform the following operations: Receive an authorization and authentication request carrying a quantum key ciphertext sent by an SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters.

[0121] The quantum key ciphertext is authorized and authenticated based on the target quantum key.

[0122] Feedback the authorization and authentication result to the SDP gateway; wherein the authorization and authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

[0123] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of the present application shall be included in the protection scope of one or more embodiments of the present application.

[0124] The systems, devices, and modules described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0125] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0126] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0127] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A connection method for an SDP gateway, applied to an SDP client, characterized in that: include: Calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card; wherein the target quantum key is generated by the quantum security service platform based on true random parameters; Generate a quantum key ciphertext based on the target quantum key; A connection request carrying the quantum key ciphertext is initiated to the SDP gateway; wherein the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext, so that the SDP gateway establishes a connection with the SDP client after the authorization and authentication are passed.

2. The method according to claim 1, characterized in that Generating a quantum key ciphertext based on the target quantum key includes: Apply for a temporary session key from the quantum security service platform, and the temporary session key corresponds to an identifier; Encrypting the target quantum key based on the temporary session key to obtain a quantum key ciphertext; Among them, the connection request also carries an identifier of the temporary session key, and the connection request is used to request the SDP gateway to authorize and authenticate the quantum key ciphertext through the quantum security service platform based on the temporary session key corresponding to the identifier.

3. The method according to claim 2, characterized in that Before calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card, the method further includes: Creating a quantum key management application on a local mobile device, wherein the quantum key management application is configured with an application protocol data unit APDU protocol for interacting with a SIM card, and the APDU protocol is configured with a first command for instructing the SIM card to provide a target quantum key; Calling a SIM card of a local mobile device to obtain a target quantum key stored in the SIM card includes: Based on the quantum key management application, a first command is issued to the SIM card of the mobile device to call the SIM card to provide a locally stored target quantum key.

4. The method according to claim 3, characterized in that The APDU protocol is also configured with a second command for instructing the SIM card to encrypt the target quantum key; Encrypting the target quantum key based on the temporary session key to obtain a quantum key ciphertext includes: Based on the quantum key management application, a second command is issued to the SIM card of the mobile device to call the SIM card to encrypt the target quantum key based on the temporary session key to obtain a quantum key ciphertext.

5. The method according to claim 1, characterized in that Before calling the SIM card of the local mobile device to obtain the target quantum key stored in the SIM card, the method further includes: Send a quantum key distribution request to the quantum security service platform to obtain the coded information fed back by the quantum security service platform; wherein the coded information is obtained by encoding the true random parameters based on light of multiple intensities; the light of multiple intensities includes light in a signal state and light in a weak decoy state; the light in the signal state corresponds to the same basis vector; the light in the weak decoy state corresponds to the first basis vector or the second basis vector selected with different probabilities; Selecting to measure the coded information under the first basis vector or the second basis vector with different probabilities respectively to obtain an original code; According to the basis vector corresponding to the encoded information and the intensity of light, as well as the first basis vector or the second basis vector selected and measured locally, a target quantum key is screened out from the original code.

6. A connection method for an SDP gateway, applied to an SDP gateway, characterized in that: include: Receiving a connection request sent by an SDP client and carrying a quantum key ciphertext; wherein the quantum key ciphertext is generated based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters; Sending an authorization and authentication request carrying the quantum key ciphertext to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to perform authorization and authentication on the quantum key ciphertext based on the target quantum key; Receive the authorization and authentication result fed back by the quantum security service platform, and if the authorization and authentication result indicates that the authorization and authentication is passed, establish a connection with the SDP client.

7. The method according to claim 6, characterized in that The quantum key ciphertext is obtained by the SDP client encrypting the target quantum key based on the temporary session key; the temporary session key is obtained by the SDP client applying for the quantum security service platform; the connection request also carries an identifier of the temporary session key; Sending an authorization authentication request carrying the quantum key ciphertext to the quantum security service platform includes: Sending an authorization and authentication request carrying the quantum key ciphertext and the identifier to the quantum security service platform; wherein the authorization and authentication request is used to request the quantum security service platform to decrypt the quantum key ciphertext based on a temporary session key matching the identifier, and then authorize and authenticate the decryption result based on the target quantum key.

8. A connection method for an SDP gateway, applied to a quantum security service platform, characterized in that: include: Receiving an authorization and authentication request carrying a quantum key ciphertext sent by an SDP gateway; wherein the quantum key ciphertext is generated by the SDP client based on a target quantum key, and the target quantum key is generated by a quantum security service platform based on true random parameters; Authorizing and authenticating the quantum key ciphertext based on the target quantum key; Feedback the authorization and authentication result to the SDP gateway; wherein the authorization and authentication result is used to indicate whether the SDP network has established a connection with the SDP client.

9. The method according to claim 8, characterized in that The quantum key ciphertext is obtained by the SDP client encrypting the target quantum key based on the temporary session key; the temporary session key is obtained by the SDP client applying for the quantum security service platform; The authorization and authentication request also carries an identifier of the temporary session key; Authorizing and authenticating the quantum key ciphertext based on the target quantum key, including: Determining the matching temporary session key based on the identifier in the authorization authentication request; Decrypting the quantum key ciphertext based on the temporary session key to obtain a decryption result; The decryption result is authorized and authenticated based on the target quantum key; if the target quantum key is consistent with the decryption result, the authorization and authentication result indicates a pass; if the target quantum key is consistent with the decryption result, the authorization and authentication result indicates a fail.

10. The method according to claim 8, characterized in that Before receiving the authorization and authentication request sent by the SDP gateway, the method further includes: Receive the quantum key distribution request sent by the SDP client; The true random parameters are encoded based on light of multiple intensities to obtain encoded information; wherein the light of multiple intensities includes light in a signal state and light in a weak decoy state; the light in the signal state corresponds to the same basis vector; the light in the weak decoy state corresponds to a first basis vector or a second basis vector selected with different probabilities; The encoding information is fed back to the SDP client; wherein the encoding information is used by the SDP client to filter out the target quantum key.

Images