Key charging method, related equipment, medium and product

Abstract

The invention discloses a key charging method, related equipment, a medium and a product. The method comprises the following steps: receiving a first message sent by a charging platform; the first message comprises a to-be-charged terminal list and the number of to-be-charged secret keys of each terminal in the terminal list; sending a second message and / or a third message to the charging platform; the second message indicates the first terminal entering the updating process; the third message indicates the second terminal entering the key charging process.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a key injection method, related equipment, medium and product. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase. The use of quantum keys (QK) can improve the security of business systems. Quantum security keys are based on the principles of quantum mechanics and use the non-cloning and non-measurable characteristics of quantum states to achieve real-time encrypted communication and improve communication efficiency.

[0003] In the related technology, quantum keys are encapsulated by the encapsulation key of the quantum key service platform and sent in batches to the filling platform for filling. However, the repeatedly used encapsulation key makes it difficult to ensure the security of the quantum key filling process. Summary of the invention

[0004] The embodiments of the present application provide a key injection method, related equipment, medium and product.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] A key charging method is applied to a cryptographic service platform, the method comprising:

[0007] Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0008] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering into an update process; the third message indicates a second terminal entering into a key injection process.

[0009] In the above solution, before sending the second message and / or the third message to the filling platform, the method includes:

[0010] Determine the first terminal that meets a first condition and / or the second terminal that does not meet the first condition in the terminal list; the first condition indicates that the first key parameter is not included or the first key parameter is to be updated.

[0011] In the above solution, after determining the first terminal in the terminal list that meets the first condition, the method includes:

[0012] A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

[0013] In the above solution, after sending the second message to the filling platform, the method further comprises:

[0014] Receive a sixth message sent by the charging platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

[0015] In the above solution, after receiving the sixth message sent by the charging platform, the method further comprises:

[0016] verifying the third key parameter;

[0017] When the third key parameter is verified to be legal, the first key parameter is saved.

[0018] In the above solution, after saving the first key parameter, the method further includes:

[0019] generating a first charging key for the first terminal;

[0020] encrypting the first charging key based on the first key parameter to obtain an encrypted first charging key;

[0021] generating a fourth key parameter based on the first key parameter;

[0022] A seventh message is sent to the filling platform; the seventh message includes the encrypted first filling key and the fourth key parameter.

[0023] In the above solution, after determining the second terminal in the terminal list that does not meet the first condition, the method includes:

[0024] generating a second charging key for the second terminal;

[0025] encrypting the second charging key based on the first key parameter to obtain an encrypted second charging key;

[0026] A fourth key parameter is generated based on the first key parameter; and the third message includes the encrypted second filling key and the fourth key parameter.

[0027] In the above scheme, the method further includes:

[0028] The first charging state of the first charging key and / or the second charging state of the second charging key are set.

[0029] A key injection method is applied to a key injection platform, the method comprising:

[0030] Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0031] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an update process; the third message indicates a second terminal entering a key injection process.

[0032] In the above solution, after receiving the second message sent by the cryptographic service platform, the method further comprises:

[0033] A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

[0034] In the above solution, after sending the fourth message to the first terminal, the method further includes:

[0035] receiving a fifth message sent by the first terminal; the fifth message includes the encrypted first key parameter, the second key parameter and the third key parameter;

[0036] Sending a sixth message to the cryptographic service platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0037] In the above solution, after sending the sixth message to the cryptographic service platform, the method further includes:

[0038] Receiving a seventh message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key and fourth key parameters;

[0039] An eighth message is sent to the first terminal; the eighth message includes the encrypted first injection key and the fourth key parameter.

[0040] In the above solution, after receiving the third message sent by the cryptographic service platform, the method further comprises:

[0041] A ninth message is sent to the second terminal; the ninth message includes the encrypted second charging key and the fourth key parameter.

[0042] A key charging method is applied to a terminal, and the method comprises:

[0043] Receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

[0044] In the above solution, after receiving the fourth message sent by the filling platform, the method further comprises:

[0045] Generate a first key parameter and save the first key parameter;

[0046] Encrypting the first key parameter to obtain an encrypted first key parameter;

[0047] generating a third key parameter based on the first key parameter;

[0048] A fifth message is sent to the filling platform; the fifth message includes the encrypted first key parameter, the second key parameter and the third key parameter.

[0049] In the above solution, after sending the fifth message to the filling platform, the method further comprises:

[0050] Receiving an eighth message sent by the charging platform; the eighth message includes the encrypted first charging key and fourth key parameters;

[0051] verifying the fourth key parameter;

[0052] If the fourth key parameter is verified to be legal, decrypting the encrypted first charging key based on the first key parameter to obtain the first charging key;

[0053] The first charging key is charged.

[0054] In the above scheme, after receiving the ninth message sent by the filling platform, the method further comprises:

[0055] verifying the fourth key parameter;

[0056] In the case where the fourth key parameter is verified to be legal, decrypting the encrypted second charging key based on the first key parameter to obtain the second charging key;

[0057] The second charging key is charged.

[0058] A key charging device, applied to a cryptographic service platform, comprising:

[0059] Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0060] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering into an update process; the third message indicates a second terminal entering into a key injection process.

[0061] A key charging device, applied to a charging platform, comprising:

[0062] Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0063] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an update process; the third message indicates a second terminal entering a key injection process.

[0064] A key charging device, applied to a terminal, comprising:

[0065] Receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

[0066] A cryptographic service platform includes a first communication interface and a first processor; wherein:

[0067] The first communication interface is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0068] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering into an update process; the third message indicates a second terminal entering into a key injection process.

[0069] A filling platform includes a second communication interface and a second processor; wherein:

[0070] The second communication interface is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0071] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an update process; the third message indicates a second terminal entering a key injection process.

[0072] A terminal comprises a third communication interface and a third processor; wherein:

[0073] The third communication interface is used to receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

[0074] A storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, it implements the steps of any method on the cryptographic service platform side, or implements the steps of any method on the charging platform side, or implements the steps of any method on the terminal side.

[0075] A computer product, including a computer program, characterized in that when the computer program is executed by a processor, it implements the steps of any method on the cryptographic service platform side, or implements the steps of any method on the charging platform side, or implements the steps of any method on the terminal side.

[0076] The present invention provides a key filling method, related equipment, medium and product; receiving a first message sent by a filling platform; the first message includes a list of terminals to be filled and the number of keys to be filled for each terminal in the terminal list; sending a second message and / or a third message to the filling platform; the second message indicates the first terminal entering the update process; the third message indicates the second terminal entering the key filling process. That is to say, the present application receives a first message sent by a filling platform through a cryptographic service platform, the first message includes a list of terminals to be filled and the number of keys to be filled for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the filling platform, the second message indicates the first terminal entering the update process; the third message indicates the second terminal entering the key filling process; so as to enable the cryptographic service platform to initiate the terminal update process and / or filling process according to security requirements, and solves the problem in the related art that the encapsulated key of the cryptographic service platform is repeatedly used, and it is difficult to ensure the security of the quantum key filling process. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 A flowchart of a key injection method provided in an embodiment of the present application;

[0078] Figure 2 A key relationship diagram provided for an embodiment of the present application;

[0079] Figure 3 A schematic diagram of a key injection preparation process provided in an embodiment of the present application;

[0080] Figure 4 A schematic diagram of a key injection process provided in an embodiment of the present application;

[0081] Figure 5 A flowchart of another key injection method provided in an embodiment of the present application;

[0082] Figure 6 A schematic diagram of a flow chart of a third key injection method provided in an embodiment of the present application;

[0083] Figure 7 A schematic diagram of the structure of a key charging device provided in an embodiment of the present application;

[0084] Figure 8 A schematic diagram of the structure of another key injection device provided in an embodiment of the present application;

[0085] Fig. 9 A schematic diagram of the structure of a third key injection device provided in an embodiment of the present application;

[0086] Fig.10 A schematic diagram of the structure of the cryptographic service platform provided in the embodiment of the present application;

[0087] Fig.11 A schematic diagram of the structure of the filling platform provided in the embodiment of the present application;

[0088] Fig.12 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0089] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0090] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0091] The terms "first / second / third" involved in the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first / second / third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0092] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0093] In the related art, the quantum key on the user equipment (UE) is usually charged offline to the security area of ​​the UE at one time to construct a quantum key resource pool, and the service application obtains and uses the quantum key from the resource pool. The security area can be the Subscriber Identity Module (SIM) card, Universal Subscriber Identity Module (USIM) card, Super SIM card, Secure Digital (SD) card, etc. on the terminal.

[0094] In order to ensure the security of quantum keys, quantum keys are generally managed in layers. Taking the UE's security area as the USIM card as an example, the quantum key service platform is mainly responsible for connecting with the quantum random number generator and the quantum key distribution (Quantum Key Distribution, QKD) node to generate, manage and distribute quantum keys; the charging platform receives charging tasks from the quantum key service platform in a single or batch manner, and charges the quantum key into the quantum key service card application of the USIM card to complete the charging of the quantum key; the card dealer (USIM card manufacturer) is mainly responsible for making blank cards and writing card applications and personalized data.

[0095] The embodiment of the present application provides a key injection method, which is applied to a cryptographic service platform. Figure 1 As shown, the method comprises the following steps:

[0096] Step S101: Receive the first message sent by the filling platform.

[0097] The first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list.

[0098] It can be understood that the cryptographic service platform can be understood as a quantum key service platform. The terminal may include a UE, and may also include a quantum secure terminal (Quantum Secure Equipment, QSE), that is, a secure terminal device that can provide quantum security services for upper-layer business applications based on quantum keys; this application does not limit this. The embodiment of the present application is described by taking a UE as an example, and the UE includes a USIM card.

[0099] The quantum key can be managed by the quantum key service card application on the USIM card. The quantum key service card application is responsible for receiving instructions and data from the charging platform, storing the quantum key in the secure storage area of ​​the USIM card, and completing the charging of the quantum key. Before the charging platform receives the quantum key charging task, the charging platform can send the quantum key service card application to the card dealer through a secure channel. After the card is written, the card dealer will synchronize the security element identifier (SEID) list of the USIM card to the charging platform and the quantum key service platform through a secure channel.

[0100] refer to Figure 2As shown, the quantum key service platform can generate KEK to protect QK, and can also generate the initial key encapsulation key KEK_i and the public-private key pair (SKp, PKp); (SKp, PKp) is used to protect the confidentiality of KEK, and KEK_i is used to protect the legitimacy of KEK. The card dealer has its own unique public-private key pair (SKm, PKm) to protect KEK_i; the quantum key service platform can obtain the card dealer's public key PKm from a secure channel.

[0101] In practical applications, reference Figure 3 As shown, before the quantum key service platform sends KEK_i to the card dealer, it can encrypt KEK_i through an encryption algorithm to obtain EKEK_i, EKEK_i = Epub (PKm, KEK_i). The quantum key service platform sends EKEK_i to the card dealer through a secure channel, and the card dealer can decrypt EKEK_i through a decryption algorithm to obtain KEK_i; KEK_i = Dpub (SKm, EKEK_i). The quantum key service platform can also send PKp to the card dealer.

[0102] After receiving the quantum key injection task, the injection platform can prepare a QK requirement list {SEID, QKN}_i according to the task requirements, where i=1,…,n; QKN is the number of injection keys corresponding to each SEID. The injection platform sends an injection key acquisition request to the quantum key service platform, and the request contains {SEID, QKN}_i. The first message can be understood as an injection key acquisition request, where {SEID, QKN}_i includes the identifier of each terminal to be injected and the number of keys to be injected corresponding to the terminal.

[0103] Step S102: Sending a second message and / or a third message to the filling platform.

[0104] The second message indicates the first terminal entering the update process; the third message indicates the second terminal entering the key injection process.

[0105] Understandable, reference Figure 3 As shown, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i.

[0106] In actual applications, for USIM cards that do not have KEK or need to update KEK, the update process is run, and the first terminal can be understood as the terminal corresponding to the USIM card that does not have KEK or needs to update KEK. The quantum key service platform generates a key parameter R_KEK, which can be a random number or a timestamp. After generating R_KEK, the quantum key service platform sends a KEK update request to the charging platform. The second message can be understood as a KEK update request, and the second message includes the SEID and R_KEK corresponding to the first terminal.

[0107] For the USIM card with available KEK, the key injection process is run. The second terminal can be understood as the terminal corresponding to the USIM card with available KEK. After the quantum key service platform generates a quantum key for the second terminal, it can encrypt the quantum key based on the KEK and then send a key acquisition response to the injection platform. The third message can be understood as a key acquisition response. The third message includes the SEID corresponding to the second terminal and the encrypted quantum key.

[0108] It can be seen from the above content that in the embodiment of the present application, the cryptographic service platform receives a first message sent by a charging platform, the first message including a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the charging platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process; so as to enable the cryptographic service platform to initiate the terminal update process and / or charging process according to security requirements, thereby solving the problem in the related art that the encapsulation key of the cryptographic service platform is repeatedly used, making it difficult to ensure the security of the quantum key charging process.

[0109] In some embodiments of the present application, before sending the second message and / or the third message to the filling platform, the process includes:

[0110] A first terminal that meets a first condition and / or a second terminal that does not meet the first condition in the terminal list is determined; the first condition indicates that the first key parameter is not included or the first key parameter is to be updated.

[0111] It can be understood that the first key parameter can be understood as KEK. The first condition can be understood as no KEK or the KEK needs to be updated.

[0112] In practical applications, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i. The first terminal can be understood as the terminal corresponding to the USIM card that has no KEK or needs to update the KEK. The second terminal can be understood as the terminal corresponding to the USIM card that has an available KEK.

[0113] In some embodiments of the present application, after determining the first terminal in the terminal list that meets the first condition, the method includes:

[0114] A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

[0115] In practical applications, reference Figure 4As shown, the second key parameter can be understood as R_KEK generated by the quantum key service platform, and R_KEK can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends a KEK update request to the charging platform, and the second message can be understood as a KEK update request, and the second message includes the SEID and R_KEK corresponding to the first terminal.

[0116] After receiving the second message, the charging platform sends a fourth message to the quantum key service card application on each first terminal through SEID, requesting the quantum key service card application to update the KEK.

[0117] After receiving the fourth message, the quantum key service card application generates a KEK and saves it; then encrypts the KEK to obtain the encrypted first key parameter EKEK, EKEK = Epub (PKp, KEK); then generates a KEK verification code KEK_MAC based on the KEK, KEK_MAC = HMAC (KEK_i, KEK, SEID, R_KEK). After obtaining EKEK and KEK_MAC, a fifth message is sent to the charging platform in response to the KEK update request of the charging platform. The fifth message may include SEID, R_KEK, EKEK and KEK_MAC.

[0118] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the KEK update request of the cryptographic service platform. The sixth message may include {SEID, R_KEK, EKEK, KEK_MAC, QKN}_i, i=1,…,n.

[0119] In some embodiments of the present application, after sending the second message to the filling platform, the method includes:

[0120] Receive a sixth message sent by the charging platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0121] In practical applications, reference Figure 4 As shown, after receiving the KEK update response from the first terminal, the charging platform returns the KEK update response to the cryptographic service platform. The sixth message can be understood as the KEK update response; the sixth message can include {SEID, R_KEK, EKEK, KEK_MAC}_i, i=1,…,n.

[0122] The first key parameter may be understood as KEK, the second key parameter may be understood as R_KEK, the third key parameter may be understood as KEK_MAC, and QKN may be understood as the number of keys to be charged in the first terminal.

[0123] In some embodiments of the present application, after receiving the sixth message sent by the filling platform, the method includes:

[0124] Verifying a third key parameter;

[0125] When the third key parameter is verified to be legal, the first key parameter is saved.

[0126] In practical applications, reference Figure 4 As shown, after the cryptographic service platform receives the sixth message sent by the charging platform, it can verify the legitimacy of KEK_MAC for each pair of (SEID, QKN)_i, and save KEK when KEK_MAC is legal.

[0127] In some embodiments of the present application, after saving the first key parameter, the following steps are included:

[0128] generating a first charging key for the first terminal;

[0129] Encrypting the first charging key based on the first key parameter to obtain the encrypted first charging key;

[0130] generating a fourth key parameter based on the first key parameter;

[0131] A seventh message is sent to the charging platform; the seventh message includes the encrypted first charging key and fourth key parameters.

[0132] In practical applications, reference Figure 4 As shown, after the cryptographic service platform saves the KEK of the first terminal, it generates the quantum key set QKs = {QK1, QK2, ..., QKn} and the corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the first terminal. The first injection key can be understood as QKs.

[0133] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted first charging key EQKs, EQKs=E(KEK, QKs); generates the first charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...); QKs_MAC can also be generated based on KEK and EKEK, in which case, QKs_MAC=HMAC(KEK, SEID, KEK, QKIDs, EQKs, ...). The seventh message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0134] After receiving the seventh message, the charging platform sends an eighth message to the quantum key service card application on each first terminal through SEID. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0135] The quantum key service card application verifies the legitimacy of QKs_MAC based on the eighth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0136] In some embodiments of the present application, after determining the second terminal in the terminal list that does not meet the first condition, the method includes:

[0137] generating a second charging key for the second terminal;

[0138] Encrypting the second charging key based on the first key parameter to obtain an encrypted second charging key;

[0139] A fourth key parameter is generated based on the first key parameter; and the third message includes the encrypted second charging key and the fourth key parameter.

[0140] In actual applications, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i. The second terminal can be understood as the terminal corresponding to the USIM card with an available KEK.

[0141] The cryptographic service platform generates a quantum key set QKs = {QK1, QK2, ..., QKn} and a corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the second terminal. The second injection key can be understood as QKs.

[0142] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted second charging key EQKs, EQKs=E(KEK, QKs); generates the second charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). The third message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0143] After receiving the third message, the charging platform sends a ninth message to the quantum key service card application on each second terminal through SEID. The ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0144] The quantum key service card application verifies the legitimacy of QKs_MAC based on the ninth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0145] In some embodiments of the present application, the method further comprises:

[0146] The first charging state of the first charging key and / or the second charging state of the second charging key are set.

[0147] In actual applications, after the quantum key service card application completes the charging, it can return a charging response to the charging platform. After receiving it, the charging platform sends the charging response to the cryptographic service platform. The charging platform can set the charging status of each QKs.

[0148] The embodiment of the present application provides a key injection method, which is applied to the injection platform, referring to Figure 5 As shown, the method comprises the following steps:

[0149] Step S501: Send a first message to the cryptographic service platform.

[0150] The first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list.

[0151] It can be understood that the cryptographic service platform can be understood as a quantum key service platform. The terminal may include a UE, and may also include a quantum secure terminal (Quantum Secure Equipment, QSE), that is, a secure terminal device that can provide quantum security services for upper-layer business applications based on quantum keys; this application does not limit this. The embodiment of the present application is described by taking a UE as an example, and the UE includes a USIM card.

[0152] The quantum key can be managed by the quantum key service card application on the USIM card. The quantum key service card application is responsible for receiving instructions and data from the charging platform, storing the quantum key in the secure storage area of ​​the USIM card, and completing the charging of the quantum key. Before the charging platform receives the quantum key charging task, the charging platform can send the quantum key service card application to the card dealer through a secure channel. After the card is written, the card dealer will synchronize the security element identifier (SEID) list of the USIM card to the charging platform and the quantum key service platform through a secure channel.

[0153] refer to Figure 2 As shown, the quantum key service platform can generate KEK to protect QK, and can also generate the initial key encapsulation key KEK_i and the public-private key pair (SKp, PKp); (SKp, PKp) is used to protect the confidentiality of KEK, and KEK_i is used to protect the legitimacy of KEK. The card dealer has its own unique public-private key pair (SKm, PKm) to protect KEK_i; the quantum key service platform can obtain the card dealer's public key PKm from a secure channel.

[0154] In practical applications, reference Figure 3As shown, before the quantum key service platform sends KEK_i to the card dealer, it can encrypt KEK_i through an encryption algorithm to obtain EKEK_i, EKEK_i = Epub (PKm, KEK_i). The quantum key service platform sends EKEK_i to the card dealer through a secure channel, and the card dealer can decrypt EKEK_i through a decryption algorithm to obtain KEK_i; KEK_i = Dpub (SKm, EKEK_i). The quantum key service platform can also send PKp to the card dealer.

[0155] After receiving the quantum key injection task, the injection platform can prepare a QK requirement list {SEID, QKN}_i according to the task requirements, where i=1,…,n; QKN is the number of injection keys corresponding to each SEID. The injection platform sends an injection key acquisition request to the quantum key service platform, and the request contains {SEID, QKN}_i. The first message can be understood as an injection key acquisition request, where {SEID, QKN}_i includes the identifier of each terminal to be injected and the number of keys to be injected corresponding to the terminal.

[0156] Step S502: Receive the second message and / or the third message sent by the cryptographic service platform.

[0157] The second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key injection process.

[0158] refer to Figure 3 As shown, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i.

[0159] In actual applications, for USIM cards that do not have KEK or need to update KEK, the update process is run, and the first terminal can be understood as the terminal corresponding to the USIM card that does not have KEK or needs to update KEK. The quantum key service platform generates a key parameter R_KEK, which can be a random number or a timestamp. After generating R_KEK, the quantum key service platform sends a KEK update request to the charging platform. The second message can be understood as a KEK update request, and the second message includes the SEID and R_KEK corresponding to the first terminal.

[0160] For the USIM card with available KEK, the key injection process is run. The second terminal can be understood as the terminal corresponding to the USIM card with available KEK. After the quantum key service platform generates a quantum key for the second terminal, it can encrypt the quantum key based on the KEK and then send a key acquisition response to the injection platform. The third message can be understood as a key acquisition response. The third message includes the SEID corresponding to the second terminal and the encrypted quantum key.

[0161] It can be seen from the above content that in the embodiment of the present application, the cryptographic service platform receives a first message sent by a charging platform, the first message including a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the charging platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process; so as to enable the cryptographic service platform to initiate the terminal update process and / or charging process according to security requirements, thereby solving the problem in the related art that the encapsulation key of the cryptographic service platform is repeatedly used, making it difficult to ensure the security of the quantum key charging process.

[0162] In some embodiments of the present application, after receiving the second message sent by the cryptographic service platform, the method includes:

[0163] A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

[0164] In practical applications, reference Figure 4 As shown, the second key parameter can be understood as R_KEK generated by the quantum key service platform, and R_KEK can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends a KEK update request to the charging platform, and the second message can be understood as a KEK update request, and the second message includes the SEID and R_KEK corresponding to the first terminal.

[0165] After receiving the second message, the charging platform sends a fourth message to the quantum key service card application on each first terminal through SEID, requesting the quantum key service card application to update the KEK.

[0166] In some embodiments of the present application, after sending the fourth message to the first terminal, the method includes:

[0167] receiving a fifth message sent by the first terminal; the fifth message includes the encrypted first key parameter, second key parameter and third key parameter;

[0168] A sixth message is sent to the cryptographic service platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0169] In actual application, after receiving the fourth message, the quantum key service card application generates a KEK and saves it; then encrypts the KEK to obtain the encrypted first key parameter EKEK, EKEK = Epub (PKp, KEK); then generates a KEK verification code KEK_MAC based on the KEK, KEK_MAC = HMAC (KEK_i, KEK, SEID, R_KEK). After obtaining EKEK and KEK_MAC, a fifth message is sent to the charging platform in response to the KEK update request of the charging platform. The fifth message may include SEID, R_KEK, EKEK and KEK_MAC.

[0170] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the KEK update request of the cryptographic service platform. The sixth message may include {SEID, R_KEK, EKEK, KEK_MAC, QKN}_i, i=1,…,n.

[0171] In some embodiments of the present application, after sending the sixth message to the cryptographic service platform, the method includes:

[0172] receiving a seventh message sent by the cryptographic service platform; the seventh message including the encrypted first charging key and the fourth key parameter;

[0173] An eighth message is sent to the first terminal; the eighth message includes the encrypted first charging key and the fourth key parameter.

[0174] In practical applications, reference Figure 4 As shown, after the cryptographic service platform receives the sixth message sent by the charging platform, it can verify the legitimacy of KEK_MAC for each pair of (SEID, QKN)_i, and save KEK when KEK_MAC is legal.

[0175] After the cryptographic service platform saves the KEK of the first terminal, it generates the quantum key set QKs = {QK1, QK2, ..., QKn} and the corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the first terminal. The first injection key can be understood as QKs.

[0176] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted first charging key EQKs, EQKs=E(KEK, QKs); generates the first charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...); QKs_MAC can also be generated based on KEK and EKEK, in which case, QKs_MAC=HMAC(KEK, SEID, KEK, QKIDs, EQKs, ...). The seventh message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0177] After receiving the seventh message, the charging platform sends an eighth message to the quantum key service card application on each first terminal through SEID. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0178] The quantum key service card application verifies the legitimacy of QKs_MAC based on the eighth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0179] In some embodiments of the present application, after receiving the third message sent by the cryptographic service platform, the method includes:

[0180] A ninth message is sent to the second terminal; the ninth message includes the encrypted second charging key and the fourth key parameter.

[0181] In actual applications, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i. The second terminal can be understood as the terminal corresponding to the USIM card with an available KEK.

[0182] The cryptographic service platform generates a quantum key set QKs = {QK1, QK2, ..., QKn} and a corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the second terminal. The second injection key can be understood as QKs.

[0183] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted second charging key EQKs, EQKs=E(KEK, QKs); generates the second charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). The third message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0184] After receiving the third message, the charging platform sends a ninth message to the quantum key service card application on each second terminal through SEID. The ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0185] The quantum key service card application verifies the legitimacy of QKs_MAC based on the ninth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0186] The embodiment of the present application provides a key injection method, which is applied to a terminal, referring to Figure 6 As shown, the method comprises the following steps:

[0187] Step S601: receiving the fourth message and / or the ninth message sent by the charging platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second charging key and the fourth key parameter.

[0188] In actual application, after receiving the fourth message, the quantum key service card application generates a KEK and saves it; then encrypts the KEK to obtain the encrypted first key parameter EKEK, EKEK = Epub (PKp, KEK); then generates a KEK verification code KEK_MAC based on the KEK, KEK_MAC = HMAC (KEK_i, KEK, SEID, R_KEK). After obtaining EKEK and KEK_MAC, a fifth message is sent to the charging platform in response to the KEK update request of the charging platform. The fifth message may include SEID, R_KEK, EKEK and KEK_MAC.

[0189] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the KEK update request of the cryptographic service platform. The sixth message may include {SEID, R_KEK, EKEK, KEK_MAC, QKN}_i, i=1,…,n.

[0190] After receiving the sixth message sent by the charging platform, the cryptographic service platform can verify the legitimacy of KEK_MAC for each pair of (SEID, QKN)_i, and save KEK if KEK_MAC is legal. After saving the KEK of the first terminal, the cryptographic service platform generates the quantum key set QKs={QK1, QK2, ..., QKn} and the corresponding key identifier QKIDs={QKID1, QKID2, ..., QKIDn} of the first terminal. The first charging key can be understood as QKs.

[0191] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted first charging key EQKs, EQKs=E(KEK, QKs); generates the first charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...); QKs_MAC can also be generated based on KEK and EKEK, in which case, QKs_MAC=HMAC(KEK, SEID, KEK, QKIDs, EQKs, ...). The seventh message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0192] After receiving the seventh message, the charging platform sends an eighth message to the quantum key service card application on each first terminal through SEID. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0193] The quantum key service card application verifies the legitimacy of QKs_MAC based on the eighth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0194] The quantum key service card application verifies the legitimacy of QKs_MAC based on the ninth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0195] In some embodiments of the present application, after receiving the fourth message sent by the filling platform, the method includes:

[0196] Generate a first key parameter and save the first key parameter;

[0197] Encrypting the first key parameter to obtain an encrypted first key parameter;

[0198] generating a third key parameter based on the first key parameter;

[0199] A fifth message is sent to the filling platform; the fifth message includes the encrypted first key parameter, second key parameter and third key parameter.

[0200] In actual application, after receiving the fourth message, the quantum key service card application generates a KEK and saves it; then encrypts the KEK to obtain the encrypted first key parameter EKEK, EKEK = Epub (PKp, KEK); then generates a KEK verification code KEK_MAC based on the KEK, KEK_MAC = HMAC (KEK_i, KEK, SEID, R_KEK). After obtaining EKEK and KEK_MAC, a fifth message is sent to the charging platform in response to the KEK update request of the charging platform. The fifth message may include SEID, R_KEK, EKEK and KEK_MAC.

[0201] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the KEK update request of the cryptographic service platform. The sixth message may include {SEID, R_KEK, EKEK, KEK_MAC, QKN}_i, i=1,…,n.

[0202] After receiving the sixth message sent by the charging platform, the cryptographic service platform can verify the legitimacy of KEK_MAC for each pair of (SEID, QKN)_i, and save KEK if KEK_MAC is legal.

[0203] After the cryptographic service platform saves the KEK of the first terminal, it generates the quantum key set QKs = {QK1, QK2, ..., QKn} and the corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the first terminal. The first injection key can be understood as QKs.

[0204] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted first charging key EQKs, EQKs=E(KEK, QKs); generates the first charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...); QKs_MAC can also be generated based on KEK and EKEK, in which case, QKs_MAC=HMAC(KEK, SEID, KEK, QKIDs, EQKs, ...). The seventh message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0205] After receiving the seventh message, the charging platform sends an eighth message to the quantum key service card application on each first terminal through SEID. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0206] In some embodiments of the present application, after sending the fifth message to the filling platform, the method includes:

[0207] Receiving an eighth message sent by the charging platform; the eighth message includes the encrypted first charging key and fourth key parameters;

[0208] verifying the fourth key parameter;

[0209] When the fourth key parameter is verified to be legal, decrypting the encrypted first charging key based on the first key parameter to obtain the first charging key;

[0210] Prime the first prime key.

[0211] In actual applications, the quantum key service card application verifies the legitimacy of QKs_MAC based on the eighth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0212] In some embodiments of the present application, after receiving the ninth message sent by the filling platform, the method includes:

[0213] verifying the fourth key parameter;

[0214] When the fourth key parameter is verified to be legal, decrypting the encrypted second charging key based on the first key parameter to obtain the second charging key;

[0215] Prime the second prime key.

[0216] In actual applications, the quantum key service platform determines whether each SEID has a corresponding KEK for each pair of (SEID, QKN)_i. The second terminal can be understood as the terminal corresponding to the USIM card with an available KEK.

[0217] The cryptographic service platform generates a quantum key set QKs = {QK1, QK2, ..., QKn} and a corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the second terminal. The second injection key can be understood as QKs.

[0218] The cryptographic service platform encrypts QKs based on KEK to obtain the encrypted second charging key EQKs, EQKs=E(KEK, QKs); generates the second charging key verification code QKs_MAC based on KEK, and the fourth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). The third message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1, ..., n.

[0219] After receiving the third message, the charging platform sends a ninth message to the quantum key service card application on each second terminal through SEID. The ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0220] The quantum key service card application verifies the legitimacy of QKs_MAC based on the ninth message. If QKs_MAC is legal, it decrypts EQKs to obtain QKs, and then writes QKs and the corresponding QKIDs locally.

[0221] Based on the same inventive concept as above, Figure 7 A schematic diagram of the structure of a key injection device provided by an embodiment of the present invention, which is applied to a cryptographic service platform, includes:

[0222] The first receiving unit 701 is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0223] The first sending unit 702 is used to send a second message and / or a third message to the charging platform; the second message indicates the first terminal entering the update process; the third message indicates the second terminal entering the key charging process.

[0224] In some embodiments of the present application, the device also includes: a first processing unit, used to determine a first terminal in the terminal list that meets the first condition and / or a second terminal that does not meet the first condition; the first condition indicates that the first key parameter is not included or the first key parameter is to be updated.

[0225] In some embodiments of the present application, the first processing unit is further used to generate a second key parameter for the first terminal; and the second message includes the second key parameter.

[0226] In some embodiments of the present application, the first receiving unit 701 is further used to receive a sixth message sent by the charging platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

[0227] In some embodiments of the present application, the first processing unit is further used to verify the third key parameter;

[0228] When the third key parameter is verified to be legal, the first key parameter is saved.

[0229] In some embodiments of the present application, the first processing unit is further configured to generate a first charging key for the first terminal;

[0230] Encrypting the first charging key based on the first key parameter to obtain the encrypted first charging key;

[0231] generating a fourth key parameter based on the first key parameter;

[0232] The first sending unit 702 is further used to send a seventh message to the charging platform; the seventh message includes the encrypted first charging key and the fourth key parameter.

[0233] In some embodiments of the present application, the first processing unit is further configured to generate a second charging key for the second terminal;

[0234] Encrypting the second charging key based on the first key parameter to obtain an encrypted second charging key;

[0235] A fourth key parameter is generated based on the first key parameter; and the third message includes the encrypted second charging key and the fourth key parameter.

[0236] In some embodiments of the present application, the first processing unit is further configured to set a first charging state of the first charging key and / or a second charging state of the second charging key.

[0237] Based on the same inventive concept as above, Figure 8 A schematic diagram of the structure of a key injection device provided by an embodiment of the present invention, which is applied to an injection platform, includes:

[0238] The second sending unit 801 is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0239] The second receiving unit 802 is used to receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key injection process.

[0240] In some embodiments of the present application, the second sending unit 801 is further used to send a fourth message to the first terminal; the fourth message includes the second key parameter.

[0241] In some embodiments of the present application, the second receiving unit 802 is further configured to receive a fifth message sent by the first terminal; the fifth message includes the encrypted first key parameter, the second key parameter, and the third key parameter;

[0242] The second sending unit 801 is further used to send a sixth message to the cryptographic service platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0243] In some embodiments of the present application, the second receiving unit 802 is further configured to receive a seventh message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key and the fourth key parameter;

[0244] The second sending unit 801 is further used to send an eighth message to the first terminal; the eighth message includes the encrypted first injection key and the fourth key parameter.

[0245] In some embodiments of the present application, the second sending unit 801 is further used to send a ninth message to the second terminal; the ninth message includes the encrypted second charging key and the fourth key parameter.

[0246] Based on the same inventive concept as above, Fig. 9 A schematic diagram of the structure of a key injection device provided in an embodiment of the present invention, which is applied to a terminal, includes:

[0247] The third receiving unit 901 is used to receive the fourth message and / or the ninth message sent by the charging platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second charging key and the fourth key parameter.

[0248] In some embodiments of the present application, the device further includes a second processing unit and a third sending unit; wherein the second processing unit is used to generate a first key parameter and save the first key parameter;

[0249] Encrypting the first key parameter to obtain an encrypted first key parameter;

[0250] generating a third key parameter based on the first key parameter;

[0251] The third sending unit is used to send a fifth message to the filling platform; the fifth message includes the encrypted first key parameter, second key parameter and third key parameter.

[0252] In some embodiments of the present application, the third receiving unit 901 is used to receive an eighth message sent by the charging platform; the eighth message includes the encrypted first charging key and the fourth key parameter;

[0253] The second processing unit is further used to verify the fourth key parameter;

[0254] When the fourth key parameter is verified to be legal, decrypting the encrypted first charging key based on the first key parameter to obtain the first charging key;

[0255] Prime the first prime key.

[0256] In some embodiments of the present application, the second processing unit is further used to verify the fourth key parameter;

[0257] When the fourth key parameter is verified to be legal, decrypting the encrypted second charging key based on the first key parameter to obtain the second charging key;

[0258] Prime the second prime key.

[0259] Based on the hardware implementation of the above program modules, and in order to implement the method of the cryptographic service platform side of the embodiment of the present application, the embodiment of the present application also provides a cryptographic service platform, such as Fig.10 As shown, the cryptographic service platform 1000 includes:

[0260] The first communication interface 1001 is capable of exchanging information with the filling platform;

[0261] The first processor 1002 is connected to the first communication interface 1001 to implement information interaction with the charging platform, and is used to execute the method provided by one or more technical solutions of the cryptographic service platform side when running the computer program;

[0262] The first memory 1003 , on which the computer program is stored.

[0263] Specifically, the first communication interface 1001 is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0264] A second message and / or a third message is sent to the charging platform; the second message indicates the first terminal entering the update process; the third message indicates the second terminal entering the key charging process.

[0265] In some embodiments of the present application, the first processor 1002 is used to determine a first terminal that meets a first condition and / or a second terminal that does not meet the first condition in the terminal list; the first condition indicates that the first key parameter is not included or the first key parameter is to be updated.

[0266] In some embodiments of the present application, the first communication interface 1001 is further used to generate a second key parameter of the first terminal; and the second message includes the second key parameter.

[0267] In some embodiments of the present application, the first communication interface 1001 is also used to receive a sixth message sent by the charging platform; the sixth message includes the encrypted first key parameter, second key parameter, third key parameter and the number of keys to be charged by the first terminal.

[0268] In some embodiments of the present application, the first processor 1002 is further configured to verify a third key parameter;

[0269] When the third key parameter is verified to be legal, the first key parameter is saved.

[0270] In some embodiments of the present application, the first processor 1002 is further configured to generate a first charging key for the first terminal;

[0271] Encrypting the first charging key based on the first key parameter to obtain the encrypted first charging key;

[0272] generating a fourth key parameter based on the first key parameter;

[0273] The first communication interface 1001 is also used to send a seventh message to the charging platform; the seventh message includes the encrypted first charging key and fourth key parameters.

[0274] In some embodiments of the present application, the first processor 1002 is further configured to generate a second charging key for the second terminal;

[0275] Encrypting the second charging key based on the first key parameter to obtain an encrypted second charging key;

[0276] A fourth key parameter is generated based on the first key parameter; and the third message includes the encrypted second charging key and the fourth key parameter.

[0277] In some embodiments of the present application, the first processor 1002 is further configured to set a first charging state of the first charging key and / or a second charging state of the second charging key.

[0278] Of course, in actual application, the various components in the cryptographic service platform 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0279] The first memory 1003 in the embodiment of the present application is used to store various types of data to support the operation of the cryptographic service platform 1000. Examples of such data include: any computer program used to operate on the cryptographic service platform 1000.

[0280] The method disclosed in the above embodiment of the present application can be applied to the first processor 1002, or implemented by the first processor 1002. The first processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the first processor 1002 or an instruction in the form of software. The first processor 1002 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1002 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1003, and the first processor 1002 reads the information in the first memory 1003, and completes the steps of the above method in combination with its hardware.

[0281] In an exemplary embodiment, the cryptographic service platform 1000 can be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0282] Based on the hardware implementation of the above program modules, and in order to implement the method of the charging platform side of the embodiment of the present application, the embodiment of the present application also provides a charging platform, such as Fig.11 As shown, the filling platform 1100 includes:

[0283] The second communication interface 1101 is capable of exchanging information with the cryptographic service platform and the terminal;

[0284] The second processor 1102 is connected to the second communication interface 1101 to implement information interaction with the cryptographic service platform and the terminal, and is used to execute the method provided by one or more technical solutions of the charging platform side when running the computer program;

[0285] The second memory 1103 , on which the computer program is stored.

[0286] Specifically, the second communication interface 1101 is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0287] A second message and / or a third message sent by the cryptographic service platform is received; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

[0288] In some embodiments of the present application, the second communication interface 1101 is further used to send a fourth message to the first terminal; the fourth message includes the second key parameter.

[0289] In some embodiments of the present application, the second communication interface 1101 is further used to receive a fifth message sent by the first terminal; the fifth message includes the encrypted first key parameter, the second key parameter and the third key parameter;

[0290] The second communication interface 1101 is also used to send a sixth message to the cryptographic service platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0291] In some embodiments of the present application, the second communication interface 1101 is further used to receive a seventh message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key and the fourth key parameter;

[0292] An eighth message is sent to the first terminal; the eighth message includes the encrypted first charging key and the fourth key parameter.

[0293] In some embodiments of the present application, the second communication interface 1101 is further used to send a ninth message to the second terminal; the ninth message includes the encrypted second injection key and the fourth key parameter.

[0294] The method disclosed in the above embodiment of the present application can be applied to the second processor 1102, or implemented by the second processor 1102. The second processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the second processor 1102 or an instruction in the form of software. The second processor 1102 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1102 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1103, and the second processor 1102 reads the information in the second memory 1103, and completes the steps of the above method in combination with its hardware.

[0295] In an exemplary embodiment, the filling platform 1100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0296] Based on the hardware implementation of the above program modules, and in order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a terminal, such as Fig.12 As shown, the terminal 1200 includes:

[0297] The third communication interface 1201 is capable of exchanging information with the filling platform;

[0298] The third processor 1202 is connected to the second communication interface 1201 to implement information interaction with the filling platform, and is used to execute the method provided by one or more technical solutions on the terminal side when running the computer program;

[0299] The third memory 1203 , on which the computer program is stored.

[0300] Specifically, the third communication interface 1201 is used to receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

[0301] In some embodiments of the present application, the third processor 1202 is used to generate a first key parameter and save the first key parameter;

[0302] Encrypting the first key parameter to obtain an encrypted first key parameter;

[0303] generating a third key parameter based on the first key parameter;

[0304] The third communication interface 1201 is used to send a fifth message to the filling platform; the fifth message includes the encrypted first key parameter, second key parameter and third key parameter.

[0305] In some embodiments of the present application, the third communication interface 1201 is used to receive an eighth message sent by the charging platform; the eighth message includes the encrypted first charging key and the fourth key parameter;

[0306] The third processor 1202 is further used to verify the fourth key parameter;

[0307] When the fourth key parameter is verified to be legal, decrypting the encrypted first charging key based on the first key parameter to obtain the first charging key;

[0308] Prime the first prime key.

[0309] In some embodiments of the present application, the third processor 1202 is further configured to verify a fourth key parameter;

[0310] When the fourth key parameter is verified to be legal, decrypting the encrypted second charging key based on the first key parameter to obtain the second charging key;

[0311] Prime the second prime key.

[0312] It can be understood that the memory (first memory 1003, second memory 1103, third memory 1203) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache.By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0313] Based on the above embodiments, the embodiments of the present application provide a storage medium, wherein the storage medium stores computer executable instructions, and the computer executable instructions are configured to execute Figure 1 or Figure 5 or Figure 6 The corresponding embodiment provides a key injection method.

[0314] Based on the above embodiments, the embodiments of the present application further provide a computer product, including a computer program, which is executed by a processor to implement Figure 1 or Figure 5 or Figure 6 The corresponding embodiments provide steps in the key injection method.

[0315] It should be noted that the above-mentioned computer storage medium can be a memory such as ROM, PROM, EPROM, EEPROM, FRAM, FlashMemory, magnetic surface storage, optical disk, or CD-ROM; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0316] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0317] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0318] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a first network device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0319] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0320] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0321] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0322] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A key filling method, characterized in that: Applied to a cryptographic service platform, the method comprises: Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering into an update process; the third message indicates a second terminal entering into a key injection process.

2. The method according to claim 1, characterized in that Before sending the second message and / or the third message to the filling platform, the method includes: Determine the first terminal that meets a first condition and / or the second terminal that does not meet the first condition in the terminal list; the first condition indicates that the first key parameter is not included or the first key parameter is to be updated.

3. The method according to claim 2, characterized in that After determining the first terminal in the terminal list that meets the first condition, the method further includes: A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

4. The method according to claim 3, characterized in that After sending the second message to the filling platform, the method includes: Receive a sixth message sent by the charging platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

5. The method according to claim 4, characterized in that After receiving the sixth message sent by the filling platform, the method further comprises: verifying the third key parameter; When the third key parameter is verified to be legal, the first key parameter is saved.

6. The method according to claim 5, characterized in that After the first key parameter is saved, the method further comprises: generating a first charging key for the first terminal; encrypting the first charging key based on the first key parameter to obtain an encrypted first charging key; generating a fourth key parameter based on the first key parameter; A seventh message is sent to the filling platform; the seventh message includes the encrypted first filling key and the fourth key parameter.

7. The method according to claim 2, characterized in that: After determining the second terminal in the terminal list that does not meet the first condition, the method further includes: generating a second charging key for the second terminal; encrypting the second charging key based on the first key parameter to obtain an encrypted second charging key; A fourth key parameter is generated based on the first key parameter; and the third message includes the encrypted second filling key and the fourth key parameter.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: The first charging state of the first charging key and / or the second charging state of the second charging key are set.

9. A key filling method, characterized in that: Applied to a charging platform, the method comprises: Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an update process; the third message indicates a second terminal entering a key injection process.

10. The method according to claim 9, characterized in that After receiving the second message sent by the cryptographic service platform, the method includes: A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

11. The method according to claim 10, characterized in that After the sending the fourth message to the first terminal, the method includes: receiving a fifth message sent by the first terminal; the fifth message includes the encrypted first key parameter, the second key parameter and the third key parameter; Sending a sixth message to the cryptographic service platform; the sixth message includes the encrypted first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

12. The method according to claim 11, characterized in that After the sixth message is sent to the cryptographic service platform, the method further comprises: Receiving a seventh message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key and fourth key parameters; An eighth message is sent to the first terminal; the eighth message includes the encrypted first injection key and the fourth key parameter.

13. The method according to claim 9, characterized in that After receiving the third message sent by the cryptographic service platform, the method further comprises: A ninth message is sent to the second terminal; the ninth message includes the encrypted second injection key and the fourth key parameter.

14. A key filling method, characterized in that: Applied to a terminal, the method comprises: Receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

15. The method according to claim 14, characterized in that After receiving the fourth message sent by the filling platform, the method further comprises: Generate a first key parameter and save the first key parameter; Encrypting the first key parameter to obtain an encrypted first key parameter; generating a third key parameter based on the first key parameter; A fifth message is sent to the filling platform; the fifth message includes the encrypted first key parameter, the second key parameter and the third key parameter.

16. The method according to claim 15, characterized in that After sending the fifth message to the filling platform, the method further comprises: Receiving an eighth message sent by the charging platform; the eighth message includes the encrypted first charging key and fourth key parameters; verifying the fourth key parameter; If the fourth key parameter is verified to be legal, decrypting the encrypted first charging key based on the first key parameter to obtain the first charging key; The first charging key is charged.

17. The method according to claim 14, characterized in that After receiving the ninth message sent by the filling platform, the method further comprises: verifying the fourth key parameter; In the case where the fourth key parameter is verified to be legal, decrypting the encrypted second charging key based on the first key parameter to obtain the second charging key; The second charging key is charged.

18. A cryptographic service platform, comprising a first communication interface and a first processor; wherein: The first communication interface is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering into an update process; the third message indicates a second terminal entering into a key injection process.

19. A filling platform, comprising a second communication interface and a second processor; wherein: The second communication interface is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an update process; the third message indicates a second terminal entering a key injection process.

20. A terminal comprising a third communication interface and a third processor; wherein: The third communication interface is used to receive the fourth message and / or the ninth message sent by the filling platform; the fourth message includes the second key parameter; the ninth message includes the encrypted second filling key and the fourth key parameter.

21. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8, 9 to 13, or 14 to 17 are implemented.

22. A computer product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8, 9 to 13, or 14 to 17 are implemented.

Images