Key charging method, related equipment, medium and product

Abstract

The invention discloses a key charging method, related equipment, a medium and a product. The method comprises the following steps: receiving a first message sent by a charging platform; the first message comprises a to-be-charged terminal list and the number of to-be-charged secret keys of each terminal in the terminal list; sending a second message and / or a third message to the charging platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a key injection method, related equipment, medium and product. Background Art

[0002] With the rapid development of Internet technology, the network security risks of information systems continue to increase. The use of quantum keys (QK) can improve the security of business systems. Quantum security keys are based on the principles of quantum mechanics and use the non-cloning and non-measurable characteristics of quantum states to achieve real-time encrypted communication and improve communication efficiency.

[0003] In the related technology, quantum keys are sent in batches by a quantum key service platform to a charging platform for charging. The charging platform can obtain the same full key as the quantum key service platform, and the security of the quantum key charging process cannot be guaranteed. Summary of the invention

[0004] The embodiments of the present application provide a key injection method, related equipment, medium and product.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] A key charging method is applied to a cryptographic service platform, the method comprising:

[0007] Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0008] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

[0009] In the above solution, before sending the second message and / or the third message to the filling platform, the method includes:

[0010] It is determined that the first terminal that does not include the first key parameter and / or the second terminal that includes the first key parameter is included in the terminal list.

[0011] In the above solution, after determining that the terminal list does not include the first terminal having the first key parameter, the method further includes:

[0012] A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

[0013] In the above solution, after sending the second message to the filling platform, the method further comprises:

[0014] Receive a sixth message sent by the charging platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

[0015] In the above solution, after receiving the sixth message sent by the filling platform, the method further comprises:

[0016] verifying the third key parameter;

[0017] When the third key parameter is verified to be legal, the first key parameter is saved.

[0018] In the above solution, after saving the first key parameter, the method further includes:

[0019] generating a first charging key for the first terminal;

[0020] determining whether to update a fourth key parameter of the first terminal;

[0021] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0022] encrypting the first charging key based on the updated fourth key parameter to obtain an encrypted first charging key;

[0023] generating a fifth key parameter based on the updated fourth key parameter;

[0024] Sending a seventh message to the charging platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter;

[0025] If not, encrypting the first charging key based on the fourth key parameter to obtain an encrypted first charging key;

[0026] generating a fifth key parameter based on the fourth key parameter;

[0027] An eighth message is sent to the filling platform; the eighth message includes the encrypted first filling key and the fifth key parameter.

[0028] In the above solution, after determining the second terminal including the first key parameter in the terminal list, the method further includes:

[0029] generating a second charging key for the second terminal;

[0030] determining whether to update a fourth key parameter of the second terminal;

[0031] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0032] encrypting the second charging key based on the updated fourth key parameter to obtain an encrypted second charging key;

[0033] generating a fifth key parameter based on the updated fourth key parameter; the third message comprising the encrypted second charging key, the encrypted fourth key parameter and the fifth key parameter;

[0034] If not, encrypting the second charging key based on the fourth key parameter to obtain an encrypted second charging key;

[0035] A fifth key parameter is generated based on the fourth key parameter; and the third message includes the encrypted second charging key and the fifth key parameter.

[0036] In the above scheme, the method further comprises:

[0037] The first charging state of the first charging key and / or the second charging state of the second charging key are set.

[0038] A key injection method is applied to a key injection platform, the method comprising:

[0039] Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0040] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an initialization process; the third message indicates a second terminal entering a key injection process.

[0041] In the above solution, after receiving the second message sent by the cryptographic service platform, the method further comprises:

[0042] A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

[0043] In the above solution, after sending the fourth message to the first terminal, the method further includes:

[0044] receiving a fifth message sent by the first terminal; the fifth message includes a first key parameter, the second key parameter and a third key parameter;

[0045] Sending a sixth message to the cryptographic service platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0046] In the above solution, after sending the sixth message to the cryptographic service platform, the method further includes:

[0047] receiving a seventh message or an eighth message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; the eighth message includes the encrypted first charging key and the fifth key parameter;

[0048] Sending a ninth message to the first terminal; the ninth message includes the encrypted first injection key, the fifth key parameter and / or the encrypted fourth key parameter.

[0049] In the above solution, after receiving the third message sent by the cryptographic service platform, the method further comprises:

[0050] A tenth message is sent to the second terminal; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0051] A key charging method is applied to a terminal, and the method comprises:

[0052] Receive the fourth message and / or the tenth message sent by the filling platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second filling key, the fifth key parameter and / or the encrypted fourth key parameter.

[0053] In the above solution, after receiving the fourth message sent by the filling platform, the method further comprises:

[0054] generating a first key parameter and a third key parameter;

[0055] A fifth message is sent to the filling platform; the fifth message includes the first key parameter, the second key parameter and the third key parameter.

[0056] In the above solution, after sending the fifth message to the filling platform, the method further comprises:

[0057] receiving a ninth message sent by the charging platform; the ninth message comprising the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter;

[0058] If the ninth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0059] verifying the fifth key parameter;

[0060] In the case where the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the updated fourth key parameter to obtain the first charging key;

[0061] If the ninth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0062] In the case where the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the fourth key parameter to obtain the first charging key;

[0063] The first charging key is charged.

[0064] In the above scheme, after receiving the tenth message sent by the charging platform, the method includes:

[0065] If the tenth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0066] verifying the fifth key parameter;

[0067] In the case where the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the updated fourth key parameter to obtain the second charging key;

[0068] If the tenth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0069] In the case where the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the fourth key parameter to obtain the second charging key;

[0070] The second charging key is charged.

[0071] A key charging device, applied to a cryptographic service platform, comprising:

[0072] Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0073] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

[0074] A key charging device, applied to a charging platform, comprising:

[0075] Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0076] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an initialization process; the third message indicates a second terminal entering a key injection process.

[0077] A key charging device, applied to a terminal, comprising:

[0078] Receive the fourth message and / or the tenth message sent by the filling platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second filling key, the fifth key parameter and / or the encrypted fourth key parameter.

[0079] A cryptographic service platform includes a first communication interface and a first processor; wherein:

[0080] The first communication interface is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0081] A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

[0082] A filling platform includes a second communication interface and a second processor; wherein:

[0083] The second communication interface is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0084] Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an initialization process; the third message indicates a second terminal entering a key injection process.

[0085] A terminal comprises a third communication interface and a third processor; wherein:

[0086] The third communication interface is used to receive the fourth message and / or the tenth message sent by the filling platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second filling key, the fifth key parameter and / or the encrypted fourth key parameter.

[0087] A storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, it implements the steps of any method on the cryptographic service platform side, or implements the steps of any method on the charging platform side, or implements the steps of any method on the terminal side.

[0088] A computer product, including a computer program, characterized in that when the computer program is executed by a processor, it implements the steps of any method on the cryptographic service platform side, or implements the steps of any method on the charging platform side, or implements the steps of any method on the terminal side.

[0089] The present invention provides a key filling method, related equipment, medium and product; receiving a first message sent by a filling platform; the first message includes a list of terminals to be filled and the number of keys to be filled for each terminal in the terminal list; sending a second message and / or a third message to the filling platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key filling process. That is to say, the present application receives the first message sent by the filling platform through the cryptographic service platform, the first message includes a list of terminals to be filled and the number of keys to be filled for each terminal in the terminal list; the cryptographic service platform sends the second message and / or the third message to the filling platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key filling process; so as to realize the dual separation of terminal access rights (filling platform) and key management rights (cryptographic service platform), so that the filling platform cannot obtain the filled quantum key, and solves the problem that the filling platform can obtain the same full key as the quantum key service platform in the related art, but cannot protect the security of the quantum key filling process. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 A flowchart of a key injection method provided in an embodiment of the present application;

[0091] Figure 2 A key relationship diagram provided for an embodiment of the present application;

[0092] Figure 3 A schematic diagram of a key injection preparation process provided in an embodiment of the present application;

[0093] Figure 4 A schematic diagram of a key injection process provided in an embodiment of the present application;

[0094] Figure 5 A flowchart of another key injection method provided in an embodiment of the present application;

[0095] Figure 6 A schematic diagram of a flow chart of a third key injection method provided in an embodiment of the present application;

[0096] Figure 7 A schematic diagram of the structure of a key charging device provided in an embodiment of the present application;

[0097] Figure 8A schematic diagram of the structure of another key injection device provided in an embodiment of the present application;

[0098] Fig. 9 A schematic diagram of the structure of a third key injection device provided in an embodiment of the present application;

[0099] Fig.10 A schematic diagram of the structure of the cryptographic service platform provided in the embodiment of the present application;

[0100] Fig.11 A schematic diagram of the structure of the filling platform provided in the embodiment of the present application;

[0101] Fig.12 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0102] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0103] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0104] The terms "first / second / third" involved in the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first / second / third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0105] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0106] In the related art, the quantum key on the user equipment (UE) is usually charged offline to the security area of ​​the UE at one time to construct a quantum key resource pool, and the service application obtains and uses the quantum key from the resource pool. The security area can be the Subscriber Identity Module (SIM) card, Universal Subscriber Identity Module (USIM) card, Super SIM card, Secure Digital (SD) card, etc. on the terminal.

[0107] In order to ensure the security of quantum keys, quantum keys are generally managed in layers. Taking the UE's security area as the USIM card as an example, the quantum key service platform is mainly responsible for connecting with the quantum random number generator and the quantum key distribution (Quantum Key Distribution, QKD) node to generate, manage and distribute quantum keys; the charging platform receives charging tasks from the quantum key service platform in a single or batch manner, and charges the quantum key into the quantum key service card application of the USIM card to complete the charging of the quantum key; the card dealer (USIM card manufacturer) is mainly responsible for making blank cards and writing card applications and personalized data.

[0108] The embodiment of the present application provides a key injection method, which is applied to a cryptographic service platform. Figure 1 As shown, the method comprises the following steps:

[0109] Step S101: Receive the first message sent by the filling platform.

[0110] The first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list.

[0111] It can be understood that the cryptographic service platform can be understood as a quantum key service platform. The terminal may include a UE, and may also include a quantum secure terminal (Quantum Secure Equipment, QSE), that is, a secure terminal device that can provide quantum security services for upper-layer business applications based on quantum keys; this application does not limit this. The embodiment of the present application is described by taking a UE as an example, and the UE includes a USIM card.

[0112] The quantum key can be managed by the quantum key service card application on the USIM card. The quantum key service card application is responsible for receiving instructions and data from the charging platform, storing the quantum key in the secure storage area of ​​the USIM card, and completing the charging of the quantum key. Before the charging platform receives the quantum key charging task, the charging platform can send the quantum key service card application to the card dealer through a secure channel. After the card is written, the card dealer will synchronize the security element identifier (SEID) list of the USIM card to the charging platform and the quantum key service platform through a secure channel.

[0113] refer to Figure 2 As shown, the quantum key service platform can generate the initial key encapsulation key KEK_i and the key encapsulation key KEK; KEK is used to protect QK, and KEK_i is used to protect the legitimacy of KEK. The quantum key service card application can self-generate a public-private key pair (SKc, PKc) during initialization, and the public-private key pair is used to protect the key encapsulation key KEK. The card dealer has its own unique public-private key pair (SKm, PKm) to protect KEK_i; the quantum key service platform can obtain the card dealer's public key PKm from a secure channel.

[0114] In practical applications, reference Figure 3 As shown, before the quantum key service platform sends KEK_i to the card dealer, it can encrypt KEK_i through an encryption algorithm to obtain EKEK_i, EKEK_i = Epub (PKm, KEK_i). The quantum key service platform sends EKEK_i to the card dealer through a secure channel, and the card dealer can decrypt EKEK_i through a decryption algorithm to obtain KEK_i; KEK_i = Dpub (SKm, EKEK_i).

[0115] After receiving the quantum key injection task, the injection platform can prepare a QK requirement list {SEID, QKN}_i according to the task requirements, where i=1,…,n; QKN is the number of injection keys corresponding to each SEID. The injection platform sends an injection key acquisition request to the quantum key service platform, and the request contains {SEID, QKN}_i. The first message can be understood as an injection key acquisition request, where {SEID, QKN}_i includes the identifier of each terminal to be injected and the number of keys to be injected corresponding to the terminal.

[0116] Step S102: Sending a second message and / or a third message to the filling platform.

[0117] The second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key injection process.

[0118] Understandable, reference Figure 3As shown, for each pair of (SEID, QKN)_i, the quantum key service platform can query from the database whether there is a public key PKc corresponding to the SEID, that is, confirm whether the quantum key service card application on the USIM card has completed initialization.

[0119] In actual applications, for the USIM card that has not been initialized by the quantum key service card application, the initialization process is run, and the first terminal can be understood as the terminal corresponding to the USIM card that has not been initialized by the quantum key service card application. The quantum key service platform generates a key parameter R_PKc, which can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends an initialization request to the charging platform, and the second message can be understood as an initialization request. The second message includes the SEID and R_PKc corresponding to the first terminal.

[0120] For the USIM card that has been initialized by the quantum key service card application, run the key injection process. The second terminal can be understood as the terminal corresponding to the USIM card that has been initialized by the quantum key service card application. After the quantum key service platform generates a quantum key for the second terminal, it can encrypt the quantum key based on the KEK, and then send a key acquisition response to the injection platform. The third message can be understood as a key acquisition response. The third message includes the SEID corresponding to the second terminal and the encrypted quantum key.

[0121] It can be seen from the above content that the embodiment of the present application receives a first message sent by a charging platform through a cryptographic service platform, the first message including a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the charging platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process; so as to realize the dual separation of terminal access rights (charging platform) and key management rights (cryptographic service platform), so that the charging platform cannot obtain the charged quantum key, which solves the problem in the related art that the charging platform can obtain the same full key as the quantum key service platform and cannot protect the security of the quantum key charging process.

[0122] In some embodiments of the present application, before sending the second message and / or the third message to the filling platform, the process includes:

[0123] A first terminal that does not include the first key parameter and / or a second terminal that includes the first key parameter is determined in the terminal list.

[0124] It can be understood that the first key parameter can be understood as the public key PKc.

[0125] In practical applications, for each pair of (SEID, QKN)_i, the quantum key service platform can query from the database whether there is a public key PKc corresponding to the SEID, that is, confirm whether the quantum key service card application on the USIM card has completed initialization. The first terminal can be understood as the terminal corresponding to the USIM card whose quantum key service card application has not been initialized. The second terminal can be understood as the terminal corresponding to the USIM card whose quantum key service card application has been initialized.

[0126] In some embodiments of the present application, after determining that the first terminal in the terminal list does not include the first key parameter, the method includes:

[0127] A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

[0128] In practical applications, reference Figure 4 As shown, the second key parameter can be understood as R_PKc generated by the quantum key service platform, and R_PKc can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends an initialization request to the charging platform, and the second message can be understood as an initialization request, and the second message includes the SEID and R_PKc corresponding to the first terminal.

[0129] After receiving the second message, the charging platform sends a fourth message to the quantum key service card application on each first terminal through SEID, requesting the quantum key service card application to initialize. After receiving the fourth message, the quantum key service card application generates a public-private key pair (SKc, PKc) and a public key verification code PKc_MAC, PKc_MAC = HMAC (KEK_i, PKc, SEID, R_PKc), and sends a fifth message to the charging platform in response to the initialization request of the charging platform. The fifth message may include SEID, R_PKc, PKc and PKc_MAC.

[0130] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the initialization request of the cryptographic service platform. The sixth message may include {SEID, QKN, R_PKc, PKc, PKc_MAC}_i, i=1,…,n.

[0131] In some embodiments of the present application, after sending the second message to the filling platform, the method includes:

[0132] Receive a sixth message sent by the charging platform; the sixth message includes a first key parameter, a second key parameter, a third key parameter and the number of keys to be charged to the first terminal.

[0133] In practical applications, reference Figure 4As shown, after receiving the initialization response of the first terminal, the charging platform returns the initialization response to the cryptographic service platform, and the sixth message can be understood as the initialization response; the sixth message can include {SEID, QKN, R_PKc, PKc, PKc_MAC}_i, i=1,…,n. The first key parameter can be understood as PKc, the second key parameter is R_PKc, the third key parameter can be understood as PKc_MAC, and QKN can be understood as the number of keys to be charged by the first terminal.

[0134] In some embodiments of the present application, after receiving the sixth message sent by the filling platform, the method includes:

[0135] Verifying a third key parameter;

[0136] When the third key parameter is verified to be legal, the first key parameter is saved.

[0137] In practical applications, reference Figure 4 As shown, after the cryptographic service platform receives the sixth message sent by the charging platform, it can verify the legitimacy of PKc_MAC for each pair of (SEID, QKN)_i, and save PKc if PKc_MAC is legal.

[0138] In some embodiments of the present application, after saving the first key parameter, the following steps are included:

[0139] generating a first charging key for the first terminal;

[0140] determining whether to update a fourth key parameter of the first terminal;

[0141] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0142] encrypting the first charging key based on the updated fourth key parameter to obtain an encrypted first charging key;

[0143] generating a fifth key parameter based on the updated fourth key parameter;

[0144] Sending a seventh message to the charging platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter;

[0145] If not, encrypt the first charging key based on the fourth key parameter to obtain the encrypted first charging key;

[0146] generating a fifth key parameter based on the fourth key parameter;

[0147] An eighth message is sent to the charging platform; the eighth message includes the encrypted first charging key and the fifth key parameter.

[0148] In practical applications, reference Figure 4 As shown, after the cryptographic service platform saves the PKc of the first terminal, it generates the quantum key set QKs = {QK1, QK2, ..., QKn} and the corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the first terminal. The first injection key can be understood as QKs.

[0149] The cryptographic service platform needs to determine whether to update the KEK of the first terminal, and the fourth key parameter can be understood as KEK. The cryptographic service platform updates the key encapsulation key at any time according to security needs, which is conducive to protecting and improving the security of quantum keys.

[0150] If so, a new KEK is randomly generated, and the new KEK is saved according to the SEID, and the updated KEK is encrypted to obtain the encrypted fourth key parameter EKEK=Epub(PKc, KEK). QKs is encrypted by the updated KEK to obtain the encrypted first filling key EQKs, and the first filling key verification code QKs_MAC is generated. The fifth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, EKEK, QKIDs, EQKs, ...). If not, QKs is encrypted by KEK to obtain EQKs and generate QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). Among them, EQKs=E(KEK, QKs). The seventh message may include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n.

[0151] After receiving the seventh message, the charging platform sends a ninth message to the quantum key service card application on each first terminal through SEID, and the ninth message may include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}; after receiving the eighth message, the charging platform sends a ninth message to the quantum key service card application on each first terminal through SEID, and at this time, the ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0152] The quantum key service card application determines whether there is an EKEK for each SEID according to the ninth message. If there is, the EKEK needs to be decrypted to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0153] In some embodiments of the present application, after determining the second terminal including the first key parameter in the terminal list, the method includes:

[0154] generating a second charging key for the second terminal;

[0155] determining whether to update a fourth key parameter of the second terminal;

[0156] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0157] encrypting the second charging key based on the updated fourth key parameter to obtain an encrypted second charging key;

[0158] generating a fifth key parameter based on the updated fourth key parameter; the third message includes the encrypted second charging key, the encrypted fourth key parameter and the fifth key parameter;

[0159] If not, encrypting the second charging key based on the fourth key parameter to obtain an encrypted second charging key;

[0160] A fifth key parameter is generated based on the fourth key parameter; and the third message includes the encrypted second charging key and the fifth key parameter.

[0161] In actual applications, for each pair of (SEID, QKN)_i, the quantum key service platform can query from the database whether there is a public key PKc corresponding to the SEID, that is, confirm whether the quantum key service card application on the USIM card has completed initialization. The second terminal can be understood as the terminal corresponding to the USIM card that has been initialized by the quantum key service card application.

[0162] Run the key injection process for the USIM card that has been initialized by the quantum key service card application. Figure 4 As shown, the cryptographic service platform generates a quantum key set QKs = {QK1, QK2, ..., QKn} and a corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the second terminal. The second injection key can be understood as QKs.

[0163] The cryptographic service platform needs to determine whether to update the KEK of the second terminal. The fourth key parameter can be understood as KEK. If so, a new KEK is randomly generated, and the new KEK is saved according to SEID. The updated KEK is encrypted to obtain the encrypted fourth key parameter EKEK=Epub(PKc, KEK). QKs is encrypted by the updated KEK to obtain the encrypted second filling key EQKs, and the second filling key verification code QKs_MAC is generated. The fifth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, EKEK, QKIDs, EQKs, ...). If not, QKs is encrypted by KEK to obtain EQKs, and QKs_MAC is generated, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). Among them, EQKs=E(KEK, QKs). After generating QKs_MAC and QKs, the cryptographic service platform sends a third message to the charging platform. The third message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n.

[0164] After receiving the third message, the charging platform sends the tenth message to the quantum key service card application on each second terminal through SEID. The tenth message may include {SEID, QKIDs, EQKs, QKs_MAC}, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}.

[0165] The quantum key service card application determines whether there is an EKEK for each SEID according to the tenth message. If there is, it needs to decrypt the EKEK to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0166] In some embodiments of the present application, the method further comprises:

[0167] The first charging state of the first charging key and / or the second charging state of the second charging key are set.

[0168] In actual applications, after the quantum key service card application completes the charging, it can return a charging response to the charging platform. After receiving it, the charging platform sends the charging response to the cryptographic service platform. The charging platform can set the charging status of each QKs.

[0169] The embodiment of the present application provides a key injection method, which is applied to the injection platform, referring to Figure 5 As shown, the method comprises the following steps:

[0170] Step S501: Send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list.

[0171] In practical applications, after receiving a quantum key injection task, the injection platform can prepare a QK requirement list {SEID, QKN}_i according to the task requirements, where i=1,…,n; QKN is the number of injection keys corresponding to each SEID. The injection platform sends an injection key acquisition request to the quantum key service platform, and the request contains {SEID, QKN}_i. The first message can be understood as an injection key acquisition request, where {SEID, QKN}_i includes the identifier of each terminal to be injected and the number of keys to be injected corresponding to the terminal.

[0172] Step S502: Receive the second message and / or the third message sent by the cryptographic service platform.

[0173] The second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key injection process.

[0174] It can be understood that for each pair of (SEID, QKN)_i, the quantum key service platform can query from the database whether there is a public key PKc corresponding to the SEID, that is, confirm whether the quantum key service card application on the USIM card has completed initialization.

[0175] In actual applications, for the USIM card that has not been initialized by the quantum key service card application, the initialization process is run, and the first terminal can be understood as the terminal corresponding to the USIM card that has not been initialized by the quantum key service card application. The quantum key service platform generates a key parameter R_PKc, which can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends an initialization request to the charging platform, and the second message can be understood as an initialization request. The second message includes the SEID and R_PKc corresponding to the first terminal.

[0176] For the USIM card that has been initialized by the quantum key service card application, run the key injection process. The second terminal can be understood as the terminal corresponding to the USIM card that has been initialized by the quantum key service card application. After the quantum key service platform generates a quantum key for the second terminal, it can encrypt the quantum key based on the KEK, and then send a key acquisition response to the injection platform. The third message can be understood as a key acquisition response. The third message includes the SEID corresponding to the second terminal and the encrypted quantum key.

[0177] It can be seen from the above content that the embodiment of the present application receives a first message sent by a charging platform through a cryptographic service platform, the first message including a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the charging platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process; so as to realize the dual separation of terminal access rights (charging platform) and key management rights (cryptographic service platform), so that the charging platform cannot obtain the charged quantum key, which solves the problem in the related art that the charging platform can obtain the same full key as the quantum key service platform and cannot protect the security of the quantum key charging process.

[0178] In some embodiments of the present application, after receiving the second message sent by the cryptographic service platform, the method includes:

[0179] A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

[0180] In practical applications, the second key parameter can be understood as R_PKc generated by the quantum key service platform, and R_PKc can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends an initialization request to the charging platform, and the second message can be understood as an initialization request, and the second message includes the SEID and R_PKc corresponding to the first terminal.

[0181] After receiving the second message, the charging platform sends a fourth message to the quantum key service card application on each first terminal through SEID, requesting the quantum key service card application to initialize. After receiving the fourth message, the quantum key service card application generates a public-private key pair (SKc, PKc) and a public key verification code PKc_MAC, PKc_MAC = HMAC (KEK_i, PKc, SEID, R_PKc), and sends a fifth message to the charging platform in response to the initialization request of the charging platform. The fifth message may include SEID, R_PKc, PKc and PKc_MAC.

[0182] In some embodiments of the present application, after sending the fourth message to the first terminal, the method includes:

[0183] receiving a fifth message sent by the first terminal; the fifth message includes a first key parameter, a second key parameter and a third key parameter,

[0184] A sixth message is sent to the cryptographic service platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged by the first terminal.

[0185] In actual application, after the quantum key service card application on the first terminal receives the fourth message, it generates a public-private key pair (SKc, PKc) and a public key verification code PKc_MAC, PKc_MAC = HMAC (KEK_i, PKc, SEID, R_PKc), and sends the fifth message to the filling platform to respond to the initialization request of the filling platform. The fifth message may include SEID, R_PKc, PKc and PKc_MAC.

[0186] After receiving the fifth message, the charging platform sends a sixth message to the cryptographic service platform in response to the initialization request of the cryptographic service platform. The sixth message may include {SEID, QKN, R_PKc, PKc, PKc_MAC}_i, i=1,…,n.

[0187] In some embodiments of the present application, after sending the sixth message to the cryptographic service platform, the method includes:

[0188] receiving the seventh message or the eighth message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; the eighth message includes the encrypted first charging key and the fifth key parameter;

[0189] A ninth message is sent to the first terminal; the ninth message includes the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0190] In practical applications, after the cryptographic service platform saves the PKc of the first terminal, it generates the quantum key set QKs = {QK1, QK2, ..., QKn} of the first terminal and the corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn}. The first injection key can be understood as QKs.

[0191] The cryptographic service platform needs to determine whether to update the KEK of the first terminal, and the fourth key parameter can be understood as KEK. The cryptographic service platform updates the key encapsulation key at any time according to security needs, which is conducive to protecting and improving the security of quantum keys.

[0192] If so, a new KEK is randomly generated, and the new KEK is saved according to the SEID, and the updated KEK is encrypted to obtain the encrypted fourth key parameter EKEK=Epub(PKc, KEK). QKs is encrypted by the updated KEK to obtain the encrypted first filling key EQKs, and the first filling key verification code QKs_MAC is generated. The fifth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, EKEK, QKIDs, EQKs, ...). If not, QKs is encrypted by KEK to obtain EQKs and generate QKs_MAC, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). Among them, EQKs=E(KEK, QKs). The seventh message may include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n. The eighth message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n.

[0193] After receiving the seventh message, the charging platform sends a ninth message to the quantum key service card application on each first terminal through SEID, and the ninth message may include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}; after receiving the eighth message, the charging platform sends a ninth message to the quantum key service card application on each first terminal through SEID, and at this time, the ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0194] The quantum key service card application determines whether there is an EKEK for each SEID according to the ninth message. If there is, the EKEK needs to be decrypted to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0195] In some embodiments of the present application, after receiving the third message sent by the cryptographic service platform, the method includes:

[0196] A tenth message is sent to the second terminal; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0197] In actual applications, for each pair of (SEID, QKN)_i, the quantum key service platform can query from the database whether there is a public key PKc corresponding to the SEID, that is, confirm whether the quantum key service card application on the USIM card has completed initialization. The second terminal can be understood as the terminal corresponding to the USIM card that has been initialized by the quantum key service card application.

[0198] Run the key injection process for the USIM card that has been initialized by the quantum key service card application. Figure 4 As shown, the cryptographic service platform generates a quantum key set QKs = {QK1, QK2, ..., QKn} and a corresponding key identifier QKIDs = {QKID1, QKID2, ..., QKIDn} of the second terminal. The second injection key can be understood as QKs.

[0199] The cryptographic service platform needs to determine whether to update the KEK of the second terminal. The fourth key parameter can be understood as KEK. If so, a new KEK is randomly generated, and the new KEK is saved according to SEID. The updated KEK is encrypted to obtain the encrypted fourth key parameter EKEK=Epub(PKc, KEK). QKs is encrypted by the updated KEK to obtain the encrypted second filling key EQKs, and the second filling key verification code QKs_MAC is generated. The fifth key parameter can be understood as QKs_MAC, QKs_MAC=HMAC(SEID, EKEK, QKIDs, EQKs, ...). If not, QKs is encrypted by KEK to obtain EQKs, and QKs_MAC is generated, QKs_MAC=HMAC(SEID, KEK, QKIDs, EQKs, ...). Among them, EQKs=E(KEK, QKs). After generating QKs_MAC and QKs, the cryptographic service platform sends a third message to the charging platform. The third message may include {SEID, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}_i, i=1,…,n.

[0200] After receiving the third message, the charging platform sends the tenth message to the quantum key service card application on each second terminal through SEID. The tenth message may include {SEID, QKIDs, EQKs, QKs_MAC}, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}.

[0201] The quantum key service card application determines whether there is an EKEK for each SEID according to the tenth message. If there is, it needs to decrypt the EKEK to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0202] The embodiment of the present application provides a key injection method, which is applied to a terminal, referring to Figure 6 As shown, the method comprises the following steps:

[0203] Step S601: receiving the fourth message and / or the tenth message sent by the charging platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0204] In actual applications, for USIM cards that have not been initialized by the quantum key service card application, the initialization process is run, and the quantum key service platform generates a key parameter R_PKc, which can be a random number or a timestamp. After generating R_PKc, the quantum key service platform sends a second message to the charging platform, and the second message includes the SEID and R_PKc corresponding to the first terminal. After receiving the second message, the charging platform sends a fourth message to the quantum key service card application on each first terminal through the SEID, requesting the quantum key service card application to be initialized.

[0205] After receiving the third message, the charging platform sends the tenth message to the quantum key service card application on each second terminal through SEID. The tenth message may include {SEID, QKIDs, EQKs, QKs_MAC}, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}.

[0206] It can be seen from the above content that the embodiment of the present application receives a first message sent by a charging platform through a cryptographic service platform, the first message including a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; the cryptographic service platform sends a second message and / or a third message to the charging platform, the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process; so as to realize the dual separation of terminal access rights (charging platform) and key management rights (cryptographic service platform), so that the charging platform cannot obtain the charged quantum key, which solves the problem in the related art that the charging platform can obtain the same full key as the quantum key service platform and cannot protect the security of the quantum key charging process.

[0207] In some embodiments of the present application, after receiving the fourth message sent by the filling platform, the method includes:

[0208] generating a first key parameter and a third key parameter;

[0209] A fifth message is sent to the charging platform; the fifth message includes a first key parameter, a second key parameter and a third key parameter.

[0210] In actual applications, after the charging platform sends an initialization request instruction to the quantum key service card application on each first terminal through SEID, the quantum key service card application generates a public-private key pair (SKc, PKc) and a public key verification code PKc_MAC, PKc_MAC = HMAC (KEK_i, PKc, SEID, R_PKc). The first parameter key is PKc, and the third key parameter can be understood as a public key verification code.

[0211] A fifth message is sent to the charging platform in response to the initialization request of the charging platform. The fifth message may include SEID, R_PKc, PKc and PKc_MAC.

[0212] In some embodiments of the present application, after sending the fifth message to the filling platform, the method includes:

[0213] Receiving a ninth message sent by the charging platform; the ninth message includes the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter;

[0214] If the ninth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0215] verifying the fifth key parameter;

[0216] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the updated fourth key parameter to obtain the first charging key;

[0217] If the ninth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0218] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the fourth key parameter to obtain the first charging key;

[0219] Prime the first prime key.

[0220] In actual application, after receiving the seventh message, the charging platform sends the ninth message to the quantum key service card application on each first terminal through SEID, and the ninth message may include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}; after receiving the eighth message, the charging platform sends the ninth message to the quantum key service card application on each first terminal through SEID, and at this time, the ninth message may include {SEID, QKIDs, EQKs, QKs_MAC}.

[0221] The quantum key service card application determines whether there is an EKEK for each SEID according to the ninth message. If there is, the EKEK needs to be decrypted to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0222] In some embodiments of the present application, after receiving the tenth message sent by the filling platform, the method includes:

[0223] If the tenth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0224] verifying the fifth key parameter;

[0225] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the updated fourth key parameter to obtain the second charging key;

[0226] If the tenth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0227] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the fourth key parameter to obtain the second charging key;

[0228] Prime the second prime key.

[0229] In actual applications, after receiving the third message, the charging platform sends the tenth message to the quantum key service card application on each second terminal through SEID. The tenth message may include {SEID, QKIDs, EQKs, QKs_MAC}, and may also include {SEID, EKEK, QKIDs, EQKs, QKs_MAC}.

[0230] The quantum key service card application determines whether there is an EKEK for each SEID according to the tenth message. If there is, it needs to decrypt the EKEK to obtain a new KEK. The new KEK = Dpub (SKc, EKEK), after overwriting and saving the KEK, verify the legitimacy of QKs_MAC, and if QKs_MAC is legal, decrypt EQKs to obtain QKs, and then write QKs and the corresponding QKIDs to the local.

[0231] Based on the same inventive concept as above, Figure 7 A schematic diagram of the structure of a key injection device provided by an embodiment of the present invention, which is applied to a cryptographic service platform, includes:

[0232] The first receiving unit 701 is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0233] The first sending unit 702 is used to send a second message and / or a third message to the charging platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process.

[0234] In some embodiments of the present application, the apparatus further includes: a first processing unit, configured to determine a first terminal that does not include the first key parameter and / or a second terminal that includes the first key parameter in the terminal list.

[0235] In some embodiments of the present application, the first processing unit is further used to generate a second key parameter for the first terminal; and the second message includes the second key parameter.

[0236] In some embodiments of the present application, the first receiving unit 701 is further used to receive a sixth message sent by the charging platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

[0237] In some embodiments of the present application, the first processing unit is further used to verify the third key parameter;

[0238] When the third key parameter is verified to be legal, the first key parameter is saved.

[0239] In some embodiments of the present application, the first processing unit is further configured to generate a first charging key for the first terminal;

[0240] determining whether to update a fourth key parameter of the first terminal;

[0241] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0242] encrypting the first charging key based on the updated fourth key parameter to obtain an encrypted first charging key;

[0243] generating a fifth key parameter based on the updated fourth key parameter;

[0244] The first sending unit 702 is further used to send a seventh message to the charging platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter;

[0245] The first processing unit is further configured to, if no, encrypt the first charging key based on the fourth key parameter to obtain the encrypted first charging key;

[0246] generating a fifth key parameter based on the fourth key parameter;

[0247] The first sending unit 702 is further used to send an eighth message to the charging platform; the eighth message includes the encrypted first charging key and the fifth key parameter.

[0248] In some embodiments of the present application, the first processing unit is further configured to generate a second charging key for the second terminal;

[0249] determining whether to update a fourth key parameter of the second terminal;

[0250] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0251] encrypting the second charging key based on the updated fourth key parameter to obtain an encrypted second charging key;

[0252] generating a fifth key parameter based on the updated fourth key parameter; the third message includes the encrypted second charging key, the encrypted fourth key parameter and the fifth key parameter;

[0253] If not, encrypting the second charging key based on the fourth key parameter to obtain an encrypted second charging key;

[0254] A fifth key parameter is generated based on the fourth key parameter; and the third message includes the encrypted second charging key and the fifth key parameter.

[0255] In some embodiments of the present application, the first processing unit is further configured to set a first charging state of the first charging key and / or a second charging state of the second charging key.

[0256] Based on the same inventive concept as above, Figure 8 A schematic diagram of the structure of a key injection device provided by an embodiment of the present invention, which is applied to an injection platform, includes:

[0257] The second sending unit 801 is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0258] The second receiving unit 802 is used to receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key injection process.

[0259] In some embodiments of the present application, the second sending unit 801 is further used to send a fourth message to the first terminal; the fourth message includes the second key parameter.

[0260] In some embodiments of the present application, the second receiving unit 802 is further configured to receive a fifth message sent by the first terminal; the fifth message includes the first key parameter, the second key parameter, and the third key parameter;

[0261] The second sending unit 801 is further used to send a sixth message to the cryptographic service platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

[0262] In some embodiments of the present application, the second receiving unit 802 is further used to receive the seventh message or the eighth message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; the eighth message includes the encrypted first charging key and the fifth key parameter;

[0263] The second sending unit 801 is further used to send a ninth message to the first terminal; the ninth message includes the encrypted first injection key, the fifth key parameter and / or the encrypted fourth key parameter.

[0264] In some embodiments of the present application, the second sending unit 801 is further used to send a tenth message to the second terminal; the tenth message includes the encrypted second injection key, the fifth key parameter and / or the encrypted fourth key parameter.

[0265] Based on the same inventive concept as above, Fig. 9 A schematic diagram of the structure of a key injection device provided by an embodiment of the present invention, which is applied to a terminal, includes:

[0266] The third receiving unit 901 is used to receive the fourth message and / or the tenth message sent by the charging platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0267] In some embodiments of the present application, the device further includes: a second processing unit and a third sending unit; wherein the second processing unit is used to generate the first key parameter and the third key parameter;

[0268] The third sending unit is used to send a fifth message to the filling platform; the fifth message includes the first key parameter, the second key parameter and the third key parameter.

[0269] In some embodiments of the present application, the third receiving unit 901 is used to receive a ninth message sent by the charging platform; the ninth message includes the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter;

[0270] The second processing unit is further configured to, if the ninth message includes the encrypted fourth key parameter, decrypt the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0271] verifying the fifth key parameter;

[0272] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the updated fourth key parameter to obtain the first charging key;

[0273] If the ninth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0274] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the fourth key parameter to obtain the first charging key;

[0275] Prime the first prime key.

[0276] In some embodiments of the present application, the second processing unit is further configured to, if the tenth message includes an encrypted fourth key parameter, decrypt the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0277] verifying the fifth key parameter;

[0278] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the updated fourth key parameter to obtain the second charging key;

[0279] If the tenth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0280] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the fourth key parameter to obtain the second charging key;

[0281] Prime the second prime key.

[0282] Based on the hardware implementation of the above program modules, and in order to implement the method of the cryptographic service platform side of the embodiment of the present application, the embodiment of the present application also provides a cryptographic service platform, such as Fig.10 As shown, the cryptographic service platform 1000 includes:

[0283] The first communication interface 1001 is capable of exchanging information with the filling platform;

[0284] The first processor 1002 is connected to the first communication interface 1001 to implement information interaction with the charging platform, and is used to execute the method provided by one or more technical solutions of the cryptographic service platform side when running the computer program;

[0285] The first memory 1003 , on which the computer program is stored.

[0286] Specifically, the first communication interface 1001 is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0287] A second message and / or a third message is sent to the charging platform; the second message indicates the first terminal entering the initialization process; the third message indicates the second terminal entering the key charging process.

[0288] In some embodiments of the present application, the first processor 1002 is configured to determine a first terminal that does not include the first key parameter and / or a second terminal that includes the first key parameter in the terminal list.

[0289] In some embodiments of the present application, the first processor 1002 is configured to generate a second key parameter for the first terminal; and the second message includes the second key parameter.

[0290] In some embodiments of the present application, the first communication interface 1001 is used to receive a sixth message sent by the charging platform; the sixth message includes a first key parameter, a second key parameter, a third key parameter and the number of keys to be charged by the first terminal.

[0291] In some embodiments of the present application, the first processor 1002 is configured to verify the third key parameter;

[0292] When the third key parameter is verified to be legal, the first key parameter is saved.

[0293] In some embodiments of the present application, the first processor 1002 is configured to generate a first charging key for the first terminal;

[0294] determining whether to update a fourth key parameter of the first terminal;

[0295] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0296] encrypting the first charging key based on the updated fourth key parameter to obtain an encrypted first charging key;

[0297] generating a fifth key parameter based on the updated fourth key parameter;

[0298] The first communication interface 1001 is used to send a seventh message to the charging platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter;

[0299] If no, the first processor 1002 is configured to encrypt the first charging key based on the fourth key parameter to obtain an encrypted first charging key;

[0300] generating a fifth key parameter based on the fourth key parameter;

[0301] The first communication interface 1001 is used to send an eighth message to the charging platform; the eighth message includes the encrypted first charging key and the fifth key parameter.

[0302] In some embodiments of the present application, the first processor 1002 is further configured to generate a second charging key for the second terminal;

[0303] determining whether to update a fourth key parameter of the second terminal;

[0304] If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter;

[0305] encrypting the second charging key based on the updated fourth key parameter to obtain an encrypted second charging key;

[0306] generating a fifth key parameter based on the updated fourth key parameter;

[0307] The third message includes the encrypted second charging key, the encrypted fourth key parameter and the fifth key parameter;

[0308] If not, encrypting the second charging key based on the fourth key parameter to obtain an encrypted second charging key;

[0309] A fifth key parameter is generated based on the fourth key parameter; and the third message includes the encrypted second charging key and the fifth key parameter.

[0310] In some embodiments of the present application, the first processor 1002 is configured to set a first charging state of a first charging key and / or a second charging state of a second charging key.

[0311] Of course, in actual application, the various components in the cryptographic service platform 1000 are coupled together through the bus system 1004. It can be understood that the bus system 1004 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.10 Various buses are labeled as bus system 1004 .

[0312] The first memory 1003 in the embodiment of the present application is used to store various types of data to support the operation of the cryptographic service platform 1000. Examples of such data include: any computer program used to operate on the cryptographic service platform 1000.

[0313] The method disclosed in the above embodiment of the present application can be applied to the first processor 1002, or implemented by the first processor 1002. The first processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the first processor 1002 or an instruction in the form of software. The first processor 1002 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1002 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1003, and the first processor 1002 reads the information in the first memory 1003, and completes the steps of the above method in combination with its hardware.

[0314] In an exemplary embodiment, the cryptographic service platform 1000 can be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0315] Based on the hardware implementation of the above program modules, and in order to implement the method of the charging platform side of the embodiment of the present application, the embodiment of the present application also provides a charging platform, such as Fig.11 As shown, the filling platform 1100 includes:

[0316] The second communication interface 1101 is capable of exchanging information with the cryptographic service platform and the terminal;

[0317] The second processor 1102 is connected to the second communication interface 1101 to implement information interaction with the cryptographic service platform and the terminal, and is used to execute the method provided by one or more technical solutions of the charging platform side when running the computer program;

[0318] The second memory 1103 , on which the computer program is stored.

[0319] Specifically, the second communication interface 1101 is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list;

[0320] A second message and / or a third message sent by the cryptographic service platform is received; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

[0321] In some embodiments of the present application, the second communication interface 1101 is further used to send a fourth message to the first terminal; the fourth message includes the second key parameter.

[0322] In some embodiments of the present application, the second communication interface 1101 is further used to receive a fifth message sent by the first terminal; the fifth message includes the first key parameter, the second key parameter and the third key parameter;

[0323] A sixth message is sent to the cryptographic service platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged by the first terminal.

[0324] In some embodiments of the present application, the second communication interface 1101 is further used to receive the seventh message or the eighth message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; the eighth message includes the encrypted first charging key and the fifth key parameter;

[0325] A ninth message is sent to the first terminal; the ninth message includes the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0326] In some embodiments of the present application, the second communication interface 1101 is further used to send a tenth message to the second terminal; the tenth message includes the encrypted second injection key, the fifth key parameter and / or the encrypted fourth key parameter.

[0327] The method disclosed in the above embodiment of the present application can be applied to the second processor 1102, or implemented by the second processor 1102. The second processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the second processor 1102 or an instruction in the form of software. The second processor 1102 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1102 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1103, and the second processor 1102 reads the information in the second memory 1103, and completes the steps of the above method in combination with its hardware.

[0328] In an exemplary embodiment, the filling platform 1100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0329] Based on the hardware implementation of the above program modules, and in order to implement the method on the terminal side of the embodiment of the present application, the embodiment of the present application also provides a terminal, such as Fig.12 As shown, the terminal 1200 includes:

[0330] The third communication interface 1201 is capable of exchanging information with the filling platform;

[0331] The third processor 1202 is connected to the second communication interface 1201 to implement information interaction with the filling platform, and is used to execute the method provided by one or more technical solutions on the terminal side when running the computer program;

[0332] The third memory 1203 , on which the computer program is stored.

[0333] Specifically, the third communication interface 1201 is used to receive the fourth message and / or the tenth message sent by the charging platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

[0334] In some embodiments of the present application, the third processor 1202 is configured to generate a first key parameter and a third key parameter;

[0335] The third communication interface 1201 is used to send a fifth message to the charging platform; the fifth message includes a first key parameter, a second key parameter and a third key parameter.

[0336] In some embodiments of the present application, the third communication interface 1201 is used to receive a ninth message sent by the charging platform; the ninth message includes the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter;

[0337] The third processor 1202 is configured to decrypt the encrypted fourth key parameter to obtain an updated fourth key parameter if the ninth message includes the encrypted fourth key parameter;

[0338] verifying the fifth key parameter;

[0339] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the updated fourth key parameter to obtain the first charging key;

[0340] If the ninth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0341] When the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the fourth key parameter to obtain the first charging key;

[0342] Prime the first prime key.

[0343] In some embodiments of the present application, the third processor 1202 is configured to, if the tenth message includes the encrypted fourth key parameter, decrypt the encrypted fourth key parameter to obtain an updated fourth key parameter;

[0344] verifying the fifth key parameter;

[0345] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the updated fourth key parameter to obtain the second charging key;

[0346] If the tenth message does not include the encrypted fourth key parameter, verifying the fifth key parameter;

[0347] When the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the fourth key parameter to obtain the second charging key;

[0348] Prime the second prime key.

[0349] It can be understood that the memory (first memory 1003, second memory 1103, third memory 1203) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache.By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0350] Based on the above embodiments, the embodiments of the present application provide a storage medium, wherein the storage medium stores computer executable instructions, and the computer executable instructions are configured to execute Figure 1 or Figure 5 or Figure 6 The corresponding embodiment provides a key injection method.

[0351] Based on the above embodiments, the embodiments of the present application further provide a computer product, including a computer program, which is executed by a processor to implement Figure 1 or Figure 5 or Figure 6 The corresponding embodiments provide steps in the key injection method.

[0352] It should be noted that the above-mentioned computer storage medium can be a memory such as ROM, PROM, EPROM, EEPROM, FRAM, FlashMemory, magnetic surface storage, optical disk, or CD-ROM; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0353] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0354] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0355] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a first network device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0356] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0357] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0358] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0359] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A key filling method, characterized in that: Applied to a cryptographic service platform, the method comprises: Receive a first message sent by a charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

2. The method according to claim 1, characterized in that Before sending the second message and / or the third message to the filling platform, the method includes: It is determined that the first terminal that does not include the first key parameter and / or the second terminal that includes the first key parameter is included in the terminal list.

3. The method according to claim 2, characterized in that After determining that the terminal list does not include the first terminal having the first key parameter, the method further includes: A second key parameter of the first terminal is generated; and the second message includes the second key parameter.

4. The method according to claim 3, characterized in that After sending the second message to the filling platform, the method includes: Receive a sixth message sent by the charging platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged to the first terminal.

5. The method according to claim 4, characterized in that After receiving the sixth message sent by the filling platform, the method further comprises: verifying the third key parameter; When the third key parameter is verified to be legal, the first key parameter is saved.

6. The method according to claim 5, characterized in that After the first key parameter is saved, the method further comprises: generating a first charging key for the first terminal; determining whether to update a fourth key parameter of the first terminal; If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter; encrypting the first charging key based on the updated fourth key parameter to obtain an encrypted first charging key; generating a fifth key parameter based on the updated fourth key parameter; Sending a seventh message to the charging platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; If not, encrypting the first charging key based on the fourth key parameter to obtain an encrypted first charging key; generating a fifth key parameter based on the fourth key parameter; An eighth message is sent to the filling platform; the eighth message includes the encrypted first filling key and the fifth key parameter.

7. The method according to claim 2, characterized in that: After determining the second terminal including the first key parameter in the terminal list, the method further comprises: generating a second charging key for the second terminal; determining whether to update a fourth key parameter of the second terminal; If so, update the fourth key parameter, save the updated fourth key parameter and encrypt the updated fourth key parameter to obtain an encrypted fourth key parameter; encrypting the second charging key based on the updated fourth key parameter to obtain an encrypted second charging key; generating a fifth key parameter based on the updated fourth key parameter; the third message comprising the encrypted second charging key, the encrypted fourth key parameter and the fifth key parameter; If not, encrypting the second charging key based on the fourth key parameter to obtain an encrypted second charging key; A fifth key parameter is generated based on the fourth key parameter; and the third message includes the encrypted second charging key and the fifth key parameter.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: The first charging state of the first charging key and / or the second charging state of the second charging key are set.

9. A key filling method, characterized in that: Applied to a charging platform, the method comprises: Sending a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an initialization process; the third message indicates a second terminal entering a key injection process.

10. The method according to claim 9, characterized in that After receiving the second message sent by the cryptographic service platform, the method includes: A fourth message is sent to the first terminal; the fourth message includes a second key parameter.

11. The method according to claim 10, characterized in that After the sending the fourth message to the first terminal, the method includes: receiving a fifth message sent by the first terminal; the fifth message includes a first key parameter, a second key parameter, and a third key parameter; Sending a sixth message to the cryptographic service platform; the sixth message includes the first key parameter, the second key parameter, the third key parameter and the number of keys to be charged in the first terminal.

12. The method according to claim 11, characterized in that After the sixth message is sent to the cryptographic service platform, the method further comprises: receiving a seventh message or an eighth message sent by the cryptographic service platform; the seventh message includes the encrypted first charging key, the encrypted fourth key parameter and the fifth key parameter; the eighth message includes the encrypted first charging key and the fifth key parameter; Sending a ninth message to the first terminal; the ninth message includes the encrypted first injection key, the fifth key parameter and / or the encrypted fourth key parameter.

13. The method according to claim 9, characterized in that After receiving the third message sent by the cryptographic service platform, the method further comprises: A tenth message is sent to the second terminal; the tenth message includes the encrypted second charging key, the fifth key parameter and / or the encrypted fourth key parameter.

14. A key filling method, characterized in that: Applied to a terminal, the method comprises: Receive the fourth message and / or the tenth message sent by the filling platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second filling key, the fifth key parameter and / or the encrypted fourth key parameter.

15. The method according to claim 14, characterized in that After receiving the fourth message sent by the filling platform, the method further comprises: generating a first key parameter and a third key parameter; A fifth message is sent to the filling platform; the fifth message includes the first key parameter, the second key parameter and the third key parameter.

16. The method according to claim 15, characterized in that After sending the fifth message to the filling platform, the method further comprises: receiving a ninth message sent by the charging platform; the ninth message comprising the encrypted first charging key, the fifth key parameter and / or the encrypted fourth key parameter; If the ninth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter; verifying the fifth key parameter; In the case where the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the updated fourth key parameter to obtain the first charging key; If the ninth message does not include the encrypted fourth key parameter, verifying the fifth key parameter; In the case where the fifth key parameter is verified to be legal, decrypting the encrypted first charging key based on the fourth key parameter to obtain the first charging key; The first charging key is charged.

17. The method according to claim 13, characterized in that After receiving the tenth message sent by the charging platform, the method further comprises: If the tenth message includes the encrypted fourth key parameter, decrypting the encrypted fourth key parameter to obtain an updated fourth key parameter; verifying the fifth key parameter; In the case where the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the updated fourth key parameter to obtain the second charging key; If the tenth message does not include the encrypted fourth key parameter, verifying the fifth key parameter; In the case where the fifth key parameter is verified to be legal, decrypting the encrypted second charging key based on the fourth key parameter to obtain the second charging key; The second charging key is charged.

18. A cryptographic service platform, comprising a first communication interface and a first processor; wherein: The first communication interface is used to receive a first message sent by the charging platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; A second message and / or a third message is sent to the injection platform; the second message indicates a first terminal entering an initialization process; and the third message indicates a second terminal entering a key injection process.

19. A filling platform, comprising a second communication interface and a second processor; wherein: The second communication interface is used to send a first message to the cryptographic service platform; the first message includes a list of terminals to be charged and the number of keys to be charged for each terminal in the terminal list; Receive a second message and / or a third message sent by the cryptographic service platform; the second message indicates a first terminal entering an initialization process; the third message indicates a second terminal entering a key injection process.

20. A terminal comprising a third communication interface and a third processor; wherein: The third communication interface is used to receive the fourth message and / or the tenth message sent by the filling platform; the fourth message includes the second key parameter; the tenth message includes the encrypted second filling key, the fifth key parameter and / or the encrypted fourth key parameter.

21. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8, 9 to 13, or 14 to 17 are implemented.

22. A computer product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8, 9 to 13, or 14 to 17 are implemented.

Images