Key distribution method

Abstract

The invention discloses a secret key distribution method, which is used for solving the problem of low secret key distribution security. The scheme provided by the invention comprises the following steps: acquiring a first hash value by home terminal equipment, wherein the first hash value is obtained by performing hash operation on a randomly generated first character string; determining a transmission mode of an initial secret key pool from at least two transmission modes based on the first hash value and first information; wherein the first information comprises at least one of the hardware value information of the super SIM card in the home terminal device and the hardware value information of the super SIM card in the opposite terminal device; and completing the distribution of the initial key pool with the opposite terminal device based on the determined transmission mode.

Description

Technical Field

[0001] The present application relates to the technical field of key distribution, and in particular to a key distribution method. Background Art

[0002] Key distribution is the process of exchanging secret keys between the local device and the peer device. The main purpose of key distribution is to ensure confidentiality and data integrity during the communication process to prevent unauthorized access and data tampering. The key distribution method in the related art has the problem of low security. Therefore, how to improve the security of key distribution is the technical problem to be solved by this application. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a key distribution method to solve the problem of low security of key distribution.

[0004] In a first aspect, a key distribution method is provided, which is applied to a local device, including: obtaining a first hash value, which is obtained by performing a hash operation on a randomly generated first character string; based on the first hash value and first information, determining a transmission method of an initial key pool from at least two transmission methods; wherein the first information includes at least one of hardware value information of a super SIM card in the local device and hardware value information of a super SIM card in a peer device; and based on the determined transmission method, completing the distribution of the initial key pool with the peer device.

[0005] In a second aspect, an electronic device is provided, which is a local device and includes: an acquisition module for acquiring a first hash value, wherein the first hash value is obtained by performing a hash operation on a randomly generated first character string; a processing module for determining a transmission mode of an initial key pool from at least two transmission modes based on the first hash value and first information; wherein the first information includes at least one of hardware value information of a super SIM card in the local device and hardware value information of a super SIM card in a peer device; and a communication module for completing the distribution of the initial key pool with the peer device based on the determined transmission mode.

[0006] According to a third aspect, an electronic device is provided. The electronic device comprises a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method according to the first aspect are implemented.

[0007] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method according to the first aspect are implemented.

[0008] In a fifth aspect, a computer program product is provided, the computer program product comprising a non-transitory computer-readable storage medium storing a computer program, the computer program being operable to cause a computer to execute part or all of the steps of the method of the first aspect.

[0009] In an embodiment of the present application, a hash operation is performed on a randomly generated first character string to obtain a first hash value, and a transmission method of the initial key pool is determined based on the first hash value and the hardware value information of the super SIM card. The transmission method of the initial key pool is related to the hardware value information of the super SIM card and the randomly generated character string, which is conducive to increasing the difficulty of initial monitoring and improving the security of key distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A schematic diagram showing a flow chart of a key distribution method provided in an embodiment of the present application; Figure 2 A schematic diagram showing a flow chart of a key distribution method provided in an embodiment of the present application; Figure 3 A schematic diagram showing a flow chart of a key distribution method provided in an embodiment of the present application; Figure 4 A schematic diagram showing a flow chart of a key distribution method provided in an embodiment of the present application; Figure 5 A schematic diagram showing the structure of an electronic device provided in an embodiment of the present application is shown; Figure 6 A schematic diagram of the hardware structure of an electronic device for executing the key distribution method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0012] Figure 1A schematic diagram of a key distribution method provided by an embodiment of the present application is shown, and the method can be executed by a local device, such as a terminal device or a server device, and the local device can communicate with a peer device. Figure 1 As shown, the method may include the following steps.

[0013] S102: Obtain a first Hash value, where the first Hash value is obtained by performing a Hash operation on a first randomly generated character string.

[0014] In one embodiment, Figure 2 As shown, the local device can generate a first string, wherein the first string is randomly generated, and the first string can be a Reed-Solomon code (RS code) or the like; the local device performs a hash operation on the first string to obtain a first hash value, and transmits it to the opposite device through a public channel. In this step, the local device obtains the first hash value, including: the local device performs a hash operation on the first string randomly generated by itself to obtain the first hash value.

[0015] In another embodiment, the peer device may generate a first string, wherein the first string is randomly generated, and the first string may be an RS code, etc.; the peer device performs a hash operation on the first string to obtain a first hash value, and transmits the first hash value to the local device through a public channel. In this step, the local device obtains the first hash value, including: the local device receives the first hash value from the peer device.

[0016] S104: Based on the first hash value and the first information, determine the transmission method of the initial key pool from at least two transmission methods; wherein the first information includes at least one of the hardware value information of the super subscriber identity module (Subscriber Identity Module, SIM) card in the local device and the hardware value information of the super SIM card in the opposite device.

[0017] In this embodiment, both the local device and the opposite device are equipped with super SIM cards. The local device and the opposite device can exchange encrypted information, so that the local device can obtain the hardware value information of the super SIM card in the opposite device; the opposite device can obtain the hardware value information of the super SIM card in the local device.

[0018] In one embodiment, the local device can determine the transmission mode of the initial key pool from at least two transmission modes based on the first hash value and the first information, using a formula pre-agreed between the local device and the opposite device. For example, the agreed formula is: Select=Calculate(dispersion factor 1, dispersion factor 2, hash). Dispersion factor 1 is the hardware value information of the super SIM card in the local device, and the hardware value information may include at least one of the following: integrated circuit card identifier (ICCID); security element identifier (SEID), etc. Dispersion factor 2 is the hardware value information of the super SIM card in the opposite device, and the hardware value information may include at least one of the following: ICCID; SEID, etc. Hash in the formula represents the first hash value. Select in the formula represents the determined transmission mode of the initial key pool.

[0019] like Figure 2 As shown, the opposite device can also adopt the same method as the local device to determine the transmission method of the initial key pool from at least two transmission methods based on the first hash value and the first information, so that the transmission methods of the initial key pool determined by the local device and the opposite device are the same.

[0020] In one embodiment, the transmission method determined includes: 1) using an initial key pool distribution method based on a super SIM card and quantum communication; or, 2) a measurement device independent quantum key distribution (MDI-QKD) method. The above two transmission methods can achieve lossless transmission of quantum keys and ensure highly reliable and secure key distribution through the principle of quantum entanglement.

[0021] S106: Based on the determined transmission mode, the initial key pool is distributed with the opposite device.

[0022] The key distribution method provided in the embodiment of the present application performs a hash operation on a randomly generated first character string to obtain a first hash value, and determines a transmission method of an initial key pool based on the first hash value and the hardware value information of the super SIM card. The transmission method of the initial key pool is related to the hardware value information of the super SIM card and the randomly generated character string, which is conducive to increasing the difficulty of initial monitoring and improving the security of key distribution.

[0023] The key distribution method provided in the embodiment of the present application can be applied to high-security key exchange scenarios in government and enterprises, within groups, and financial-related industries, as well as secure and trusted products, such as trusted 5G calls, trusted 5G messages, trusted text messages, etc., and has high commercial value.

[0024] In one embodiment, the transmission method determined by the local device and the opposite device includes: using an initial key pool distribution method based on a super SIM card and quantum communication. Figure 3 As shown, the distribution of the initial key pool with the opposite device based on the determined transmission mode includes: 1) The local device (referred to as A) uses the public key (publicKeyB) of the super SIM card in the peer device (referred to as B) to encrypt the first character string to obtain a first ciphertext (encryptData).

[0025] In this embodiment, the first character string may be randomly generated by the local device.

[0026] 2) A performs a binary operation on the first ciphertext to obtain a first bit of data (byteData0), and sends the first bit of data (byteData0) to the peer device using a single photon signal.

[0027] The peer device is also used to receive the second bit of data (byteData1); the peer device is also used to use the private key (privateKeyB) of its own super SIM card to decrypt the received second bit of data to obtain the first decrypted data (decryptData1); perform a hash operation on the first decrypted data to obtain a second hash value; and when the second hash value is the same as the first hash value, it means that the transmission process has not been monitored, and the first string can be used as the initial key pool. At this time, the peer device can also notify the local device through a public channel to use the first string as the initial key pool.

[0028] In one embodiment, the method further includes: the local device receives the first information from the opposite device; and when it is determined based on the first information that the second hash value is different from the first hash value, jumps to the step of obtaining the first hash value. Since the second hash value is different from the first hash value, it means that the first string may be tampered with or intercepted, and the data is incomplete and wrong. Therefore, the local device can discard the initial key pool with the opposite device, that is, the first string will not be used as the initial key pool. At this time, the opposite device can also notify the local device through a public channel to jump back to S102 and re-distribute the initial key pool to improve security.

[0029] In any of the above embodiments, the method further includes: storing the initial key pool in the auxiliary security domain of the super SIM card in the local device for subsequent encrypted communication, so that the local device and the opposite device complete the transmission of the initial key pool.

[0030] The above initial key pool distribution method based on super SIM card and quantum communication realizes the integration of super SIM card + quantum communication technology, and uses single-photon signal to send the first bit of data to the other device, avoiding the data verification waste in key distribution technology and reducing the amount of data transmitted; at the same time, the principle of quantum entanglement can realize the lossless transmission of quantum keys and ensure the highly reliable and secure distribution of keys, reducing the risk of eavesdropping and improving the security of key distribution.

[0031] In addition, the initial secret key is stored in the auxiliary security domain of the super SIM card and will not be removed from the card, further improving the security of key distribution.

[0032] In one embodiment, the transmission mode determined by the local device and the opposite device includes: MDI-QKD mode. Figure 4 As shown, the distribution of the initial key pool with the opposite device based on the determined transmission mode includes: repeatedly performing the following steps to obtain the initial key pool: 1) Modulating a one-bit photon based on a randomly selected polarization basis, and sending the photon to a third party E through a quantum channel; wherein the peer device is used to modulate a one-bit photon based on a randomly selected polarization basis, and send the photon to the third party through a quantum channel.

[0033] 2) When it is determined that the third party obtains a successful measurement result and the polarization base selected by the local device is the same as the polarization base selected by the opposite end, retain the bit.

[0034] By performing the above steps multiple times, the reserved multiple bits can be used as the initial key pool.

[0035] In the preparation of the quantum state, the key is encoded in the relative phase. In this embodiment, the local device and the opposite device can randomly select polarization bases x, y∈{0,1,...M-1} from a variety of polarization bases, and modulate the corresponding one-bit photons a, b∈{0,1} to prepare a coherent state, and send the photons to a third party through a quantum channel. In this embodiment, the local device and the opposite device can use the polarization base x=0 (y=0) as the key base and the base x>=1 (y>=1) as the test base.

[0036] The third party receives the photons sent by the local device and the opposite device, and after a 50:50 BS quantum interference, it directs the output pulse to two single-photon detectors and announces the Bell state measurement result z∈{Q + ,Q _ ,J},J represents an erroneous measurement result. For a successful measurement result Q + or Q _, the local device and the peer device can announce their respective selected polarization bases, and when they choose the same polarization base x=y=v, the corresponding bits are reserved. In addition, if the third party announces the measurement result as Q _ , the local device or the other device can flip its bits.

[0037] The above steps 1) and 2) can be repeated multiple times. When the local device and the opposite device select the same polarization basis y, the local device and the opposite device can also sacrifice some bits to estimate the success probability P of Bell state measurement. y succ , and the corresponding quantum bit error rate e y succ , where succ∈{Q + ,Q _} to improve the accuracy of the obtained key pool.

[0038] Optionally, the local device and the peer device may also perform error correction and confidentiality amplification steps to extract a final initial key pool.

[0039] In any one of the embodiments of the above MDI-QKD method, the method further includes: storing the initial key pool in the auxiliary security domain of the super SIM card in the local device for subsequent encrypted communication, at which point the local device and the opposite device complete the transmission of the initial key pool.

[0040] The above MDI-QKD method, through the integration of MDI-QKD and super SIM card capabilities, distributes a key pool as the key pool for generating encryption keys for each subsequent interaction, thereby improving the security of key distribution.

[0041] Based on any one of the above embodiments, after completing the distribution of the initial key pool, the method also includes: the local device selects an encryption key from the initial key pool; uses the encryption key to encrypt the original data to obtain a second ciphertext; and sends the second ciphertext and key description information of the encryption key to the opposite device.

[0042] This embodiment is described from the perspective of the sender, and the following embodiment will be described from the perspective of the receiver.

[0043] Based on any one of the above embodiments, after completing the distribution of the initial key pool, the method also includes: receiving a third ciphertext and key description information of the encryption key of the third ciphertext; determining a decryption key based on the key description information and the initial key pool; and decrypting the third ciphertext based on the decryption key.

[0044] The key description information in the above two embodiments may include: the starting position of the character string in the initial key pool and the key length.

[0045] Optionally, when all the keys in the initial key pool are used up, jump to the step of obtaining the first hash value.

[0046] In a specific embodiment, the ciphertext sender (such as the local device) uses the offset position in the key pool in the super SIM card as the starting point, and uses the random length as the key length to read the required encryption key (PrivateKey) in order, encrypts the original data, and records the key description information: starting position n, key length l (the key string from n to l will be marked as no longer used); the ciphertext sender sends the ciphertext + key description information (n, l) to the ciphertext receiver, and the ciphertext receiver reads the specified starting position n from the super SIM card according to the key description information, and calculates the string of l characters thereafter as the decryption key (the key string from n to l will be marked as no longer used). This cycle is repeated until all the keys in the key pool are used up and marked as no longer used, and then the initial key pool is redistributed.

[0047] Figure 5 The following is a schematic diagram of the structure of an electronic device 500 provided in an embodiment of the present application. The electronic device 500 is a local device and includes the following modules: The acquisition module 502 is used to acquire a first Hash value, where the first Hash value is obtained by performing a Hash operation on a randomly generated first character string.

[0048] The processing module 504 is used to determine the transmission mode of the initial key pool from at least two transmission modes based on the first hash value and the first information; wherein the first information includes at least one of the hardware value information of the super SIM card in the local device and the hardware value information of the super SIM card in the opposite device.

[0049] The communication module 506 is used to complete the distribution of the initial key pool with the opposite device based on the determined transmission mode.

[0050] In an embodiment of the present application, a hash operation is performed on a randomly generated first character string to obtain a first hash value, and a transmission method of the initial key pool is determined based on the first hash value and the hardware value information of the super SIM card. The transmission method of the initial key pool is related to the hardware value information of the super SIM card and the randomly generated character string, which is conducive to increasing the difficulty of initial monitoring and improving the security of key distribution.

[0051] In one embodiment, the determined transmission method includes: using an initial key pool distribution method based on a super SIM card and quantum communication; or, an MDI-QKD method.

[0052] In one embodiment, the communication module 506 is used to encrypt the first string using the public key of the super SIM card in the peer device to obtain a first ciphertext; perform a binary operation on the first ciphertext to obtain a first bit of data, and send the first bit of data to the peer device using a single photon signal; wherein the peer device is also used to decrypt the received second bit of data using the private key of the super SIM card to obtain first decrypted data; perform a hash operation on the first decrypted data to obtain a second hash value; and when the second hash value is the same as the first hash value, use the first string as the initial key pool.

[0053] In one embodiment, the communication module 506 is further configured to receive first information from the opposite device; and trigger the acquisition module 502 when it is determined based on the first information that the second hash value is different from the first hash value.

[0054] In one embodiment, the communication module 506 is used to repeatedly perform the following steps to obtain the initial key pool: modulate a one-bit photon based on a randomly selected polarization basis, and send the photon to a third party through a quantum channel; wherein the peer device is used to modulate a one-bit photon based on a randomly selected polarization basis, and send the photon to a third party through a quantum channel; when it is determined that the third party obtains a successful measurement result and the polarization basis selected by the local device is the same as the polarization basis selected by the peer device, retain the bit.

[0055] In one embodiment, the processing module 504 is configured to store the initial key pool in the auxiliary security domain of the super SIM card in the local device.

[0056] In one embodiment, the communication module 506 is further used to select an encryption key from the initial key pool; use the encryption key to encrypt the original data to obtain a second ciphertext; and send the second ciphertext and key description information of the encryption key to the peer device.

[0057] In one embodiment, the communication module 506 is further used to receive a third ciphertext and key description information of an encryption key of the third ciphertext; determine a decryption key based on the key description information and the initial key pool; and decrypt the third ciphertext based on the decryption key.

[0058] In one embodiment, the key description information includes: the starting position of the character string in the initial key pool and the key length.

[0059] In one embodiment, the communication module 506 is further configured to trigger the acquisition module 502 when all the keys in the initial key pool are used up.

[0060] The electronic device 500 provided in the embodiment of the present application can execute any embodiment described in the aforementioned method embodiment and realize the functions and beneficial effects of any embodiment described in the aforementioned method embodiment, which will not be described in detail here.

[0061] Among them, the above modules in the electronic device provided by the embodiment of the present application can also implement the method steps provided by the above method embodiment. Alternatively, the electronic device provided by the embodiment of the present application can also include other modules in addition to the above modules to implement the method steps provided by the above method embodiment. And the electronic device provided by the embodiment of the present application can achieve the technical effects that can be achieved by the above method embodiment.

[0062] An embodiment of the present application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned key distribution embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0063] Figure 6 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device includes a processor, and may also include an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0064] The processor, network interface and memory can be interconnected through an internal bus, which can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0065] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0066] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a device for locating the target user at the logical level. The processor executes the program stored in the memory and is specifically used to execute: Figure 1-4 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0067] The above application Figure 1-4 The method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or instructions in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0068] The electronic device can also execute any embodiment described in the aforementioned method embodiment, and realize the functions and beneficial effects of any embodiment described in the aforementioned method embodiment, which will not be repeated here.

[0069] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0070] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned key distribution method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0071] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to execute part or all of the steps of the above-mentioned key distribution method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0072] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0073] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0075] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0076] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0077] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0078] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0079] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0080] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0081] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A key distribution method, characterized in that: Applied to local devices, including: Obtaining a first Hash value, where the first Hash value is obtained by performing a Hash operation on a randomly generated first character string; Based on the first hash value and the first information, determining a transmission mode of the initial key pool from at least two transmission modes; wherein the first information includes at least one of hardware value information of the super user identity module SIM card in the local device and hardware value information of the super SIM card in the opposite device; Based on the determined transmission mode, the initial key pool is distributed with the opposite device.

2. The method according to claim 1, characterized in that The determined transmission mode includes: Use the initial key pool distribution method based on super SIM card and quantum communication; or, Measurement device independent quantum key distribution MDI-QKD method.

3. The method according to claim 2, characterized in that The distributing the initial key pool with the peer device based on the determined transmission mode includes: Encrypt the first character string using the public key of the super SIM card in the peer device to obtain a first ciphertext; Performing a binary operation on the first ciphertext to obtain a first bit of data, and sending the first bit of data to the opposite-end device using a single-photon signal; Among them, the opposite end device is also used to use the private key of the super SIM card to decrypt the received second bit data to obtain the first decrypted data; perform a hash operation on the first decrypted data to obtain a second hash value; and when the second hash value is the same as the first hash value, use the first character string as the initial key pool.

4. The method according to claim 3, characterized in that The method further comprises: Receiving first information from the opposite device; If it is determined based on the first information that the second hash value is different from the first hash value, the process jumps to the step of obtaining the first hash value.

5. The method according to claim 2, characterized in that: The step of distributing the initial key pool with the peer device based on the determined transmission mode includes: repeatedly performing the following steps to obtain the initial key pool: Modulating a one-bit photon based on a randomly selected polarization basis, and sending the photon to a third party through a quantum channel; wherein the peer device is used to modulate a one-bit photon based on a randomly selected polarization basis, and send the photon to a third party through a quantum channel; When it is determined that the third party obtains a successful measurement result and the polarization base selected by the local device is the same as the polarization base selected by the opposite end, the bit is retained.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: The initial key pool is stored in the auxiliary security domain of the super SIM card in the local device.

7. The method according to claim 1, characterized in that The method further comprises: Selecting an encryption key from the initial key pool; Encrypt the original data using the encryption key to obtain a second ciphertext; Send the second ciphertext and key description information of the encryption key to the peer device.

8. The method according to claim 1, characterized in that The method further comprises: Receiving a third ciphertext and key description information of an encryption key of the third ciphertext; Determine a decryption key based on the key description information and the initial key pool; The third ciphertext is decrypted based on the decryption key.

9. The method according to claim 7 or 8, characterized in that: The key description information includes: the starting position of the character string in the initial key pool and the key length.

10. The method according to claim 9, characterized in that When all the keys in the initial key pool are used up, jump to the step of obtaining the first hash value.

Images