Session key generation method and related device

Abstract

The invention discloses a session key generation method and a related device, and relates to the technical field of quantum encryption. When the first SIM card needs to perform information interaction with the second SIM card, a private key team and a public key team can be generated, and the first SIM card is pre-configured with a mixed key encapsulation algorithm, so that the public key team comprises a public key capable of resisting quantum attacks, and after the public key team is sent to the second SIM card, the private key team and the public key team can resist quantum attacks. And the second SIM card can generate key generation information by using an encapsulation algorithm in the mixed key encapsulation algorithm, encrypt the key generation information by using the public key team to obtain ciphertext information, and send the ciphertext information to the first SIM card, so that the first SIM card can decrypt the ciphertext information by using the private key team to obtain the key generation information. Therefore, the session key is obtained.

Description

Technical Field

[0001] The present invention belongs to the technical field of quantum encryption, and in particular to a session key generation method and related devices. Background Art

[0002] Quantum computers are physical devices that follow the laws of quantum mechanics to perform high-speed mathematical and logical operations, store and process quantum information. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Quantum computers have become a key technology under research because they have the ability to process mathematical problems more efficiently than ordinary computers. For example, they can speed up the time to crack RSA keys from hundreds of years to a few hours.

[0003] That is, with the development of quantum technology, current quantum computing technology is developing rapidly, and quantum computers have been proven to be able to pose a threat to current encryption systems within a limited time. Therefore, traditional protection schemes may not be able to effectively protect the information transmission process. Summary of the invention

[0004] The purpose of the present invention is to provide a session key generation method and related devices. Since a PQC module is added to a SIM card, the SIM card can have the ability to resist quantum attacks during the key encapsulation process. At the same time, combined with SM2 (classical symmetric encryption), the key encapsulation process for the SIM card can be more secure, which helps to improve the security of the SIM card during the interaction process.

[0005] In a first aspect, an embodiment of the present application provides a session key generation method, which is applied to a first SIM card, wherein the first SIM card is pre-configured with a hybrid key encapsulation algorithm, wherein the hybrid key encapsulation algorithm includes at least two key generation algorithms, wherein the at least two key generation algorithms include a key generation algorithm belonging to a post-quantum key algorithm; in response to detecting a connection interaction instruction with a second SIM card, a private key team and a public key team are generated using the at least two key generation algorithms; and the public key team is sent to the second SIM card; wherein the second SIM card is also pre-configured with the hybrid key encapsulation algorithm, wherein the second SIM card is used to generate key generation information corresponding to a session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and to encrypt the key generation information using the public key team to obtain ciphertext information, and to return the ciphertext information to the first SIM card; after receiving the ciphertext information, the ciphertext information is decrypted using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm to obtain the key generation information, and the session key is generated using the key generation information.

[0006] Optionally, the first SIM card includes a random number generation unit, and the generation of the private key team and the public key team using the at least two key generation algorithms includes: generating the at least two random numbers using the random number generation unit; generating the private key team and the public key team based on the at least two key generation algorithms and the at least two random numbers.

[0007] Optionally, the at least two key generation algorithms include a first post-quantum generation algorithm and a second national secret generation algorithm, and the generating of the at least two random numbers using the random number generation unit includes: generating a first random number and a second random number using the random number generation unit;

[0008] Correspondingly, the above-mentioned generation of the private key team and the public key team based on the above-mentioned at least two key generation algorithms and at least two random numbers includes: generating a first quantum private key and a first quantum public key based on the above-mentioned first random number and the above-mentioned first post-quantum generation algorithm; generating a second classical private key and a second classical public key based on the above-mentioned second random number and the above-mentioned second national secret generation algorithm; generating the above-mentioned private key team based on the above-mentioned first quantum private key and the above-mentioned second classical private key, and generating the above-mentioned public key team based on the above-mentioned first quantum public key and the above-mentioned second classical public key.

[0009] Optionally, the second SIM card also includes a random number generation unit, and the second SIM card is used to generate the key generation information in the following manner:

[0010] The random number generation unit is used to generate a third random number and a fourth random number; based on the third random number and the encapsulation algorithm in the hybrid key encapsulation algorithm, a first quantum key is generated; based on the first quantum key and the fourth random number, the key generation information is obtained.

[0011] Optionally, the second SIM card is used to encrypt the key generation information in the following manner to obtain ciphertext information:

[0012] The first quantum key is encrypted using the first quantum public key and the encapsulation algorithm to obtain first sub-ciphertext information; the fourth random number is encrypted using the second classical public key and the encapsulation algorithm to obtain second sub-ciphertext information; and the ciphertext information is generated based on the first sub-ciphertext information and the second sub-ciphertext information.

[0013] Optionally, the decrypting the ciphertext information using the private key team and the decryption algorithm in the hybrid key encapsulation algorithm to obtain the key generation information includes:

[0014] The first sub-ciphertext information is decrypted using the first quantum private key and the decryption algorithm to obtain the first quantum key; the second sub-ciphertext information is decrypted using the second classical private key and the decryption algorithm to obtain the fourth random number; based on the first quantum key and the fourth random number, the key generation information is obtained.

[0015] Optionally, the generating a session key using the key generation information includes:

[0016] The first quantum key and the fourth random number are processed based on the SM3 hash key generation algorithm to generate the session key; wherein the second SIM card is also used to process the first quantum key and the fourth random number based on the SM3 hash key generation algorithm to generate the session key.

[0017] Optionally, the SIM card is one of a common SIM card, an ISIM card, an ESIM card, a super SIM card, a TF card, and a NM card.

[0018] In a second aspect, another embodiment of the present application provides a session key generation device, which is applied to a first SIM card, wherein the first SIM card is pre-configured with a hybrid key encapsulation algorithm, wherein the hybrid key encapsulation algorithm includes at least two key generation algorithms, wherein the at least two key generation algorithms include a key generation algorithm belonging to a post-quantum key generation algorithm;

[0019] A generating unit, configured to generate a private key team and a public key team using the at least two key generation algorithms in response to detecting a connection interaction instruction with a second SIM card;

[0020] a sending unit, configured to send the public key team to the second SIM card; wherein the second SIM card is also pre-configured with the hybrid key encapsulation algorithm, the second SIM card is configured to generate key generation information corresponding to the session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and to encrypt the key generation information using the public key team to obtain ciphertext information, and to return the ciphertext information to the first SIM card;

[0021] The key processing unit is used to decrypt the ciphertext information by using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm after receiving the ciphertext information, obtain the key generation information, and generate a session key by using the key generation information.

[0022] In a third aspect, another embodiment of the present application provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the session key generation method when running.

[0023] In a fourth aspect, another embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the session key generation method.

[0024] Compared with the prior art, the present invention provides a session key generation method and related device. When the first SIM card needs to exchange information with the second SIM card, a private key team and a public key team can be generated. Since the first SIM card is pre-configured with a hybrid key encapsulation algorithm, the public key team includes a public key that can resist quantum attacks. Therefore, after sending the public key team to the second SIM card, the second SIM card can generate key generation information using the encapsulation algorithm in the hybrid key encapsulation algorithm, and encrypt the key generation information using the public key team to obtain ciphertext information, and send the ciphertext information to the first SIM card. In this way, the first SIM card can decrypt the ciphertext information using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm to obtain the key generation information, thereby obtaining the session key. In this process, only the public key team is publicly transmitted, and the key generation information used to generate the session key is transmitted in the form of ciphertext information. When generating the key generation information, a post-quantum encryption algorithm is also used, so that the finally generated session key can resist the attack of a quantum computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flow chart of a method for generating a session key provided by an embodiment of the present invention;

[0026] Figure 2 A schematic diagram of the connection of internal modules of a first SIM card provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of a data processing process of an internal module of a first SIM card provided by another embodiment of the present invention;

[0028] Figure 4 A schematic diagram of a data interaction process between internal modules of a first SIM card and a second SIM card provided by an embodiment of the present invention;

[0029] Figure 5 A schematic diagram of a data processing process of another first SIM card internal module provided by an embodiment of the present invention;

[0030] Figure 6 A connection diagram of a session key generation device provided by an embodiment of the present invention;

[0031] Figure 7 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] With the development of quantum technology, quantum technology has better results in cracking passwords, which may lead to information leakage during the information transmission process.

[0034] In the process of information transmission, in order to ensure the security of information transmission, the sender usually encrypts the information, and then transmits the encrypted ciphertext to the receiver. The receiver can decrypt the ciphertext to obtain the information. This method increases the security of information transmission.

[0035] The premise for the encrypted information transmitted by the sender to be decrypted normally at the receiver is that the sender and the receiver have already established an encrypted transmission protocol in advance. The core of this protocol is that the sender and the receiver use the same encryption and decryption algorithm and the same session key during the information exchange process. In other words, the sender and the receiver will pre-configure the same encryption and decryption algorithm and agree on the same session key to achieve encrypted information exchange between the sender and the receiver.

[0036] In the related art, in the process of the sender and the receiver agreeing on the same session key, one party usually generates the session key and then sends the session key to the other party; however, in the process of sending the session key from one party to the other, the session key may be leaked, thereby affecting the security of the sender and the receiver during the information encryption transmission process.

[0037] In the present disclosure, the SIM card (Subscriber Identity Module) is different from the SIM card in the usual sense, and the main difference is that the SIM card in the present disclosure has a separate session key generation capability, rather than just having storage and identity identification capabilities like the SIM card in the usual sense. That is, the SIM card in the present disclosure may include a processing module and a storage module, and the processing module may call the data pre-stored in the storage module. In the present disclosure, the data stored in the storage module may include encryption algorithms such as post-quantum encryption algorithms and classical encryption algorithms, and may also include related algorithm programs such as random number generation modules for generating keys, so that the SIM card can have the functions of key generation and data encryption. The advantage of this is that the encryption and decryption process after data transmission can be performed in the SIM card, a separate hardware device, instead of being performed at the terminal software level, so that the data transmission process can be made safer.

[0038] In the present disclosure, the SIM card may be one of a normal SIM card, an ISIM card, an ESIM card, a super SIM card, a TF card, and a NM card.

[0039] Of course, in actual use, there is a client that carries the SIM card, and the client can be a vehicle-mounted device, walkie-talkie device, mobile phone, computer equipment, smart watch, Internet of Things device, wireless router, drone, etc.

[0040] In the present disclosure, in the process that the first SIM card and the second SIM card need to interact, the first SIM card generates a private key team and a public key team, and sends the public key team to the second SIM card, and the second SIM card generates key generation information for generating a session key, and uses the public key team to encrypt the key generation information to generate ciphertext information, and sends the ciphertext information to the first SIM card, and the first SIM card can use the private key team to decrypt the ciphertext information to obtain the key generation information. In this way, the first SIM card and the second SIM card can both use the key generation information to generate a session key, and the key generation information used to generate the session key is transmitted in the form of ciphertext, thereby ensuring the security of the session key generation process. At the same time, the hybrid key encapsulation algorithm in the first SIM card and the second SIM card can also include an algorithm belonging to a post-quantum algorithm, so that the transmission process can also resist the attack of a quantum computer, and further improve the security of the session key generation process.

[0041] It should be understood that the hybrid key encapsulation algorithm may include a key generation algorithm, an encapsulation algorithm and an unsealing algorithm, and the key generation algorithm may include an algorithm belonging to a post-quantum algorithm, and accordingly, the encapsulation algorithm and the unsealing algorithm should also include an algorithm belonging to a post-quantum algorithm. In this way, the generation process of the session key disclosed in the present invention can resist the attacks and cracking of both quantum computers and classical computers, thereby helping to obtain the session key more securely.

[0042] See also Figure 1 , Figure 1 A flow chart of a session key generation method provided in an embodiment of the present invention, wherein the session key generation method can be applied to a first SIM card, wherein the first SIM card is pre-configured with a hybrid key encapsulation algorithm, wherein the hybrid key encapsulation algorithm includes at least two key generation algorithms, wherein the at least two quantum key generation algorithms include a key generation algorithm belonging to a post-quantum key algorithm.

[0043] In the present disclosure, during the interaction between the first SIM card and the second SIM card, the first SIM card may be an initiator or a receiver.

[0044] The first SIM card in the present disclosure may include a processor, or may be understood as a main control chip. Therefore, the execution subject of the present application may also be understood as the processor or main control chip of the first SIM card.

[0045] It should be understood that the hybrid key encapsulation algorithm may include at least two key generation algorithms, thereby increasing the difficulty of cracking (for example, multiple keys need to be cracked, rather than just one key as in the related art). At the same time, if at least two of the key algorithms include algorithms belonging to the post-quantum key generation algorithm, the information transmission process can resist the attack of quantum computers, and the security of the data transmission process can be further improved. Of course, how to select at least two key generation algorithms can be limited according to actual conditions.

[0046] For example, post-quantum key algorithms may include: lattice-based cryptographic algorithms, multivariate-based cryptographic algorithms, etc. Classical key algorithms may include: asymmetric algorithms, symmetric algorithms, hash algorithms, etc. Therefore, how to select at least two key generation algorithms in the hybrid key encapsulation algorithm can be limited according to actual conditions.

[0047] like Figure 1 As shown, the above session key generation method may include:

[0048] Step 101: In response to detecting a connection interaction instruction with a second SIM card, generating a private key team and a public key team using at least two key generation algorithms;

[0049] Step 102: Send the public key to the second SIM card;

[0050] Step 103: After receiving the ciphertext information, the ciphertext information is decrypted using the private key team and the decryption algorithm in the hybrid key encapsulation algorithm to obtain key generation information, and the session key is generated using the key generation information.

[0051] Here, the second SIM card can also be pre-configured with a hybrid key encapsulation algorithm; the second SIM card can be used to generate key generation information corresponding to the session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and use the public key team to encrypt the key generation information to obtain ciphertext information, and return the ciphertext information to the first SIM card.

[0052] Here, the second SIM card is also pre-configured with the same hybrid key encapsulation algorithm as that of the first SIM card.

[0053] It should be understood that the decapsulation algorithm and the encapsulation algorithm in the hybrid key encapsulation algorithm match each other, and the decapsulation algorithm and the encapsulation algorithm also respectively include algorithms belonging to the post-quantum key algorithm, thereby ensuring the security of the session key generation process.

[0054] It should be understood that the hybrid key encapsulation algorithms configured in different SIM cards can be the same. When two SIM cards need to interact with each other (the information interaction between the two SIM cards can be understood as the information interaction between the two terminal devices, and the terminal device is used to carry the SIM card, and can also be understood as the terminal device as an information transmission tool for the SIM card), the two SIM cards that need to interact can be agreed on a session key, so that the two SIM cards can use the agreed session key to perform encrypted information interaction. In the present disclosure, any two SIM cards that need to interact are represented by a first SIM card and a second SIM card.

[0055] As an example, when generating a private key team and a public key team using at least two key generation algorithms, multiple key pairs may be generated, and a key pair includes a private key and a public key. The private key team can be understood as a combination of private keys in multiple key pairs, and the public key team can be understood as a combination of public keys in multiple key pairs.

[0056] As an example, the second SIM card is also pre-configured with a hybrid key encapsulation algorithm, so that the encapsulation algorithm in the hybrid key encapsulation algorithm can be used to generate key generation information for generating a session key. The key generation information may include multiple keys, and the session key can be generated based on multiple keys.

[0057] It should be understood that since multiple keys may include keys generated using an encapsulation algorithm belonging to a post-quantum key algorithm, the session key generated based on multiple keys may have the ability to resist attacks from both quantum computers and classical computers. This makes it difficult to crack information after it is encrypted using the session key, thereby better protecting the security of the information.

[0058] As an example, the second SIM card can encrypt the key generation information based on the public key team to generate ciphertext information. At this time, the ciphertext information requires the corresponding private key team to decrypt. That is, this method makes it possible for the second SIM card to transmit the key generation information to the first SIM card. What is transmitted is the ciphertext information, thereby avoiding the leakage of the key generation information.

[0059] As an example, since the first SIM card stores the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm, after receiving the ciphertext information, the first SIM card can use the private key team to decrypt the ciphertext information to obtain the key generation information. Then, the key generation information can be used to generate the session key.

[0060] Accordingly, since the second SIM card also includes key generation information, the second SIM card can also generate a session key using the key generation information. In this way, since the first SIM card and the second SIM card both have the same session key, the first SIM card and the second SIM card can use the session key to encrypt and transmit the data to be transmitted during information transmission, thereby ensuring the security of the data interaction process.

[0061] It can be seen that in the present disclosure, when the first SIM card needs to exchange information with the second SIM card, a private key team and a public key team can be generated. Since the first SIM card is pre-configured with a hybrid key encapsulation algorithm, the public key team includes a public key that can resist quantum attacks. Therefore, after sending the public key team to the second SIM card, the second SIM card can generate key generation information using the encapsulation algorithm in the hybrid key encapsulation algorithm, and encrypt the key generation information using the public key team to obtain ciphertext information, and send the ciphertext information to the first SIM card. In this way, the first SIM card can decrypt the ciphertext information using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm to obtain the key generation information, thereby obtaining the session key. In this process, only the public key team is publicly transmitted, and the key generation information used to generate the session key is transmitted in the form of ciphertext information, and when generating the key generation information, a post-quantum encryption algorithm is also used, so that the finally generated session key can resist the attack of a quantum computer.

[0062] In some embodiments, the first SIM card may include a random number generation unit, and the "generating a private key team and a public key team using at least two key generation algorithms" in the above step 101 may specifically include:

[0063] At least two random numbers are generated by using a random number generation unit; and a private key team and a public key team can be generated based on at least two key generation algorithms and at least two random numbers.

[0064] It should be understood that the random number generating unit can be understood as a quantum random number generator, so that the random numbers generated each time can be different. In this way, when the first SIM card needs to interact with another SIM card later, the random numbers used to generate the private key team and the public key team are different from the random numbers used this time, thereby increasing the difficulty of cracking.

[0065] As an example, the specific number of random numbers may be the same as the number of the key generation algorithm in the hybrid key encapsulation algorithm.

[0066] It should be understood that the use of randomly generated random numbers to generate private key teams and public key teams can also increase the difficulty of cracking the private key team and the public key team to a certain extent.

[0067] In some embodiments, the hybrid key encapsulation algorithm includes a first post-quantum generation algorithm and a second national secret generation algorithm, and the above-mentioned use of a random number generation unit to generate at least two random numbers may specifically include:

[0068] Generate a first random number and a second random number using a random number generation unit;

[0069] Correspondingly, the above-mentioned generation of a private key team and a public key team based on at least two key generation algorithms and at least two random numbers may specifically include:

[0070] Based on the first random number and the first post-quantum generation algorithm, a first quantum private key and a first quantum public key are generated; based on the second random number and the second national secret generation algorithm, a second classical private key and a second classical public key are generated; based on the first quantum private key and the second classical private key, a private key team is generated; and, based on the first quantum public key and the second classical public key, a public key team is generated.

[0071] It should be understood that the first post-quantum generation algorithm belongs to the post-quantum encryption algorithm. Therefore, in the present disclosure, in order to facilitate the distinction between the keys generated by the post-quantum encryption algorithm and the classical encryption algorithm, the first quantum private key and the first quantum public key, as well as the second classical private key and the second classical public key are used to distinguish them.

[0072] As an example, the first post-quantum generation algorithm can be a lattice-based post-quantum encryption algorithm (Kyber); the second national secret generation algorithm can be a symmetric key generation algorithm or a hash algorithm; of course, in the specific implementation, the first post-quantum generation algorithm and the second national secret generation algorithm can also be reasonably selected according to actual conditions.

[0073] As an example, the public key team may include a first quantum public key generated based on a first post-quantum generation algorithm. In this way, the public key team includes the first quantum public key and the second classical public key. In this way, the ciphertext information can be encrypted by the post-quantum algorithm or by classical encryption; that is, the ciphertext information can resist attacks from both quantum computers and classical computers.

[0074] In some embodiments, the second SIM card may also include a random number generation unit, and the second SIM card may be used to generate the key generation information in the following manner:

[0075] A third random number and a fourth random number are generated by using a random number generation unit; a first quantum key is generated based on the third random number and an encapsulation algorithm in a hybrid key encapsulation algorithm; and key generation information is obtained based on the first quantum key and the fourth random number.

[0076] As an example, the key generation information includes the first quantum key and the fourth random number, which further increases the difficulty of cracking.

[0077] As an example, the first quantum key and the fourth random number are combined to obtain key generation information.

[0078] In some embodiments, the second SIM card is used to encrypt the key generation information in the following manner to obtain ciphertext information:

[0079] Using the first quantum public key and the encapsulation algorithm, the second quantum key is encrypted to obtain the first sub-ciphertext information;

[0080] Encrypting the fourth random number using the second classical public key and the encapsulation algorithm to obtain second sub-ciphertext information;

[0081] Ciphertext information is generated based on the first sub-ciphertext information and the second sub-ciphertext information.

[0082] As an example, encryption is performed using the first quantum public key and the second classical public key. In this way, the first SIM card can use the stored first quantum public key and the second classical public key for decryption, so that the first SIM card obtains the first sub-ciphertext information and the second sub-ciphertext information, and can generate a session key based on the first sub-ciphertext information and the second sub-ciphertext information.

[0083] As an example, the first sub-ciphertext information and the second sub-ciphertext information may be combined to obtain the ciphertext information.

[0084] In some embodiments, the above step 103 of "decrypting the ciphertext information using the private key team and the decryption algorithm in the hybrid key encapsulation algorithm to obtain the key generation information" may specifically include:

[0085] Using the first quantum private key and the decryption algorithm, the first sub-ciphertext information is decrypted to obtain the first quantum key; using the second classical private key and the decryption algorithm, the second sub-ciphertext information is decrypted to obtain a fourth random number;

[0086] Based on the first quantum key and the fourth random number, key generation information is obtained.

[0087] As an example, since the first SIM card has pre-stored the first quantum private key and the second classical private key, the first SIM card can directly perform decryption based on the first quantum private key and the second classical private key to obtain the first quantum key and the fourth random number.

[0088] In some embodiments, the “generating a session key using the key generation information” in the above step 103 may specifically include: processing the first quantum key and the fourth random number based on the SM3 hybrid key generation algorithm to generate a session key;

[0089] The second SIM card is also used to process the first quantum key and the fourth random number based on the SM3 hash key generation algorithm to generate a session key.

[0090] As an example, the SM3 hash key generation algorithm can be understood as a symmetric key generation algorithm. Based on the SM3 hash key generation algorithm, the first SIM card and the second SIM card can both include the same session key, so that the first SIM card and the second SIM card can use the session key to encrypt and transmit information that needs to be sent to each other, thereby ensuring the security of information transmission.

[0091] For ease of understanding, you can combine Figure 2 - Figure 5 To understand the session key generation scheme of the present disclosure, the scenario of the present disclosure is a packaging scenario for the session key, which can also be understood as an agreement process between two SIM cards for the session key.

[0092] Combine first Figure 2 The internal module structure of the SIM card in the application scenario of the present disclosure is described as follows: Figure 2It can be seen that the SIM card in the present disclosure may include a random number generation module, a PQC module and a national secret encryption module (also understood as a classic encryption module). The random number generation module is used to generate random numbers, the PQC module is preset with a post-quantum encryption algorithm, and the classic encryption module is preset with a classic encryption algorithm.

[0093] Continue to combine Figure 3 - Figure 5 The process of generating a session key is described below. Figure 3 It can be seen that the PQC module can request random numbers from the random number generation module, and the random number generation module returns random numbers P1 and P2 for key generation.

[0094] The PQC module uses the random number P1 to generate Kyber's public and private key pair, public key K and private key K. And it can send the random number P2 to the classic encryption module.

[0095] The classic encryption module can use the random number P2 to generate the public-private key pair of SM2, the public key S and the private key S.

[0096] Continue to combine Figure 4 It can be seen that the first SIM card can send the public key K and the public key S to the second SIM card (the hardware structure of the second SIM card is the same as that of the first SIM card), and can retain the private key K and the private key S.

[0097] The PQC module of the second SIM card requests the random number generation module for key encapsulation random numbers, and the random number generation module returns random numbers 3 and 4; the Kyber key encapsulation algorithm in the PQC module uses the public key K and the random number 3 to perform Kyber key encapsulation to generate the key F (the first quantum key) and the ciphertext C1 of the key F.

[0098] The PQC module sends the random number 4 and the public key S to the classic encryption module. The classic encryption module uses the SM2 key encapsulation algorithm (encryption algorithm) and uses the public key S to encrypt the random number 4 into the ciphertext C2.

[0099] The second SIM card returns the ciphertext C1 and the ciphertext C2 to the first SIM card, and retains the key F and the random number 4.

[0100] Continue reading Figure 5 , the first SIM card sends the ciphertext C1 and ciphertext C2 to the PQC module of the SIM card, and the PQC module decrypts the ciphertext C1 using the previously reserved private key K to obtain the key F. The PQC module sends the ciphertext C2 to the classic encryption module, and the classic encryption module decrypts the ciphertext C2 using the previously reserved private key S to obtain the random number 4; the first SIM card retains the key F and the random number 4.

[0101] In this way, the first SIM card and the second SIM card can generate the same session key using the key F and the random number 4, thereby achieving encapsulation of the session key.

[0102] It can be seen that in the present disclosure, due to the addition of the PQC module, the SIM card can have the ability to resist quantum attacks during the key encapsulation process. At the same time, combined with SM2 (classical symmetric encryption), the key encapsulation process for the SIM card can be more secure, which helps to improve the security of the SIM card during the interaction process.

[0103] See also Figure 6 , Figure 6 A schematic diagram of the structure of a session key generation device provided by an embodiment of the present invention, wherein the session key generation device 6 is applied to a first SIM card, and the first SIM card is pre-configured with a hybrid key encapsulation algorithm, wherein the hybrid key encapsulation algorithm includes at least two key generation algorithms, and the at least two key generation algorithms include a key generation algorithm belonging to a post-quantum key generation algorithm;

[0104] A generating unit 601 is used to generate a private key team and a public key team using the at least two key generation algorithms in response to detecting a connection interaction instruction with a second SIM card;

[0105] The sending unit 602 is used to send the public key team to the second SIM card; wherein the second SIM card is also pre-configured with the hybrid key encapsulation algorithm, and the second SIM card is used to generate key generation information corresponding to the session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and encrypt the key generation information using the public key team to obtain ciphertext information, and return the ciphertext information to the first SIM card;

[0106] The key processing unit 603 is used to decrypt the ciphertext information by using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm after receiving the ciphertext information, obtain the key generation information, and generate a session key by using the key generation information.

[0107] In some embodiments, the first SIM card includes a random number generating unit, and the generating unit 601 is further configured to: generate the at least two random numbers using the random number generating unit;

[0108] Based on the at least two key generation algorithms and at least two random numbers, the private key team and the public key team are generated.

[0109] In some embodiments, the at least two key generation algorithms include a first post-quantum generation algorithm and a second national secret generation algorithm, and the generation unit 601 is further used to: generate a first random number and a second random number using the random number generation unit; generate a first quantum private key and a first quantum public key based on the first random number and the first post-quantum generation algorithm;

[0110] Based on the second random number and the second national secret generation algorithm, generate a second classic private key and a second classic public key;

[0111] The private key team is generated based on the first quantum private key and the second classical private key, and the public key team is generated based on the first quantum public key and the second classical public key.

[0112] In some embodiments, the second SIM card also includes a random number generation unit, and the second SIM card is used to generate the key generation information in the following manner:

[0113] Generate a third random number and a fourth random number using the random number generation unit;

[0114] Generate a first quantum key based on the third random number and the encapsulation algorithm in the hybrid key encapsulation algorithm;

[0115] Based on the first quantum key and the fourth random number, the key generation information is obtained.

[0116] In some embodiments, the second SIM card is used to encrypt the key generation information in the following manner to obtain ciphertext information:

[0117] Using the first quantum public key and the encapsulation algorithm, encrypt the first quantum secret key to obtain first sub-ciphertext information;

[0118] Using the second classic public key and the encapsulation algorithm, encrypt the fourth random number to obtain second sub-ciphertext information;

[0119] The ciphertext information is generated based on the first sub-ciphertext information and the second sub-ciphertext information.

[0120] In some embodiments, the key processing unit 603 is further used to: decrypt the first sub-ciphertext information using the first quantum private key and the decryption algorithm to obtain the first quantum key;

[0121] Decrypting the second sub-ciphertext information using the second classic private key and the decryption algorithm to obtain the fourth random number;

[0122] Based on the first quantum key and the fourth random number, the key generation information is obtained.

[0123] In some embodiments, the key processing unit 603 is further used to: process the first quantum key and the fourth random number based on the SM3 hybrid key generation algorithm to generate the session key;

[0124] The second SIM card is also used to process the first quantum key and the fourth random number based on the SM3 hash key generation algorithm to generate the session key.

[0125] In some embodiments, the SIM card is one of a normal SIM card, an ISIM card, an ESIM card, a super SIM card, a TF card, and an NM card.

[0126] Figure 7 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the functions of a computer system for implementing the method for generating an amplitude preparation circuit in any of the above-mentioned embodiments are realized.

[0127] The embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the computer executes the functions of the computer system of the session key generation method in any of the above embodiments.

[0128] The embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enables the computer to perform the functions of a computer system of the session key generation method in any of the above embodiments.

[0129] It should be understood that the specific examples in this application are only intended to help those skilled in the art to better understand the embodiments of the present application, rather than to limit the scope of the present invention.

[0130] It can be understood that in the various implementations of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of the present application.

[0131] It can be understood that the various embodiments described in this application can be implemented individually or in combination, and the embodiments of this application are not limited to this.

[0132] Unless otherwise stated, all technical and scientific terms used in the embodiments of the present application have the same meaning as those generally understood by those skilled in the art of the technical field of the present application. The terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the scope of the present application. The term "and / or" used in the present application includes any and all combinations of one or more related listed items. The singular forms of "a kind of", "above" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0133] It can be understood that the processor of the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method implementation can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (DigitalSignal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiment of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0134] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0135] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0136] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0137] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0138] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0139] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0140] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0141] The above are only specific embodiments of the present application, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for generating a session key, characterized in that: Applied to a first SIM card, the first SIM card is pre-configured with a hybrid key encapsulation algorithm, the hybrid key encapsulation algorithm includes at least two key generation algorithms, and the at least two key generation algorithms include a key generation algorithm belonging to a post-quantum key algorithm; In response to detecting a connection interaction instruction with a second SIM card, generating a private key team and a public key team using the at least two key generation algorithms; Sending the public key team to the second SIM card; wherein the second SIM card is also pre-configured with the hybrid key encapsulation algorithm, the second SIM card is used to generate key generation information corresponding to the session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and encrypt the key generation information using the public key team to obtain ciphertext information, and return the ciphertext information to the first SIM card; After receiving the ciphertext information, the ciphertext information is decrypted using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm to obtain the key generation information, and the session key is generated using the key generation information.

2. The method according to claim 1, characterized in that The first SIM card includes a random number generation unit, and the generating of a private key team and a public key team by using the at least two key generation algorithms includes: generating the at least two random numbers using the random number generation unit; The private key team and the public key team are generated based on the at least two key generation algorithms and at least two random numbers.

3. The method according to claim 2, characterized in that The at least two key generation algorithms include a first post-quantum generation algorithm and a second national secret generation algorithm, and the generating of the at least two random numbers by using the random number generation unit includes: Generate a first random number and a second random number using the random number generation unit; Correspondingly, the generating the private key team and the public key team based on the at least two key generation algorithms and the at least two random numbers includes: Generate a first quantum private key and a first quantum public key based on the first random number and the first post-quantum generation algorithm; Generate a second classic private key and a second classic public key based on the second random number and the second national secret generation algorithm; The private key team is generated based on the first quantum private key and the second classical private key, and the public key team is generated based on the first quantum public key and the second classical public key.

4. The method according to claim 3, characterized in that The second SIM card also includes a random number generation unit, and the second SIM card is used to generate the key generation information in the following manner: Generate a third random number and a fourth random number using the random number generation unit; Generate a first quantum key based on the third random number and an encapsulation algorithm in the hybrid key encapsulation algorithm; The key generation information is obtained based on the first quantum key and the fourth random number.

5. The method according to claim 4, characterized in that The second SIM card is used to encrypt the key generation information in the following manner to obtain ciphertext information: Encrypting the first quantum secret key using the first quantum public key and the encapsulation algorithm to obtain first sub-ciphertext information; Using the second classic public key and the encapsulation algorithm, encrypt the fourth random number to obtain second sub-ciphertext information; The ciphertext information is generated based on the first sub-ciphertext information and the second sub-ciphertext information.

6. The method according to claim 5, characterized in that The step of decrypting the ciphertext information by using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm to obtain the key generation information includes: Decrypting the first sub-ciphertext information using the first quantum private key and the decryption algorithm to obtain the first quantum key; Decrypting the second sub-ciphertext information using the second classic private key and the decryption algorithm to obtain the fourth random number; The key generation information is obtained based on the first quantum key and the fourth random number.

7. The method according to claim 5, characterized in that The step of generating a session key by using the key generation information comprises: Processing the first quantum key and the fourth random number based on the SM3 hashing key generation algorithm to generate the session key; The second SIM card is also used to process the first quantum key and the fourth random number based on the SM3 hash key generation algorithm to generate the session key.

8. The method according to claim 1, characterized in that The SIM card is one of a common SIM card, an ISIM card, an ESIM card, a super SIM card, a TF card, and a NM card.

9. A session key generation device, characterized in that: Applied to a first SIM card, the first SIM card is pre-configured with a hybrid key encapsulation algorithm, the hybrid key encapsulation algorithm includes at least two key generation algorithms, and the at least two key generation algorithms include a key generation algorithm belonging to a post-quantum key generation algorithm; A generating unit, configured to generate a private key team and a public key team using the at least two key generation algorithms in response to detecting a connection interaction instruction with a second SIM card; a sending unit, configured to send the public key team to the second SIM card; wherein the second SIM card is also pre-configured with the hybrid key encapsulation algorithm, the second SIM card is configured to generate key generation information corresponding to the session key based on the encapsulation algorithm in the hybrid key encapsulation algorithm, and to encrypt the key generation information using the public key team to obtain ciphertext information, and to return the ciphertext information to the first SIM card; The key processing unit is used to decrypt the ciphertext information by using the private key team and the decapsulation algorithm in the hybrid key encapsulation algorithm after receiving the ciphertext information, obtain the key generation information, and generate a session key by using the key generation information.

10. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 8 when executed.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 8.

Images