Key distribution method, electronic equipment and readable storage medium

Abstract

The invention discloses a key distribution method, electronic equipment and a readable storage medium. The method comprises the following steps: receiving a target quantum key sent by first quantum key distribution equipment; encrypting a to-be-distributed service key according to the target quantum key to obtain a target service key; and distributing the target service key to target equipment through a preset transmission channel.

Description

Technical Field

[0001] The present application belongs to the field of quantum communication technology, and specifically relates to a key distribution method, an electronic device and a readable storage medium. Background Art

[0002] Key distribution can include online key distribution and offline key distribution. Online key distribution requires the managed device and the device management platform to negotiate a secure channel, and then transmit the business key in the secure channel. Offline key distribution supports exporting business keys to secure media such as intelligent password keys (UKEY) for offline distribution. Figure 1 In the offline key distribution process shown, the key management system adopts a key management method based on secure media. The key management system negotiates the distribution protection key with the managed device. The key management system uses the distribution protection key to encrypt the business key to be distributed, and then imports the encrypted business key into the secure medium through the interface of the secure medium. The secure medium is then distributed offline to the managed device and imported into the managed device. The managed device uses the distribution protection key to decrypt the encrypted business key to obtain the business key.

[0003] The above-mentioned offline key distribution uses the distribution protection key to encrypt and protect the business key to be distributed, and the distribution protection key is protected based on an asymmetric cryptographic system. However, in the face of quantum computing attacks, the public and private keys will no longer be safe, and the distribution protection key will be at risk of being cracked or leaked. As a result, the business key to be distributed encrypted and protected by the distribution protection key will also be at risk of being leaked. Summary of the invention

[0004] The embodiments of the present application provide a key distribution method, an electronic device and a readable storage medium, which can solve the problem that there is an insecurity risk in protecting business keys based on an asymmetric cryptographic system, resulting in the risk of leakage of the business keys to be distributed.

[0005] In a first aspect, an embodiment of the present application provides a key distribution method, which is applied to a key management system. The method includes: receiving a target quantum key sent by a first quantum key distribution device; encrypting a business key to be distributed according to the target quantum key to obtain a target business key; and distributing the target business key to a target device through a preset transmission channel.

[0006] In a second aspect, an embodiment of the present application provides a key distribution method, which is applied to a target device, and the method includes: receiving a target quantum key pushed by a second quantum key distribution device; receiving a target business key sent by a key management system through a preset transmission channel; wherein, the target business key is obtained by the key management system encrypting the business key to be distributed according to the target quantum key; decrypting the target business key according to the target quantum key to obtain a business key; wherein, the business key corresponds to the business key to be distributed.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect, or implements the steps of the method described in the second aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented, or the steps of the method described in the second aspect are implemented.

[0009] In a fifth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the steps of the method described in the first aspect, or to implement the steps of the method described in the second aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises a program or instructions, and when the program or instructions are executed, the steps of the method described in the first aspect are implemented, or the steps of the method described in the second aspect are implemented.

[0011] In an embodiment of the present application, the key management system receives the target quantum key sent by the first quantum key distribution device, encrypts the business key to be distributed to obtain an encrypted target business key, and then distributes the target business key to the target device through a preset transmission channel, thereby using a quantum key that is resistant to quantum computing attacks and has higher security to encrypt the business key to be distributed, thereby ensuring that the business key has the ability to resist quantum computing attacks and has higher security during the key distribution process. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of a key distribution method in the related art; Figure 2It is a flowchart of a key distribution method provided in an embodiment of the present application; Figure 3 It is a flowchart of a key distribution method provided in an embodiment of the present application; Figure 4 It is a structural diagram of a key distribution system provided in an embodiment of the present application; Figure 5 It is a flowchart of another key distribution method provided in an embodiment of the present application; Figure 6 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0014] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0015] The key distribution method, electronic device and readable storage medium provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0016] Figure 2 The flowchart of a key distribution method provided by an embodiment of the present application is shown. The method is applied to a key management system and can be executed by an electronic device. Figure 2 , the method may include the following steps.

[0017] Step 202: Receive a target quantum key sent by a first quantum key distribution device.

[0018] Among them, the target quantum key is generated based on a quantum key distribution (QKD) network and then transmitted to the key management system. The target quantum key can be sent to the key management system through a first quantum key distribution device that is connected to the QKD network and can communicate with the key management system.

[0019] Step 204: encrypt the business key to be distributed according to the target quantum key to obtain the target business key.

[0020] Among them, the target quantum key sent by the first quantum key distribution device has the ability to resist quantum computing attacks and has higher security. The target quantum key is used to encrypt the business key to be distributed, which can improve the security of the business key.

[0021] Step 206: Distribute the target service key to the target device through a preset transmission channel.

[0022] In an embodiment of the present application, the key management system receives the target quantum key sent by the first quantum key distribution device, encrypts the business key to be distributed to obtain an encrypted target business key, and then distributes the target business key to the target device through a preset transmission channel, thereby using a quantum key that is resistant to quantum computing attacks and has higher security to encrypt the business key to be distributed, thereby ensuring that the business key has the ability to resist quantum computing attacks and has higher security during the key distribution process.

[0023] In one implementation, the above-mentioned key distribution method may also include: connecting the first quantum key distribution device to a quantum key distribution network.

[0024] In an embodiment of the present application, the first quantum key distribution device is connected to the QKD network, and the first quantum key distribution device receives the target quantum key generated by the QKD network. Then, based on the communication connection relationship established between the key management system and the first quantum key distribution device, the key management system receives the target quantum key sent by the first quantum key distribution device, so that the key management system obtains the target quantum key to encrypt the business key to be distributed according to the target quantum key to ensure the security of the business key.

[0025] In one implementation, the above step 204 encrypts the business key to be distributed according to the target quantum key to obtain the target business key, which may include the following steps.

[0026] Step 2041: encrypt the business key to be distributed according to the target quantum key to obtain an encrypted business key.

[0027] Among them, the target quantum key is used to protect the business key, and the business key to be distributed is the key required by each target device to ensure the security of business data when executing the business.

[0028] Step 2042: format-encapsulate the encrypted business key to obtain the target business key.

[0029] In the embodiment of the present application, the key management system first encrypts the business key to be distributed according to the quantum key sent by the first quantum key distribution device, and then formats the encrypted business key to obtain the target business key distributed to the target device. The format packaging includes packaging the encrypted business key into a standard format, and the definition of the standard format is shown in Table 1.

[0030] Table 1.

[0031] In one implementation, the key distribution method may further include: sending a quantum key notification message to the target device.

[0032] The quantum key notification message is used to instruct the target device to receive the target quantum key.

[0033] In an embodiment of the present application, the key management system sends a quantum key notification message to the target device to instruct the target device to receive the target quantum key pushed by the second quantum key distribution device that is communicatively connected to the target device, so that after receiving the encrypted target business key sent by the key management system, the target device uses the target quantum key to decrypt the target business key, thereby obtaining the business key.

[0034] In one implementation, the above-mentioned preset transmission channel may include: an online transmission channel or an offline transmission channel.

[0035] In the embodiment of the present application, the online transmission channel may include a secure channel negotiated between the key management system and the target device, and the key management system distributes the target business key to the target device through the negotiated secure channel. The offline transmission channel may include a secure medium such as an intelligent password key, and the key management system imports the target business key into the secure medium through the interface of the secure medium. When the secure medium is sent to the target device and connected to the target device, the target device obtains the target business key, thereby achieving a more secure key distribution that is more resistant to quantum computing attacks.

[0036] Figure 3 A schematic diagram of a key distribution method provided in an embodiment of the present application is shown in FIG. Figure 3 The method is applied to a target device and can be executed by an electronic device. The method may include the following steps.

[0037] Step 302: Receive the target quantum key pushed by the second quantum key distribution device.

[0038] Among them, the target quantum key is generated based on the QKD network and then transmitted to the target device. The target quantum key can be transmitted to the target device through a second quantum key distribution device that is connected to the QKD network and can communicate with the target device. The second quantum key distribution device is connected to the quantum key distribution network. The target quantum key is consistent with the target quantum key received by the above-mentioned key management system, so that the target device decrypts the target business key sent by the key management system based on the target quantum key to obtain the business key.

[0039] Step 304: Receive the target service key sent by the key management system through a preset transmission channel.

[0040] The target business key is obtained by the key management system encrypting the business key to be distributed according to the target quantum key.

[0041] Step 306: decrypt the target business key according to the target quantum key to obtain a business key.

[0042] The service key corresponds to the service key to be distributed, and the service key is the encrypted and decrypted service key to be distributed.

[0043] In the embodiment of the present application, the target device and the key management system both receive the target quantum key sent by the quantum key distribution device that is connected to each other in communication. The key management system encrypts the business key to be distributed based on the target quantum key to obtain the encrypted target business key, and then distributes the target business key to the target device through a preset transmission channel. The target device then receives the target business key sent by the key management system through the preset transmission channel, and decrypts the target business key based on the target quantum key to obtain the business key. Thus, the business key to be distributed is encrypted and decrypted using a quantum key that is resistant to quantum computing attacks and has higher security, ensuring that the business key has the ability to resist quantum computing attacks and higher security during the key distribution process.

[0044] In one implementation, before receiving the target quantum key sent by the second quantum key distribution device in the above step 302, the method may further include: step 301, receiving a quantum key notification message sent by the key management system.

[0045] The quantum key notification message is used to instruct the target device to receive the target quantum key.

[0046] In an embodiment of the present application, when the key management system learns that the target device needs a business key, it sends a quantum key notification message to the target device to instruct the target device to receive the target quantum key, and triggers the quantum key distribution network to distribute the target quantum key to the key management system through the first quantum key distribution device and to the target device through the second quantum key distribution device. The target device receives the target quantum key pushed by the second quantum key distribution device based on the instruction of the received quantum key notification message, and decrypts the target business key based on the target quantum key to obtain the business key, thereby ensuring that the business key has the ability to resist quantum computing attacks and higher security during the key distribution process.

[0047] Optionally, the order in which the target device receives the quantum key notification message sent by the key management system and the key management system triggers the second quantum key distribution device that is communicatively connected to the target device to distribute the target quantum key can be performed simultaneously, or the key management system can first send a quantum key notification message to the target device and then trigger the second quantum key distribution device to distribute the target quantum key to the target device, so as to ensure that the target device can receive the target quantum key in a timely manner.

[0048] Figure 4 The present application also provides a schematic diagram of a key distribution system. Figure 4 The key distribution system 400 includes a key management system 41, a target device 42, a first quantum key distribution device 43, and a second quantum key distribution device 44. The key management system 41 and the target device 42 can transmit data through a preset transmission channel, and the preset transmission channel can include an online transmission channel, such as the Internet or a dedicated network, and can also include an offline transmission channel, such as a secure medium. The first quantum key distribution device 43 and the second quantum key distribution device 44 are connected to the QKD network.

[0049] The key management system 41 is used to receive the target quantum key sent by the first quantum key distribution device 43, encrypt the business key to be distributed according to the target quantum key to obtain the target business key, and distribute the target business key to the target device 42 through a preset transmission channel. The target device 42 is used to receive the target quantum key sent by the second quantum key distribution device 44, receive the target business key sent by the key management system 41 through a preset transmission channel, and decrypt the target business key according to the target quantum key to obtain a business key; wherein the business key corresponds to the business key to be distributed.

[0050] In one implementation, the key management system 41 is used to connect the first quantum key device 43 to a quantum key distribution network.

[0051] In one implementation, the key management system 41 is used to encrypt the business key to be distributed according to the target quantum key to obtain the encrypted business key; and format-encapsulate the encrypted business key to obtain the target business key.

[0052] In one implementation, the key management system 41 is used to send a quantum key notification message to the target device 42, wherein the quantum key notification message is used to instruct the target device 42 to receive the target quantum key. The target device 42 is used to receive the quantum key notification message sent by the key management system 41, wherein the quantum key notification message is used to instruct the target device 42 to receive the target quantum key.

[0053] In one implementation, the preset transmission channel includes: an online transmission channel or an offline transmission channel.

[0054] The key distribution system 400 provided in the embodiment of the present application can achieve Figure 2 and Figure 3 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0055] Figure 5 A schematic diagram of a process flow of another key distribution method provided by an embodiment of the present application is shown in an implementation manner. The method can be applied to Figure 4 The key distribution system shown in Figure 5 , the method may include the following steps.

[0056] Step 501: The managed device registers in the key management system.

[0057] Among them, the managed device is the target device that receives the service key. The managed device registered in the key management system can obtain the required service key from the key management system for security operations such as encrypted communication and data encryption. The key management system can manage and control the service key of the managed device based on the registration information of the managed device and distribute the adapted service key to the managed device.

[0058] Step 502: Connect the key management system and the managed device to the QKD network, and initialize the connected device.

[0059] Among them, the key management system is connected to the first quantum key distribution device, the managed device is connected to the second quantum key distribution device, the key management system is connected to the QKD network through the first quantum key distribution device, and the managed device is connected to the QKD network through the second quantum key distribution device, so that it can be successfully connected to the QKD network. The QKD network uses the characteristics of quantum mechanics to ensure communication security and can generate random and secure quantum keys. Due to the non-cloning of quantum states and the uncertainty principle, various abnormal attack behaviors can be detected in a timely and accurate manner, thereby ensuring the security of quantum keys during transmission.

[0060] Step 503: The key management system selects information such as the managed device to be distributed, the type and quantity of the service key, etc.

[0061] Among them, information such as the managed equipment to be distributed, the type and quantity of business keys, etc. can be entered by the operator.

[0062] Step 504: The key management system applies for a quantum key from the first quantum key distribution device.

[0063] Optionally, the key management system may send a data packet to the managed device via a classical network to notify the managed device through the data packet that it is ready to receive the quantum key generated by the QKD network.

[0064] Step 505: The QKD network internally communicates to negotiate and distribute quantum keys. The first quantum key distribution device returns the quantum key to the key management system, and the second quantum key distribution device synchronously pushes the consistent quantum key to the managed device.

[0065] Step 506: The key management system uses the received quantum key to perform SM4 encryption on the business key to be distributed, encapsulates it into an offline distribution file in a standard format, and then imports the offline distribution file into a secure medium.

[0066] Step 507: Deliver the secure medium offline to the managed device.

[0067] Step 508: The managed device reads the offline distribution file from the secure medium, decapsulates and verifies the file according to the standard packaging format.

[0068] Step 509: The managed device uses the received quantum key to perform SM4 decryption on the decrypted business key ciphertext to obtain the business key.

[0069] In the embodiment of the present application, the key management system and the managed device receive the quantum key generated based on the QKD network. The key management system encrypts the business key to be distributed based on the received quantum key to obtain the encrypted target business key, and the managed device decrypts the target business key based on the received quantum key to obtain the business key. Thus, the business key to be distributed is encrypted and decrypted using the quantum key that is resistant to quantum computing attacks and has higher security, ensuring that the business key has the ability to resist quantum computing attacks and higher security during the key distribution process.

[0070] Based on the same technical concept, an embodiment of the present application further provides an electronic device, which is used to execute the above-mentioned key distribution method. Figure 6 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. The processor 601 can call a computer program stored in the memory 603 and can be run on the processor 601 to execute the various steps of the above-mentioned key distribution method embodiment, and can achieve the same technical effect, so it will not be repeated here to avoid repetition.

[0071] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0072] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0073] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0074] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0075] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned key distribution method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0076] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0077] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned key distribution method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0078] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0079] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes a program or instructions. When the program or instructions are executed, the various processes of the above-mentioned key distribution method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0080] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0081] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0082] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A key distribution method, characterized in that: Applied to key management systems, including: Receiving a target quantum key sent by a first quantum key distribution device; Encrypting the service key to be distributed according to the target quantum key to obtain a target service key; The target business key is distributed to the target device through a preset transmission channel.

2. The method according to claim 1, characterized in that The method further comprises: Connecting the first quantum key distribution device to a quantum key distribution network.

3. The method according to claim 1, characterized in that: The step of encrypting the service key to be distributed according to the target quantum key to obtain the target service key comprises: Encrypting the service key to be distributed according to the target quantum key to obtain an encrypted service key; The encrypted business key is format-encapsulated to obtain the target business key.

4. The method according to claim 1, characterized in that: The method further comprises: Sending a quantum key notification message to the target device; wherein the quantum key notification message is used to instruct the target device to receive the target quantum key.

5. The method according to claim 1, characterized in that The preset transmission channel includes: an online transmission channel or an offline transmission channel.

6. A key distribution method, characterized in that: Applied to target devices, including: Receiving a target quantum key pushed by a second quantum key distribution device; Receiving a target business key sent by a key management system through a preset transmission channel; wherein the target business key is obtained by encrypting a business key to be distributed by the key management system according to the target quantum key; The target business key is decrypted according to the target quantum key to obtain a business key; wherein the business key corresponds to the business key to be distributed.

7. The method according to claim 6, characterized in that Before receiving the target quantum key pushed by the second quantum key distribution device, the method further includes: Receive a quantum key notification message sent by the key management system; wherein the quantum key notification message is used to instruct the target device to receive the target quantum key.

8. An electronic device, characterized in that: The invention comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the key distribution method as described in any one of claims 1 to 5, or implements the steps of the key distribution method as described in any one of claims 6 to 7.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the key distribution method according to any one of claims 1 to 5 are implemented, or the steps of the key distribution method according to any one of claims 6 to 7 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising a program or instructions, which, when executed, implement the steps of the key distribution method as described in any one of claims 1 to 5, or implement the steps of the key distribution method as described in any one of claims 6 to 7.

Images