Communication method, electronic equipment and computer readable storage medium

Abstract

The embodiment of the invention provides a communication method, electronic equipment and a computer readable medium. The method comprises the steps that home terminal quantum security service equipment communicates with at least one block chain node; wherein the block chain corresponding to the at least one block chain node comprises at least one node in a home terminal organization and at least one node in an opposite terminal organization, the home terminal organization corresponds to the home terminal quantum security service device, and the opposite terminal organization corresponds to the opposite terminal quantum security service device. A smart contract is deployed on at least one block chain node on the block chain, and service calling information used for calling the quantum security service is configured in the smart contract.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method, an electronic device, and a computer-readable storage medium. Background Art

[0002] In the development of communication technology, cryptographic technology, as the cornerstone of information security technology, plays a core role in ensuring the confidentiality, authenticity, integrity and non-repudiation of information. In the application of cryptographic technology, due to the differences in cryptographic algorithms and security levels, the requirements for keys are also different. At present, in addition to classical keys and related cryptographic services, quantum secure communication technology also provides a new option for information security.

[0003] For example, quantum secure communication technology is based on the principles of quantum mechanics and uses a quantum key distribution (QKD) network for secure communication. QKD is the process of generating a shared key through negotiation between the two communicating parties based on the QKD protocol. The generated password is theoretically unconditionally secure. As the scale of QKD network deployment expands and user demand for high-security cryptographic products grows, user demand for application service access to the QKD network will continue to expand. The quantum security service system can provide convenient and secure quantum key and cryptographic services for applications.

[0004] However, for quantum secure communication technology, the keys, cryptographic service operations and usage records of the quantum security service system still have risks such as low security, which affects the security of quantum communications. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a communication method, an electronic device, and a computer-readable storage medium that can ensure the security of quantum communications.

[0006] To solve the above technical problems, the embodiments of the present application are implemented through the following aspects.

[0007] In a first aspect, an embodiment of the present application provides a communication method, which is applied to a local quantum security service device, and the method includes: communicating with at least one blockchain node; wherein the blockchain corresponding to the at least one blockchain node includes at least one node in the local organization and at least one node in the opposite organization, the local organization corresponds to the local quantum security service device, the opposite organization corresponds to the opposite quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

[0008] In a second aspect, an embodiment of the present application provides a communication method, which is applied to a first blockchain node on a blockchain, and the method includes: communicating with a local quantum security service device; wherein the blockchain includes at least one node in a local organization and at least one node in a peer organization, the local organization corresponds to the local quantum security service device, the peer organization corresponds to the peer quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

[0009] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and computer executable instructions stored in the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of executing the method described in the first aspect or the second aspect.

[0010] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps of the method described in the first aspect or the second aspect are implemented.

[0011] In the embodiment of the present application, by connecting the blockchain alliance chain smart contract with the quantum security service system, the smart contract is used to manage the quantum security services of the quantum security service system, thereby achieving the purpose of anti-tampering in the quantum security service process and effectively improving the security of the quantum security service. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0013] Figure 1 A schematic diagram of a communication system provided in an embodiment of the present application is shown.

[0014] Figure 2 One of the flow charts of the communication method provided in the embodiment of the present application is shown.

[0015] Figure 3 A second flow chart of the communication method provided in an embodiment of the present application is shown.

[0016] Figure 4 A third flow chart of the communication method provided in an embodiment of the present application is shown.

[0017] Figure 5 One of the structural schematic diagrams of the communication device provided in the embodiment of the present application is shown.

[0018] Figure 6 A second structural schematic diagram of the communication device provided in an embodiment of the present application is shown.

[0019] Figure 7 A schematic diagram of the hardware structure of an electronic device for executing the communication method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0021] In this application, although the quantum security service system is based on the QKD network, and can obtain theoretically unconditionally secure quantum keys from the QKD network, it can achieve secure negotiation and distribution of symmetric keys for encrypted information between the communicating parties, and provide convenient and secure quantum key and cryptographic services for applications. However, there are still security issues such as tampering with the keys, cryptographic service operations and usage records of the quantum security service system.

[0022] In this regard, this application is based on the blockchain alliance chain platform. By connecting the blockchain alliance chain smart contract with the quantum security service system, the smart contract is used to manage the quantum security services of the quantum security service system (such as quantum key creation service, quantum key acquisition service, etc.). Therefore, on the one hand, the operation of the quantum key of the quantum security service system and the usage record of the cryptographic service can be uploaded to the chain to prevent tampering. On the other hand, it can also provide blockchain applications with quantum security services that are more secure than traditional cryptography, enriching the service capabilities of the blockchain.

[0023] It is understood that the aforementioned "smart contracts" are programs stored on the blockchain that are run when predetermined conditions are met. They are often used to automatically execute agreements so that all participants can determine the results immediately without the involvement of any middlemen and without wasting time. The rules and data in smart contracts are public and visible to the outside world; smart contracts are automatically executed to prevent the emergence of malicious human operations; operational transactions are public, and false or hidden transactions will not exist because there is no third party involved, and encrypted transaction records are shared between participants, so there is no need to question whether the information has been changed for personal gain.

[0024] In this case, if Figure 1 As shown, it is a schematic diagram of the architecture of a communication system (or called a quantum security service system) provided in an embodiment of the present application. In this system, the first part is the quantum security service system, including a local quantum security service device organized by the local end and a peer quantum security service device organized by the peer end, and the local quantum security service device and the peer quantum security service device are respectively connected to the QKD network to negotiate and distribute the symmetric quantum key between the local quantum security service device and the peer quantum security service device. The quantum security service system uses the acquired quantum key directly or through derivation as an application key, and realizes the same symmetric key between the quantum security service devices at the two locations (i.e., the local quantum security service device and the peer quantum security service device) through the QKD network, thereby realizing secure distribution of the key.

[0025] The second part is the blockchain alliance chain network. The local organization and the peer organization create channel 1. The ordering (Orderer) node and entity node (Peer node) of the local organization and the peer organization join channel 1. A smart contract is created and deployed on at least one blockchain node (such as Orderer node, Peer node) on this alliance chain to manage the quantum security service in the quantum security service system.

[0026] It should be noted that quantum security service equipment is related to the organization, such as one organization generally corresponds to one quantum security service equipment. Figure 1 The communication system shown is only a schematic diagram, that is, the communication system may include Figure 1 There are more or fewer organizations or more blockchain nodes (such as Orderer nodes, Peer nodes), etc., which are not limited here. It is understood that Figure 1 The "CA" in the code stands for Electronic Certification Service.

[0027] Based on the aforementioned communication system, please refer to Figure 2 , is a flow chart of a communication method 200 provided in an embodiment of the present application. The method 200 may be executed by a local quantum security service device, such as software or hardware installed in the local quantum security service device. The local quantum security service device may be a terminal device or a server device, etc. Figure 2 As shown, the method 200 may include the following steps.

[0028] S210, the local quantum security service device communicates with at least one blockchain node.

[0029] Among them, Figure 1As shown, the blockchain (or blockchain alliance chain) corresponding to the at least one blockchain node includes at least one node in the local organization and at least one node in the opposite organization, the local organization corresponds to the local quantum security service device, the opposite organization corresponds to the opposite quantum security service device, and at least one blockchain node (such as peer node, Orderer node, etc.) on the blockchain is deployed with a smart contract, and the smart contract is configured with service call information for quantum security service calls to achieve the management of quantum security services in the quantum security service system, such as putting service calls or usage records of quantum security services on the chain to prevent tampering. In addition, the present application can also provide blockchain applications with quantum security services that are safer than traditional cryptography, enriching the service capabilities of blockchains.

[0030] It can be understood that the aforementioned service call information for quantum security service call may include but is not limited to the call condition information of quantum security service (such as automatically executing quantum security service related rules when predetermined conditions are met), call interface information (such as the interface information of the local quantum security service device involved in the quantum security service, the interface information of the quantum security distribution device, the interface information of the blockchain node where the smart contract is deployed, etc.), call timing information (such as allowing the quantum security service to be called within a predetermined time period, etc.), quantum security service method (such as quantum key creation method, quantum key acquisition method, quantum key update method, quantum key cancellation method, quantum key destruction method, quantum key deletion method, quantum key-based encryption / decryption method, quantum key-based hash-based message authentication code (Hash-basedMessage Authentication Code, HMAC) calculation / verification method), etc., which are not limited here. In other words, through the deployment of the smart contract, the call and execution of quantum security services can be realized to ensure the security of quantum security services.

[0031] Based on this, as a possible implementation method, Figure 3 As shown, the communication between the local quantum security service device and at least one blockchain node may include S310-S320, the content of which is as follows.

[0032] S310, the local quantum security service device receives a first quantum security service request sent by the first blockchain node.

[0033] Among them, the first quantum security service request carries quantum security service parameters, such as the key name and key identifier of the quantum key, the device information of the local quantum security service device, the device information of the peer quantum security service device, the key algorithm, the key length, etc., for requesting different quantum security services.

[0034] Optionally, in this embodiment, the first quantum security service request is sent by the first blockchain node when receiving a second communication quantum security service request sent by a blockchain client (or blockchain application, or decentralized application (Dapp)). For example, when the first blockchain node receives the second communication quantum security service request, it can determine the target quantum security service device (such as the local quantum security service device) and the first quantum security service request according to the quantum security service parameters carried in the second communication quantum security service request and the service call information configured in the smart contract, and then send the first quantum security service request to the local quantum security service device.

[0035] Of course, as a possible implementation method, the process of the first blockchain node determining the target quantum security service device according to the quantum security service parameters and the service call information configured in the smart contract may include: according to the quantum security service parameters and the service call information configured in the smart contract, selecting the quantum security service device closest to the first blockchain node or the blockchain client as the target quantum security service device, thereby improving the security and service efficiency of the quantum security service. It is understandable that the service call information is configured with device interface information involved in the quantum security service, quantum security service rules (quantum key creation method, update method, destruction method, HMAC verification method, encryption method, decryption method, etc.), etc., to realize the call of quantum security service.

[0036] It is worth noting that the first blockchain node belongs to the at least one blockchain node. In one implementation, the first blockchain node may be a peer node in an endorsement organization set by a gateway, etc., to obtain a more secure quantum security service capability, such as the first blockchain node may be but is not limited to a peer node in an endorsement organization closest to the local quantum security service device.

[0037] S320, the quantum security service device at the local end performs quantum security service according to the quantum security service parameters, and sends the quantum security service result and operation record to the first blockchain node.

[0038] The operation record is used to indicate the success or failure of the quantum security service.

[0039] Correspondingly, after receiving the quantum security service result and operation record sent by the quantum security service device on the local end, the first blockchain node sends the quantum security service result to the blockchain client, and sends the call record of the quantum security service and the operation record to the second blockchain node in the blockchain, so as to achieve the purpose of saving the call record of the quantum security service and the operation record to the blockchain. Therefore, on the one hand, it can provide quantum security services while also playing an anti-tampering role. On the other hand, it can also provide more secure quantum security services for blockchain applications and enrich the service capabilities of blockchain.

[0040] It is worth noting that in this embodiment, considering that the quantum security service may include but is not limited to quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption based on quantum key, data decryption based on quantum key, HMAC calculation based on quantum key, HMAC verification based on quantum key, etc., then, the implementation process of different quantum security services is described below, as follows.

[0041] 1. Quantum key creation

[0042] Assume that the quantum security service includes the quantum key creation, and the security service request is a first quantum key creation request, and the service call parameters in the smart contract include at least a key name, quantum security service device information, a key creation algorithm, and a key length. The key name is used to identify and distinguish quantum keys, the quantum security service device information is used to identify and distinguish the local and peer quantum security service devices for negotiating quantum keys, the key algorithm is used to specify the algorithm used for the key applied for creation, and the key length is used to specify the specific length of the key applied for creation.

[0043] Then, when quantum key creation is required, the blockchain client can send a second quantum security service request to the first blockchain node of the endorsement organization set by Gateway to call the key creation method in the smart contract. The first blockchain node determines the target quantum security service device (such as the local quantum security service device corresponding to the local organization) according to the key creation method in the smart contract, and sends a first quantum key creation request to the local quantum security service device corresponding to the local organization. The local quantum security service device sends a second quantum key creation request to the quantum key distribution device according to the first quantum key creation request. The quantum key distribution device generates a corresponding quantum key according to the parameters carried in the second quantum key creation request (such as local quantum security service device information, opposite quantum security service device information, key algorithm, key length, etc.), and sends the quantum key to the local quantum security service device. The local quantum security service device saves the quantum key and the key name in correspondence, and saves the operation records (such as key creation method call records, key creation records, etc.) and result status in the quantum key creation process to the blockchain, so as to achieve the purpose of tamper-proof and further improve the security of quantum security services.

[0044] Of course, in this embodiment, in addition to creating the quantum key, the local quantum security service device may initialize the quantum security service device information to determine the device identification and docking information of each quantum security service device.

[0045] Based on the quantum key created above, in a possible implementation, quantum key management operations such as quantum key acquisition, quantum key update, quantum key cancellation, quantum key destruction, and quantum key deletion can also be performed on the quantum key to achieve efficient management of the quantum key and ensure the security of the quantum key. The following are explained separately.

[0046] 2. Quantum key acquisition

[0047] Assuming that it is necessary to obtain the quantum key that has been created and saved on the quantum security service device, the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by the Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID and the local quantum security service device information.

[0048] Next, the first blockchain node determines to send a security service request (i.e., a quantum key acquisition request) to the local quantum security service device corresponding to the local quantum security service device information based on the second communication quantum security service request and the key acquisition method in the deployed smart contract. Then, the local quantum security service device can determine the quantum key, key algorithm, key length, key state, key material and other quantum key-related information based on the key identifier carried in the quantum key acquisition request.

[0049] Finally, the local quantum security service device returns the quantum key acquisition result (such as quantum key, key algorithm, key length, key status and other quantum key related information) to the first blockchain node, and saves the operation records in the key acquisition process (such as key acquisition method call records, key acquisition records, etc.) and result status (such as acquisition success or failure) to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0050] It should be noted that when it is necessary to obtain a quantum key, the key acquisition method of the smart contract is called to complete the acquisition of the key and return the key material.

[0051] 3. Quantum key update

[0052] Assuming that the quantum key created and saved on the quantum security service device needs to be updated, the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID and the quantum security service device information of the local end.

[0053] Next, the first blockchain node determines to send a security service request (i.e., a quantum key update request) to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the key update method in the deployed smart contract. Then, the local quantum security service device can interact with the quantum key distribution device according to the quantum key update request to generate a new quantum key.

[0054] Finally, the local quantum security service device returns the quantum key update result (such as the generated new quantum key, key identifier, etc.) to the first blockchain node, and saves the operation records (such as key update method call records, key update records, etc.) and result status (such as update success or failure) during the key update process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0055] It should be noted that when the quantum key needs to be updated, the key update method of the smart contract is called to complete the key update and return the new key ID.

[0056] 4. Quantum key cancellation

[0057] Assuming that it is necessary to cancel the quantum key that has been created and saved on the quantum security service device, the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID and the quantum security service device information of the local end.

[0058] Next, the first blockchain node determines to send a security service request (i.e., a quantum key cancellation request) to the local quantum security service device corresponding to the local quantum security service device information based on the second communication quantum security service request and the key cancellation method in the deployed smart contract. Then, the local quantum security service device can determine the quantum key based on the key identifier carried in the quantum key cancellation request, and modify the key state of the quantum key to an inactivated state.

[0059] Finally, the local quantum security service device returns the quantum key cancellation result (such as the key state of the quantum key has been changed to an inactive state) to the first blockchain node and the blockchain client, and saves the operation records (such as key cancellation method call records, key cancellation records, etc.) and result status (such as cancellation success or failure) during the key cancellation process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0060] It should be noted that when the quantum key needs to be cancelled, the key cancellation method of the smart contract is called to complete the cancellation of the key. After cancellation, the quantum key will not be able to be used for data encryption.

[0061] 5. Quantum key destruction

[0062] Assuming that the quantum key created and stored on the quantum security service device needs to be destroyed, the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID and the local quantum security service device information.

[0063] Next, the first blockchain node determines to send a security service request (i.e., a quantum key destruction request) to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the key destruction method in the deployed smart contract. Then, the local quantum security service device can determine the quantum key according to the key identifier carried in the quantum key destruction request, and modify the key state of the quantum key to a destroyed state.

[0064] Finally, the local quantum security service device returns the quantum key destruction result (such as the key state of the quantum key has been changed to the destroyed state) to the first blockchain node and the blockchain client, and saves the operation records (such as key destruction method call records, key destruction records, etc.) and result status (such as destruction success or failure) in the key destruction process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0065] It should be noted that when the quantum key needs to be destroyed, the key destruction method of the smart contract is called to complete the destruction of the key. After the destruction, the key cannot be used for any operation.

[0066] 6. Quantum Key Deletion

[0067] Assuming that the quantum key created and saved on the quantum security service device needs to be deleted, the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID and the quantum security service device information of the local end.

[0068] Next, the first blockchain node determines to send a security service request (i.e., a quantum key deletion request) to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the key deletion method in the deployed smart contract. Then, the local quantum security service device can determine the quantum key according to the key identifier carried in the quantum key deletion request and physically delete the quantum key.

[0069] Finally, the local quantum security service device returns the quantum key deletion result (such as the quantum key has been deleted) to the first blockchain node and the blockchain client, and saves the operation records (such as key deletion method call records, key deletion records, etc.) and result status (such as destruction success or failure) in the key deletion process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0070] It should be noted that when the quantum key needs to be deleted, the key deletion method of the smart contract can be called to complete the deletion of the key. After deletion, the key data cannot be recovered.

[0071] 7. The process of encryption based on quantum keys

[0072] Assuming that the data needs to be encrypted, and the quantum security service includes the data encryption based on the quantum key, and the security service request is a data encryption request, then the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by the Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry the key name or key ID, the data to be encrypted, and the quantum security service device information of the local end.

[0073] Next, the first blockchain node determines to send a security service request (i.e., a data encryption request) to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the encryption operation method in the deployed smart contract. Then, when the local quantum security service device receives the data encryption request (the data encryption request carries a key identifier and data to be encrypted), it can determine the quantum key and the encryption algorithm corresponding to the quantum key according to the key identifier, and encrypt the data to be encrypted according to the quantum key and the encryption algorithm to obtain encrypted data.

[0074] Finally, the local quantum security service device returns the quantum key encryption result (such as encrypted data) to the first blockchain node and the blockchain client, and saves the operation records (such as encryption method call records, data encryption records, etc.) and result status (such as encryption success or failure) in the quantum key encryption process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0075] 8. The process of decryption based on quantum key

[0076] Assuming that the data needs to be decrypted, and the quantum security service includes data decryption based on the quantum key, and the security service request is a data decryption request, then the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by the Gateway to call the smart contract deployed in the first blockchain node. The second communication quantum security service request may carry a key name or key ID, data to be decrypted, and local quantum security service device information.

[0077] Next, the first blockchain node determines to send a security service request to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the decryption operation method in the deployed smart contract. Then, when the local quantum security service device receives the data decryption request (the data decryption request carries a key identifier and data to be decrypted), it can determine the quantum key and the decryption algorithm corresponding to the quantum key according to the key identifier, and decrypt the data to be decrypted according to the quantum key and the decryption algorithm.

[0078] Finally, the local quantum security service device returns the quantum key decryption result (such as decrypted data) to the first blockchain node and the blockchain client, and saves the operation records (such as decryption method call records, data decryption records, etc.) and result status (such as decryption success or failure) in the quantum key decryption process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0079] 9. HMAC calculation process based on quantum key

[0080] Assuming that the HMAC value of the data needs to be calculated, and the quantum security service includes the HMAC calculation based on the quantum key, and the security service request is an HMAC calculation request, then the blockchain client sends a second communication quantum security service request to the first blockchain node in the endorsement organization set by the Gateway. The second communication quantum security service request may carry a key name or key ID, data to be calculated, and local quantum security service device information.

[0081] Next, the first blockchain node determines to send a security service request to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the HAMC calculation method in the deployed smart contract. Then, when receiving the HMAC calculation request, the local quantum security service device can determine the quantum key and the cryptographic algorithm corresponding to the quantum key according to the key identifier carried in the HMAC calculation request, and then perform HMAC calculation on the data to be calculated carried in the HMAC calculation request according to the quantum key and the cryptographic algorithm to obtain the HMAC value.

[0082] Finally, the local quantum security service device returns the HMAC value to the first blockchain node and the blockchain client, and saves the operation records (such as HMAC calculation method call records, HMAC calculation records, etc.) and result status (such as HMAC value calculation success or failure) in the HMAC calculation process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0083] 10. HMAC verification process based on quantum key

[0084] Assuming that the HMAC calculation process in the above 8 calculates the first HMAC value, and the quantum security service includes the HMAC verification based on the quantum key, and the security service request is an HMAC verification request, then the blockchain client sends a second communication quantum security service request to the first blockchain node of the endorsement organization set by the Gateway. The second communication quantum security service request may carry a key name or key ID, data to be verified, the first HMAC value, and the quantum security service device information of the local end.

[0085] Next, the first blockchain node determines to send a security service request to the local quantum security service device corresponding to the local quantum security service device information according to the second communication quantum security service request and the HAMC verification method in the deployed smart contract. Then, when the local quantum security service device receives the HMAC verification request and the HMAC verification request carries a key identifier, data to be verified, and a first HMAC value, it can determine the quantum key and the cryptographic algorithm corresponding to the quantum key according to the key identifier; then perform HMAC calculation on the data to be verified according to the quantum key and the cryptographic algorithm to obtain a second HMAC value; and determine the HMAC verification result according to the first HMAC value and the second HMAC value. If the first HMAC value and the second HMAC value are consistent, the HMAC verification result is determined to be a verification pass; otherwise, the HMAC verification result is determined to be a verification failure.

[0086] Finally, the local quantum security service device returns the HMAC verification result to the first blockchain node and the blockchain client, and saves the operation records (such as HMAC verification method call records, HMAC verification records, etc.) and result status (such as HMAC verification success or failure) in the HMAC verification process to the blockchain to achieve the purpose of tamper-proofing and further enhance the security of quantum security services.

[0087] In the embodiment of the present application, by adopting the blockchain alliance chain smart contract to manage the quantum key service and cryptographic service interface of the quantum security service system, on the basis of improving the security of the blockchain platform itself, it can not only provide tamper-proof protection for the operation and usage records of the quantum security service system, but also provide blockchain applications with quantum security services that are more secure than traditional cryptography, thereby enriching the service capabilities of the blockchain.

[0088] Figure 4A flow chart of a communication method 400 provided in an embodiment of the present application is shown, and the method can be executed by a first blockchain node, such as a terminal device or a server device. In other words, the method 400 can be executed by software or hardware installed in a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. Figure 4 As shown, the method 400 may include but is not limited to the following steps.

[0089] S410, the first blockchain node communicates with the local quantum security service device.

[0090] The blockchain includes at least one node in a local organization and at least one node in a peer organization, the local organization corresponds to the local quantum security service device, the peer organization corresponds to the peer quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

[0091] Optionally, the communicating with the local quantum security service device includes: receiving a second communication quantum security service request sent by the blockchain client, the second communication quantum security service request carrying a quantum security service parameter; determining a target quantum security service device and a first quantum security service request according to the quantum security service parameter and the service call information configured in the smart contract; and sending the first quantum security service request to the target quantum security service device, the target quantum security service device including the local quantum security service device.

[0092] Optionally, the quantum security service includes at least one of quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption, data decryption, HMAC calculation, and HMAC verification.

[0093] Optionally, the quantum security service parameters include at least one of a key name, a key identifier, device information of a local quantum security service device, device information of a peer quantum security service device, a key algorithm, and a key length.

[0094] Optionally, determining a target quantum security service device according to the quantum security service parameters and the smart contract includes: selecting a quantum security service device closest to the first blockchain node or the blockchain client as the target quantum security service device according to the quantum security service parameters and service call information of the quantum security service configured in the smart contract.

[0095] Optionally, the communication with the local quantum security service device further includes: receiving a quantum security service result and an operation record sent by the target quantum security service device, wherein the operation record is used to indicate the success or failure of the quantum security service; sending the quantum security service result to the blockchain client, and saving the call record of the quantum security service and the operation record to the blockchain.

[0096] It can be understood that each implementation method in method embodiment 400 has the same or corresponding technical features as the aforementioned method embodiments 200-300. Therefore, each implementation method in method embodiment 400 can refer to the description of the aforementioned method embodiments 200-300 and achieve the same or corresponding technical features. To avoid repetition, they will not be repeated here.

[0097] Figure 5 A structural schematic diagram of a communication device 500 provided in an embodiment of the present application is shown, and the device 500 includes: a communication module 510, which is used to communicate with at least one blockchain node; wherein the blockchain corresponding to the at least one blockchain node includes at least one node in a local organization and at least one node in a peer organization, the local organization corresponds to the local quantum security service device, the peer organization corresponds to the peer quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

[0098] Optionally, the communication module 510 communicates with at least one blockchain node, including: receiving a first quantum security service request sent by a first blockchain node, the first quantum security service request carrying quantum security service parameters, and the smart contract being deployed on the first blockchain node; performing quantum security service according to the quantum security service parameters, and sending the quantum security service result and operation record to the first blockchain node, wherein the operation record is used to indicate the success or failure of the quantum security service.

[0099] Optionally, the quantum security service includes at least one of quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption based on quantum key, data decryption based on quantum key, HMAC calculation based on quantum key, and HMAC verification based on quantum key.

[0100] Optionally, the quantum security service parameters include at least one of a key name of the quantum key, a key identifier, device information of a local quantum security service device, device information of a peer quantum security service device, a key algorithm, and a key length.

[0101] Optionally, the communication module 510 performs quantum security service according to the quantum security service parameters, including: determining that the quantum security service includes the quantum key creation, and the first quantum security service request is a first quantum key creation request, the first quantum key creation request carries a key name, a key identifier, a key algorithm, a key length, and device information of a quantum security service device on the other end; sending a second quantum key creation request to the quantum key distribution device according to the first quantum key creation request; receiving the quantum key sent by the quantum key distribution device, and saving the quantum key in correspondence with the key name.

[0102] Optionally, the communication module 510 performs quantum security service according to the quantum security service parameters, including: determining that the quantum security service includes data encryption based on the quantum key, and the security service request is a data encryption request, and the data encryption request carries a key identifier and data to be encrypted; determining a quantum key and an encryption algorithm corresponding to the quantum key according to the key identifier; encrypting the data to be encrypted according to the quantum key and the encryption algorithm to obtain encrypted data.

[0103] Optionally, the communication module 510 performs quantum security service according to the quantum security service parameters, including: determining that the quantum security service includes data decryption based on the quantum key, the security service request is a data decryption request, and the data decryption request carries a key identifier and data to be decrypted; determining a quantum key and a decryption algorithm corresponding to the quantum key according to the key identifier; and decrypting the data to be decrypted according to the quantum key and the decryption algorithm.

[0104] Optionally, the communication module 510 performs a quantum security service according to the quantum security service parameters, including: determining that the quantum security service includes the HMAC calculation based on the quantum key, and the security service request is an HMAC calculation request, and the HMAC calculation request carries a key identifier and data to be calculated; determining a quantum key and a cryptographic algorithm corresponding to the quantum key according to the key identifier; performing an HMAC calculation on the data to be calculated according to the quantum key and the cryptographic algorithm to obtain an HMAC value.

[0105] Optionally, the communication module 510 performs a quantum security service according to the quantum security service parameters, including: determining that the quantum security service includes the HMAC verification based on the quantum key, and the security service request is an HMAC verification request, and the HMAC verification request carries a key identifier, data to be verified, and a first HMAC value; determining a quantum key and a cryptographic algorithm corresponding to the quantum key according to the key identifier; performing an HMAC calculation on the data to be verified according to the quantum key and the cryptographic algorithm to obtain a second HMAC value; and determining an HMAC verification result according to the first HMAC value and the second HMAC value.

[0106] like Figure 6 As shown, it is a structural schematic diagram of a communication device 600 provided by an exemplary embodiment of the present application, which is applied to a first blockchain node on a blockchain, and the device 600 includes: a communication module 610 is used to communicate with a local quantum security service device; wherein, the blockchain includes at least one node in a local organization and at least one node in a peer organization, the local organization corresponds to the local quantum security service device, the peer organization corresponds to the peer quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

[0107] Optionally, the communication module 610 communicates with a local quantum security service device, including: receiving a second communication quantum security service request sent by the blockchain client, the second communication quantum security service request carrying a quantum security service parameter; determining a target quantum security service device and a first quantum security service request according to the quantum security service parameter and the service call information configured in the smart contract; and sending the first quantum security service request to the target quantum security service device, the target quantum security service device including the local quantum security service device.

[0108] Optionally, the quantum security service includes at least one of quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption, data decryption, HMAC calculation, and HMAC verification.

[0109] Optionally, the quantum security service parameters include at least one of a key name, a key identifier, device information of a local quantum security service device, device information of a peer quantum security service device, a key algorithm, and a key length.

[0110] Optionally, the communication module 610 determines the target quantum security service device according to the quantum security service parameters and the smart contract, including: selecting the quantum security service device closest to the first blockchain node or the blockchain client as the target quantum security service device according to the quantum security service parameters and the service call information configured in the smart contract.

[0111] Optionally, the communication module 610 communicates with the local quantum security service device, and also includes: receiving a quantum security service result and an operation record sent by the target quantum security service device, wherein the operation record is used to indicate the success or failure of the quantum security service; sending the quantum security service result to the blockchain client, and saving the call record of the quantum security service and the operation record to the blockchain.

[0112] The devices 500-600 provided in the embodiments of the present application can execute the methods described in the foregoing method embodiments and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be described in detail here.

[0113] Figure 7 A schematic diagram of the hardware structure of an electronic device that implements the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device includes a processor, and optionally, an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0114] The processor, the network interface and the memory may be interconnected through an internal bus, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0115] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0116] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a device for locating the specified user at the logical level. The processor executes the program stored in the memory and is specifically used to execute: Figure 2-Figure 4 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0117] The above application Figure 2-Figure 4 The method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0118] The electronic device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.

[0119] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0120] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 2-Figure 4 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0121] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0122] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1-Figure 3 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.

[0123] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0124] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0125] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0126] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0127] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A communication method, characterized in that: Applied to a local quantum security service device, the method includes: Communicate with at least one blockchain node; Among them, the blockchain corresponding to the at least one blockchain node includes at least one node in the local organization and at least one node in the opposite organization, the local organization corresponds to the local quantum security service device, the opposite organization corresponds to the opposite quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

2. The method according to claim 1, characterized in that The communicating with at least one blockchain node comprises: Receiving a first quantum secure service request sent by a first blockchain node, wherein the first quantum secure service request carries a quantum secure service parameter, and the smart contract is deployed on the first blockchain node; Performing a quantum security service according to the quantum security service parameters, and sending the quantum security service result and an operation record to the first blockchain node, wherein the operation record is used to indicate the success or failure of the quantum security service; Wherein, the first blockchain node belongs to the at least one blockchain node.

3. The method according to claim 2, characterized in that The quantum security service includes at least one of quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption based on quantum key, data decryption based on quantum key, HMAC calculation based on quantum key, and HMAC verification based on quantum key.

4. The method according to claim 3, characterized in that The quantum security service parameters include at least one of a key name of the quantum key, a key identifier, device information of a local quantum security service device, device information of a peer quantum security service device, a key algorithm, and a key length.

5. The method according to claim 3, characterized in that The performing of the quantum security service according to the quantum security service parameter includes: Determining that the quantum security service includes the quantum key creation, and the first quantum security service request is a first quantum key creation request, wherein the first quantum key creation request carries a key name, a key identifier, a key algorithm, a key length, and device information of a peer quantum security service device; Sending a second quantum key creation request to a quantum key distribution device according to the first quantum key creation request; Receive a quantum key sent by the quantum key distribution device, and save the quantum key and the key name in correspondence with each other.

6. The method according to any one of claims 3 to 5, characterized in that The performing of the quantum security service according to the quantum security service parameter includes: Determining that the quantum secure service includes the data encryption based on the quantum key, and the first quantum secure service request is a data encryption request, and the data encryption request carries a key identifier and data to be encrypted; Determine a quantum key and an encryption algorithm corresponding to the quantum key according to the key identifier; The data to be encrypted is encrypted according to the quantum key and the encryption algorithm to obtain encrypted data.

7. The method according to any one of claims 3 to 5, characterized in that The performing of the quantum security service according to the quantum security service parameter includes: Determining that the quantum security service includes data decryption based on the quantum key, the security service request is a data decryption request, and the data decryption request carries a key identifier and data to be decrypted; Determine a quantum key and a decryption algorithm corresponding to the quantum key according to the key identifier; The data to be decrypted is decrypted according to the quantum key and the decryption algorithm.

8. The method according to any one of claims 3 to 5, characterized in that The performing of the quantum security service according to the quantum security service parameter includes: Determining that the quantum security service includes the HMAC calculation based on the quantum key, and the security service request is an HMAC calculation request, and the HMAC calculation request carries a key identifier and data to be calculated; Determine a quantum key and a cryptographic algorithm corresponding to the quantum key according to the key identifier; Perform HMAC calculation on the data to be calculated according to the quantum key and the cryptographic algorithm to obtain an HMAC value.

9. The method according to any one of claims 3 to 5, characterized in that: The performing of the quantum security service according to the quantum security service parameter includes: Determining that the quantum security service includes the HMAC verification based on the quantum key, and the security service request is an HMAC verification request, and the HMAC verification request carries a key identifier, data to be verified, and a first HMAC value; Determine a quantum key and a cryptographic algorithm corresponding to the quantum key according to the key identifier; Performing HMAC calculation on the data to be verified according to the quantum key and the cryptographic algorithm to obtain a second HMAC value; An HMAC verification result is determined according to the first HMAC value and the second HMAC value.

10. A communication method, characterized in that: Applied to a first blockchain node on a blockchain, the method comprises: Communicate with the local quantum security service device; The blockchain includes at least one node in a local organization and at least one node in a peer organization, the local organization corresponds to the local quantum security service device, the peer organization corresponds to the peer quantum security service device, and a smart contract is deployed on at least one blockchain node on the blockchain, and the smart contract is configured with service call information for quantum security service calls.

11. The method according to claim 10, characterized in that The communicating with the local quantum security service device includes: Receiving a second communication quantum security service request sent by a blockchain client, wherein the second communication quantum security service request carries a quantum security service parameter; Determine a target quantum security service device and a first quantum security service request according to the quantum security service parameters and the service call information configured in the smart contract; The first quantum secure service request is sent to the target quantum secure service device, where the target quantum secure service device includes the local quantum secure service device.

12. The method according to claim 10 or 11, characterized in that The quantum security service includes at least one of quantum key creation, quantum key acquisition, quantum key activation, quantum key update, quantum key cancellation, quantum key destruction, quantum key deletion, data encryption, data decryption, HMAC calculation, and HMAC verification.

13. The method according to claim 12, characterized in that The quantum security service parameters include at least one of a key name, a key identifier, device information of a local quantum security service device, device information of a peer quantum security service device, a key algorithm, and a key length.

14. The method according to claim 11, characterized in that Determining a target quantum security service device according to the quantum security service parameter and the service call information configured in the smart contract includes: According to the quantum security service parameters and the service call information configured in the smart contract, a quantum security service device closest to the first blockchain node or the blockchain client is selected as the target quantum security service device.

15. The method according to claim 11, characterized in that The communicating with the local quantum security service device also includes: Receiving a quantum security service result and an operation record sent by the target quantum security service device, wherein the operation record is used to indicate whether the quantum security service succeeds or fails; The quantum security service result is sent to the blockchain client, and the call record of the quantum security service and the operation record are saved to the blockchain.

16. An electronic device comprising: processor; as well as A memory arranged to store computer executable instructions which, when executed, cause the processor to perform the steps of the method of any one of claims 1 to 15.

17. A computer-readable medium storing one or more programs, which, when executed by an electronic device including a plurality of application programs, causes the electronic device to execute the steps of the method according to any one of claims 1 to 15.

Images