Quantum key charging method, device and system, storage medium and computer program product

Abstract

The quantum key charging method disclosed by the invention comprises the following steps: if a charging permission message which is sent by a charging service terminal and comprises an authorization token is received, obtaining a first encryption key; generating a second encryption key corresponding to the identity recognition module; performing encryption processing on the second encryption key by adopting the first encryption key to obtain first encryption information; sending the first token verification information and the first encryption information to a charging service terminal; receiving second token verification information and second encryption key verification information sent by the charging service terminal; after the second token verification information and the second encryption key verification information pass verification, m quantum keys distributed to the identity recognition module are determined; performing encryption processing on the m quantum keys by adopting a second encryption key to obtain second encryption information; and sending the first token verification information and the second encryption information to the charging service terminal. The invention further discloses a quantum key charging device and system, a storage medium and a computer program product.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a quantum key injection method, device, equipment, storage medium and computer program product. Background Art

[0002] With the rapid development of wireless communication technology, the application of wireless communication technology is becoming more and more extensive. How to ensure the security of information transmitted during the communication process has become a technical problem that needs to be solved urgently. At present, the commonly used technical means is to encrypt the transmitted information, so that even if the encrypted data is stolen, it is not easy to be cracked, which ensures the security of the transmitted information. At present, with the introduction of quantum secure communication technology, when using quantum keys in the communication process, how to inject quantum keys and ensure the security of quantum keys has become a technical problem that needs to be solved urgently.

[0003] Application Contents

[0004] In order to solve the above technical problems, the present application hopes to provide a quantum key filling method, device, equipment, storage medium and computer program product, which solves the problem of leakage risk in the current quantum key filling process, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0005] The technical solution of this application is implemented as follows:

[0006] The present application provides a quantum key filling method, which is applied to a quantum key server, and the method includes:

[0007] If a recharging permission message including an authorization token is received from the recharging service terminal, a first encryption key is obtained; wherein the authorization token is authorization information assigned by the recharging management end to the identity recognition module installed in the recharging service terminal;

[0008] Generate a second encryption key corresponding to the identity recognition module;

[0009] Using the first encryption key to encrypt the second encryption key to obtain first encrypted information;

[0010] sending first token verification information and the first encrypted information to the refill service terminal, so that after the first token verification information passes the verification of the refill service terminal, the first encrypted information is decrypted by the identity recognition module based on the first decryption key to obtain the second encryption key, and the first token verification information is associated with the authorization token;

[0011] Receiving second token verification information and second encryption key verification information sent by the filling service terminal; wherein the second encryption key verification information is associated with the second encryption key;

[0012] After both the second token verification information and the second encryption key verification information are verified, determining m quantum keys allocated to the identity recognition module; wherein the second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1;

[0013] Using the second encryption key to encrypt the m quantum keys to obtain second encrypted information;

[0014] The first token verification information and the second encrypted information are sent to the filling service terminal, so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

[0015] The present application provides a quantum key injection method, which is applied to an injection service terminal equipped with an identity recognition module, and the method includes:

[0016] Receive an authorization token sent by the charging management end; wherein the authorization token is token information allocated to the identity recognition module by the charging management end after the identity recognition module passes the identity authentication of the charging management end;

[0017] Sending a filling permission message including the authorization token to the quantum key service end;

[0018] Receive first token verification information and first encryption information sent by the quantum key service end; wherein the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management end to the identity recognition module;

[0019] After the first token verification information is verified, the first encrypted information is decrypted by the identity recognition module using a first decryption key to obtain a second encryption key; wherein the first decryption key is stored in the identity recognition module;

[0020] generating second encryption key verification information based on the second encryption key by the identity recognition module;

[0021] Sending the stored second token verification information and the second encryption key verification information to the quantum key service end;

[0022] Receiving the first token verification information and the second encryption information sent by the quantum key service end; wherein the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified;

[0023] After the first token verification information is verified, the second encrypted information is decrypted by the identity recognition module using the second encryption key to obtain m quantum keys;

[0024] The m quantum keys are stored in a key storage area of ​​the identity recognition module through the identity recognition module.

[0025] The present application provides a quantum key injection method, which is applied to an injection management terminal, and the method includes:

[0026] Determine the authorization token corresponding to the identity recognition module installed in the charging service terminal;

[0027] Send the authorization token to the filling service terminal so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

[0028] The present application provides a first quantum key filling device, which is applied to a quantum key service end, and includes: an acquisition unit, a first generation unit, an encryption processing unit, a first sending unit, and a first determination unit; wherein:

[0029] The acquisition unit is used to acquire the first encryption key if a recharging permission message including an authorization token is received from the recharging service terminal; wherein the authorization token is authorization information allocated by the recharging management terminal to the identity recognition module installed in the recharging service terminal;

[0030] The first generating unit is used to generate a second encryption key corresponding to the identity recognition module;

[0031] The encryption processing unit is used to encrypt the second encryption key using the first encryption key to obtain first encrypted information;

[0032] The first sending unit is used to send the first token verification information and the first encrypted information to the refill service terminal, so that after the first token verification information passes the verification of the refill service terminal, the first encrypted information is decrypted by the identity recognition module based on the first decryption key to obtain the second encryption key, and the first token verification information is associated with the authorization token;

[0033] The acquisition unit is further configured to receive second token verification information and second encryption key verification information sent by the filling service terminal; wherein the second encryption key verification information is associated with the second encryption key;

[0034] The first determination unit is used to determine the m quantum keys allocated to the identity recognition module after the second token verification information and the second encryption key verification information are both verified; wherein the second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1;

[0035] The encryption processing unit is used to use the second encryption key to encrypt the m quantum keys to obtain second encrypted information;

[0036] The first sending unit is used to send the first token verification information and the second encrypted information to the filling service terminal, so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

[0037] The present application provides a second quantum key injection device, which is applied to a injection service terminal equipped with an identity recognition module, and includes: a first receiving unit, a decryption processing unit, a second generating unit, a second sending unit and a first storage unit; wherein:

[0038] The first receiving unit is used to receive an authorization token sent by the charging management end; wherein the authorization token is the token information allocated by the charging management end to the identity recognition module after the identity recognition module passes the identity authentication of the charging management end;

[0039] The second sending unit is used to send a charging permission message including the authorization token to the quantum key service end;

[0040] The first receiving unit is further used to receive first token verification information and first encryption information sent by the quantum key service end; wherein the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management end to the identity recognition module;

[0041] The decryption processing unit is used to decrypt the first encrypted information using the first decryption key through the identity recognition module to obtain a second encryption key after the first token verification information is verified; wherein the first decryption key is stored in the identity recognition module;

[0042] The second generating unit is configured to generate second encryption key verification information based on the second encryption key through the identity recognition module;

[0043] The second sending unit is used to send the stored second token verification information and the second encryption key verification information to the quantum key service end;

[0044] The first receiving unit is further used to receive the first token verification information and the second encryption information sent by the quantum key service end; wherein the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified;

[0045] The decryption processing unit is further configured to, after the first token verification information is verified, decrypt the second encrypted information using the second encryption key through the identity recognition module to obtain m quantum keys;

[0046] The first storage unit is used to store the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.

[0047] The present application provides a third quantum key injection device, which is applied to an injection management terminal, and includes: a second determination unit and a third sending unit; wherein:

[0048] The second determining unit is used to determine the authorization token corresponding to the identity recognition module installed in the filling service terminal;

[0049] The third sending unit is used to send the authorization token to the filling service terminal, so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

[0050] The present application provides a quantum key filling system, the system comprising at least: a quantum key service end, a filling service terminal equipped with an identity recognition module, and a filling management end; wherein:

[0051] The quantum key server is used to implement the steps of the quantum key filling method as described in any one of the above items;

[0052] The filling service terminal is used to implement the steps of the quantum key filling method as described in any one of the above items;

[0053] The injection management end is used to implement the steps of the quantum key injection method as described in any one of the above items.

[0054] The present application provides a storage medium, on which a quantum key injection program is stored. When the quantum key injection program is executed, it is used to implement the steps of the quantum key injection method as described in any one of the above items.

[0055] The present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the quantum key injection method as described in any one of the above items.

[0056] The embodiments of the present application provide a quantum key filling method, apparatus, device, storage medium and computer program product, wherein the filling management terminal determines the authorization token corresponding to the identity recognition module installed in the filling service terminal, and after sending the authorization token to the filling service terminal, the filling service terminal receives the authorization token sent by the filling management terminal, and sends a filling permission message including the authorization token to the quantum key service terminal. If the filling permission message including the authorization token sent by the filling service terminal is received, the quantum key service terminal obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain first encrypted information, and then sends first token verification information and the first encrypted information to the filling service terminal. After the filling service terminal receives the first token information and the first encrypted information sent by the quantum key service terminal, after the first token verification information is verified, the first encrypted information is decrypted using the first decryption key through the identity recognition module to obtain the second The charging service terminal generates an encryption key, and after generating second encryption key verification information based on the second encryption key through the identity recognition module, sends the stored second token verification information and the second encryption key verification information to the quantum key server. The quantum key server receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, determines the m quantum keys allocated to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal. After the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key server, after the first token verification information is verified, uses the second encryption key to decrypt the second encryption information through the identity recognition module to obtain m quantum keys, and finally stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. In this way, the identity recognition module can use the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and store them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of quantum key filling, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 Schematic diagram of the process of quantum key injection method provided in the embodiment of the present application Figure 1 ;

[0058] Figure 2 Schematic diagram of the process of quantum key injection method provided in the embodiment of the present application Figure 2 ;

[0059] Figure 3 Schematic diagram of the process of quantum key injection method provided in the embodiment of the present application Figure 3 ;

[0060] Figure 4 Schematic diagram of the process of quantum key injection method provided in the embodiment of the present application Figure 4 ;

[0061] Figure 5 A schematic diagram of an application scenario of a quantum key injection method provided in an embodiment of the present application;

[0062] Figure 6 A schematic diagram of the structure of a first quantum key injection device provided in an embodiment of the present application;

[0063] Figure 7 A schematic diagram of the structure of a second quantum key injection device provided in an embodiment of the present application;

[0064] Figure 8 A schematic diagram of the structure of a third quantum key injection device provided in an embodiment of the present application;

[0065] Fig. 9 A schematic diagram of the structure of a quantum key injection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0067] The embodiment of the present application provides a quantum key injection method, referring to Figure 1 As shown, the method is applied to a quantum key server, and the method comprises the following steps:

[0068] Step 101: If a recharging permission message including an authorization token is received from a recharging service terminal, a first encryption key is obtained.

[0069] The authorization token is the authorization information assigned by the charging management end to the identity recognition module installed in the charging service terminal.

[0070] In the embodiment of the present application, the quantum key service end may be a service end having a computing management function and providing quantum cryptography, such as a server device, a cloud, a platform, etc. The charging service terminal is a specific terminal device that provides quantum key charging services, which may be used in scenarios such as communication business halls. The charging management end may be a management end that manages the quantum key charging process, such as a server, a computer device, etc., or a management center, a management platform, etc. The identity recognition module may be a module for uniquely identifying a communication object, such as a Universal Subscriber Identity Module (USIM) card.

[0071] Step 102: Generate a second encryption key corresponding to the identity recognition module.

[0072] In the embodiment of the present application, the quantum key server uses a preset key generation algorithm to generate a corresponding second encryption key and assigns it to the identity recognition module. The second encryption key is a key used to subsequently encrypt the transmitted quantum key.

[0073] Step 103: Use the first encryption key to encrypt the second encryption key to obtain first encrypted information.

[0074] In the embodiment of the present application, based on a preset encryption algorithm, the second encryption key is encrypted using the first encryption key to obtain the first encrypted information.

[0075] Step 104: Send the first token verification information and the first encrypted information to the charging service terminal.

[0076] Among them, the first token verification information and the first encrypted information are sent to the charging service terminal, so that after the first token verification information passes the verification of the charging service terminal, the first encrypted information is decrypted based on the first decryption key through the identity recognition module to obtain the second encryption key, and the first token verification information is associated with the authorization token.

[0077] In an embodiment of the present application, the quantum key service end sends the first token verification information and the first encryption information to the charging service terminal at the same time, wherein the charging service terminal verifies the first token verification information, and the first encryption information is verified by the identity recognition module in the charging service terminal.

[0078] Step 105: Receive the second token verification information and the second encryption key verification information sent by the charging service terminal.

[0079] The second encryption key verification information is associated with the second encryption key.

[0080] In an embodiment of the present application, the second token verification information is associated with the authorization token sent by the charging management end, and the second encryption key verification information is the verification information obtained after the identity recognition module in the charging service terminal performs corresponding processing on the second encryption key, which is used to feed back to the quantum key service end so that the quantum key service end can verify it, and then determine whether the second encryption key received by the charging service terminal has been tampered with or replaced, thereby reducing the risk of information leakage.

[0081] Step 106: After the second token verification information and the second encryption key verification information are both verified, determine the m quantum keys allocated to the identity recognition module.

[0082] The second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1.

[0083] In the embodiment of the present application, m can be determined by the amount of data allowed to be transmitted through the information transmission channel between the quantum key service end and the identity recognition module, or it can be a pre-agreed empirical value that can be agreed upon, which can be determined by the actual situation. The quantum key service end verifies the second token verification information and the second encryption key verification information respectively. When both the second token verification information and the second encryption key verification information are verified, that is, when there is no problem with both information, the m quantum keys assigned to the identity recognition module are determined. The m quantum keys can be part of the quantum keys that have been generated in advance, or they can be generated according to the identity recognition module, which can be determined by the actual situation.

[0084] Step 107: Use the second encryption key to encrypt the m quantum keys to obtain second encrypted information.

[0085] In an embodiment of the present application, based on a preset encryption algorithm, a second encryption key is used to encrypt the determined m quantum keys to obtain second encrypted information.

[0086] Step 108: Send the first token verification information and the second encrypted information to the charging service terminal.

[0087] The first token verification information and the second encrypted information are sent to the charging service terminal so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

[0088] In an embodiment of the present application, after the second encrypted information is generated, the first token verification information and the second encrypted information are simultaneously sent to the charging service terminal, so that the charging service terminal verifies the received first token verification information, and after the verification is passed, the second encrypted information is decrypted by the identity recognition module to obtain m quantum keys.

[0089] The quantum key charging method provided in the embodiment of the present application, if a charging permission message including an authorization token is received from a charging service terminal, the quantum key service terminal obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain the first encrypted information, and then sends the first token verification information and the first encrypted information to the charging service terminal, so that after the charging service terminal receives the first token information and the first encrypted information sent by the quantum key service terminal, after the first token verification information is verified, the first encrypted information is decrypted by the identity recognition module using the first decryption key to obtain the second encryption key, and after the identity recognition module generates the second encryption key verification information based on the second encryption key, the stored second token verification information and the second encryption key are sent. The quantum key service terminal sends the verification information to the quantum key service terminal, and the quantum key service terminal receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are verified, determines the m quantum keys assigned to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain the second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal, so that after the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key service terminal, after the first token verification information is verified, uses the second encryption key to decrypt the second encryption information through the identity recognition module to obtain the m quantum keys, and stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. In this way, the identity recognition module can use the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and store them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of quantum key filling, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0090] Based on the above embodiments, the embodiments of the present application provide a quantum key injection method, which is applied to an injection service terminal equipped with an identity recognition module, referring to Figure 2 As shown, the method comprises the following steps:

[0091] Step 201: Receive the authorization token sent by the charging management terminal.

[0092] The authorization token is the token information allocated to the identity recognition module by the charging management end after the identity recognition module passes the identity authentication of the charging management end.

[0093] Step 202: Send a filling permission message including an authorization token to the quantum key service end.

[0094] Step 203: Receive first token verification information and first encryption information sent by the quantum key server.

[0095] Among them, the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management terminal to the identity recognition module.

[0096] Step 204: After the first token verification information is verified, the first encrypted information is decrypted using the first decryption key through the identity recognition module to obtain a second encryption key.

[0097] The first decryption key is stored in the identity recognition module.

[0098] In an embodiment of the present application, the charging service terminal verifies the received first token verification information, and after the first token verification information is verified, instructs the identity recognition module to use the first decryption key to decrypt the first encrypted information to obtain a second encryption key.

[0099] Step 205: Generate second encryption key verification information based on the second encryption key through the identity recognition module.

[0100] In the embodiment of the present application, after the identity recognition module of the filling service terminal decrypts and obtains the second encryption key, the second encryption key is processed to obtain second encryption key verification information.

[0101] Step 206: Send the stored second token verification information and second encryption key verification information to the quantum key service end.

[0102] Step 207: Receive the first token verification information and the second encryption information sent by the quantum key server.

[0103] Among them, the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified.

[0104] Step 208: After the first token verification information is verified, the second encrypted information is decrypted using the second encryption key through the identity recognition module to obtain m quantum keys.

[0105] In an embodiment of the present application, the charging service terminal verifies the first token verification information. After the first token verification information is verified, the identity recognition module is instructed to use the second encryption key decrypted by the identity recognition module to decrypt the received second encrypted information, so that the identity recognition module obtains m quantum keys.

[0106] Step 209: Store m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.

[0107] In this way, the first encrypted information is decrypted through the identity recognition module to obtain the second encryption key, and the second encrypted information is decrypted to obtain m quantum keys, so that the quantum key service end can charge the quantum key of the identity recognition module, thereby ensuring that the second encryption key for decrypting the m quantum keys and the second encrypted information including the m quantum keys are not processed by the charging service terminal, but are decrypted and stored by the identity recognition module installed in the charging service terminal, thereby reducing the risk of the second encryption key and the m quantum keys being leaked at the charging service terminal. Furthermore, in each transmission process, the first token verification information corresponding to the authorization token will be verified to achieve double verification, thereby ensuring the security of the information and reducing the possibility of the information being mistransmitted or modified.

[0108] The quantum key filling method provided in the embodiment of the present application receives the authorization token sent by the filling management terminal through the filling service terminal, and sends a filling permission message including the authorization token to the quantum key service end, so that after the quantum key service end receives the filling permission message including the authorization token sent by the filling service terminal, it obtains the first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain the first encrypted information, and then sends the first token verification information and the first encrypted information to the filling service terminal. After the filling service terminal receives the first token information and the first encrypted information sent by the quantum key service end, after the first token verification information is verified, the first encryption information is decrypted by the identity recognition module using the first decryption key to obtain the second encryption key, and the identity recognition module generates the second encryption key verification information based on the second encryption key. After that, the stored second token verification information and the second encryption key verification information are sent to the quantum key service end, so that the quantum key service end receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, the m quantum keys assigned to the identity recognition module are determined, the m quantum keys are encrypted with the second encryption key to obtain the second encrypted information, and the first token verification information and the second encrypted information are sent to the charging service terminal. In this way, after the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key service end, after the first token verification information is verified, the second encryption key is used to decrypt the second encrypted information through the identity recognition module to obtain the m quantum keys, and finally the m quantum keys are stored in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. In this way, the identity recognition module can use the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and store them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of quantum key filling, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0109] Based on the above embodiments, the embodiments of the present application provide a quantum key injection method, which is applied to the injection management end, referring to Figure 3 As shown, the method comprises the following steps:

[0110] Step 301: Determine the authorization token corresponding to the identity recognition module installed in the charging service terminal.

[0111] In the embodiment of the present application, the authorization token may be token information generated in advance by the charging management end for the identity recognition module using a token generation method.

[0112] Step 302: Send the authorization token to the charging service terminal.

[0113] Among them, the authorization token is sent to the filling service terminal, so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

[0114] The quantum key charging method provided in the embodiment of the present application determines the authorization token corresponding to the identity recognition module installed in the charging service terminal through the charging management end, and sends the authorization token to the charging service terminal so that the charging service terminal receives the authorization token sent by the charging management end, and sends a charging permission message including the authorization token to the quantum key service end. If the charging permission message including the authorization token sent by the charging service terminal is received, the quantum key service end obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain first encrypted information, and then sends first token verification information and the first encrypted information to the charging service terminal. After the charging service terminal receives the first token information and the first encrypted information sent by the quantum key service end, after the first token verification information is verified, the first decryption key is used to decrypt the first encrypted information through the identity recognition module to obtain the second encryption key, and sends the first token verification information and the first encrypted information to the charging service terminal. After the identification module generates second encryption key verification information based on the second encryption key, it sends the stored second token verification information and the second encryption key verification information to the quantum key server. The quantum key server receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, determines the m quantum keys allocated to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain the second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal. After the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key server, after the first token verification information is verified, uses the second encryption key to decrypt the second encryption information through the identity recognition module to obtain the m quantum keys, and finally stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. Identification module, in this way, the identity recognition module uses the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and stores them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped, which solves the problem of leakage risk in the current process of filling quantum keys, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0115] Based on the above embodiments, the embodiments of the present application provide a quantum key injection method, referring to Figure 4 As shown, the method comprises the following steps:

[0116] Step 401: The charging management terminal determines the authorization token corresponding to the identity recognition module installed in the charging service terminal.

[0117] In the embodiment of the present application, after the charging management end determines the identity recognition module that needs to be quantum key charged according to the request sent by the charging service terminal, it determines the corresponding authorization token according to the identity recognition module. The authorization token can be generated by the token authorization center of the charging management end according to the module identification information of the identity recognition module, or it can be determined by the token authorization center of the charging management end according to the module identification information of the identity recognition module and has been generated in advance.

[0118] Step 402: The charging management terminal sends an authorization token to the charging service terminal.

[0119] Among them, the authorization token is sent to the filling service terminal, so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

[0120] Step 403: The charging service terminal receives the authorization token sent by the charging management terminal.

[0121] The authorization token is the token information allocated to the identity recognition module by the charging management end after the identity recognition module passes the identity authentication of the charging management end.

[0122] Step 404: The filling service terminal sends a filling permission message including an authorization token to the quantum key service end.

[0123] In an embodiment of the present application, after the charging service terminal receives the authorization token sent by the charging management end, it determines that the charging management end has agreed to charge the identity recognition module with quantum keys. Therefore, the charging service terminal generates a charging permission message based on the authorization token, and sends a reset permission message to the quantum key service end, so that the quantum key service end determines that it is necessary to perform a charging operation of quantum key charging for the identity recognition module, and at the same time obtains the authorization token corresponding to the identity recognition module, so as to perform corresponding verification processing based on the received authorization token.

[0124] Step 405: If a recharging permission message including an authorization token is received from the recharging service terminal, the quantum key service terminal obtains the first encryption key.

[0125] The authorization token is the authorization information assigned by the charging management end to the identity recognition module installed in the charging service terminal.

[0126] In an embodiment of the present application, after the quantum key service end receives the allow charging message including the authorization token sent by the charging service terminal, it parses the Yunxi charging message, obtains the authorization token, stores the authorization token, and responds to the allow charging message to obtain the first encryption key.

[0127] Step 406: The quantum key server generates a second encryption key corresponding to the identity recognition module.

[0128] In the embodiment of the present application, the quantum key server can use a key generation algorithm, such as a symmetric key generation algorithm, to generate a second encryption key. The second encryption key is an encryption key used when transmitting the quantum key.

[0129] Step 407: The quantum key server uses the first encryption key to encrypt the second encryption key to obtain first encrypted information.

[0130] Step 408: The quantum key service end sends the first token verification information and the first encryption information to the charging service terminal.

[0131] Among them, the first token verification information and the first encrypted information are sent to the charging service terminal, so that after the first token verification information passes the verification of the charging service terminal, the first encrypted information is decrypted based on the first decryption key through the identity recognition module to obtain the second encryption key, and the first token verification information is associated with the authorization token.

[0132] In an embodiment of the present application, the quantum key service end obtains first token verification information based on the authorization token, for example, the first token verification information may be a token hash value corresponding to the authorization token. The quantum key service end simultaneously sends the first token verification information and the first encryption information to the charging service terminal.

[0133] Step 409: The charging service terminal receives the first token verification information and the first encryption information sent by the quantum key service end.

[0134] Among them, the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management terminal to the identity recognition module.

[0135] Step 410: After the first token verification information is verified, the charging service terminal uses the first decryption key to decrypt the first encrypted information through the identity recognition module to obtain a second encryption key.

[0136] The first decryption key is stored in the identity recognition module.

[0137] In the embodiment of the present application, the charging service terminal verifies the first token verification information, and after the first token verification information passes the verification, the first encrypted information is sent to the identity recognition module, and the identity recognition module uses the first decryption key stored internally to decrypt the first encrypted information to obtain the second encryption key. The first decryption key and the first encryption key are a key pair.

[0138] Step 411: The charging service terminal generates second encryption key verification information based on the second encryption key through the identity recognition module.

[0139] In an embodiment of the present application, the identity recognition module of the charging service terminal performs key processing on the second encryption key obtained by decryption to obtain second encryption key verification information. In this way, the second encryption key is transmitted in non-plaintext. Even if it is leaked during the transmission process, it will not necessarily be cracked, thereby ensuring the security of the second encryption key during the transmission process.

[0140] Step 412: The charging service terminal sends the stored second token verification information and second encryption key verification information to the quantum key service end.

[0141] In the embodiment of the present application, the second token verification information is generated by the charging service terminal for the received authorization token of the identity recognition module, that is, the second token verification information is the verification information of the authorization token generated by the charging service terminal side.

[0142] Step 413: The quantum key service end receives the second token verification information and the second encryption key verification information sent by the charging service terminal.

[0143] The second encryption key verification information is associated with the second encryption key.

[0144] Step 414: After the second token verification information and the second encryption key verification information are verified, the quantum key server determines the m quantum keys allocated to the identity recognition module.

[0145] The second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1.

[0146] In an embodiment of the present application, the quantum key service end verifies the received second token verification information and the second encryption key verification information respectively to eliminate the risk that the second token verification information and the second encryption key verification information are leaked or replaced at the charging service terminal side or during the transmission process.

[0147] Step 415: The quantum key server uses the second encryption key to encrypt the m quantum keys to obtain second encrypted information.

[0148] In an embodiment of the present application, after the second token verification information and the second encryption key verification information are verified by the quantum key service end, the quantum key service end determines that there is no problem with the filling service terminal and the identity recognition module. Therefore, the second encryption key generated for the identity recognition module can be used to encrypt the determined m quantum keys to obtain the second encrypted information.

[0149] Among them, m can be a pre-set number of quantum keys allowed to be transmitted each time; it can also be the number of all quantum keys actually allocated to the identity recognition module; it can also be the number of quantum keys requested by the identity recognition module; it can also be determined according to the channel size between the quantum key server and the identity recognition module during each transmission. In this case, the value of m for each transmission is determined by the actual size of the transmission channel, and the value of m for each transmission may be different. Therefore, the specific value of m can be determined by the actual situation.

[0150] Step 416: The quantum key service sends the first token verification information and the second encryption information to the charging service terminal.

[0151] The first token verification information and the second encrypted information are sent to the charging service terminal so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

[0152] Step 417: The charging service terminal receives the first token verification information and the second encryption information sent by the quantum key service end.

[0153] Among them, the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified.

[0154] Step 418: After the first token verification information is verified, the charging service terminal uses the second encryption key to decrypt the second encrypted information through the identity recognition module to obtain m quantum keys.

[0155] In an embodiment of the present application, the charging service terminal verifies the received first token verification. After the first token verification information passes the verification of the charging service terminal, the charging service terminal sends the second encrypted information to the identity recognition module through the content communication channel between the charging service terminal and the identity recognition module, so that the identity recognition module directly decrypts the second encrypted information. In this way, the second encrypted information is not processed by the charging service terminal, but is directly decrypted by the identity recognition module, which reduces the risk of the m quantum keys allocated to the identity recognition module being leaked at the charging service terminal, and ensures the security of the decryption process and the m quantum keys.

[0156] Step 419: The charging service terminal stores m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.

[0157] In an embodiment of the present application, the identity recognition module stores the m quantum keys obtained by decryption in a key storage area, for example, a quantum key storage pool of the identity recognition module. In this way, the security and convenience of applying the quantum keys at the identity recognition module can be guaranteed.

[0158] Based on the foregoing embodiment, in other embodiments of the present application, in step 405, the quantum key service end performs the step of "obtaining a first encryption key", which can be implemented by steps 405a to 405b:

[0159] Step 405a: The quantum key service end sends the first token verification information and the key negotiation request to the charging service terminal.

[0160] In the embodiment of the present application, after receiving the allow charging message including the authorization token, the quantum key service end may also send a key negotiation request to the charging service terminal, so that the identity recognition module on the charging service terminal side generates a corresponding encryption key, i.e., a first encryption key. When the quantum key service end sends the key negotiation request to the charging service terminal, it also sends the first token verification information to the charging service terminal to reduce the possibility of the key negotiation request being modified during the transmission process, thereby ensuring the security of the transmission process of the key negotiation request.

[0161] Correspondingly, the filling service terminal executes steps 420 to 423:

[0162] Step 420: The charging service terminal receives the first token verification information and key negotiation request sent by the quantum key service end.

[0163] Step 421: After the first token verification information is verified, the charging service terminal responds to the key negotiation request through the identity recognition module and generates a first encryption key and a first decryption key.

[0164] In the embodiment of the present application, after the charging service terminal receives the first token verification information and the key negotiation request, the charging service terminal verifies the first token verification information, and after the first token verification information passes the verification of the charging service terminal, the key negotiation request is sent to the identity recognition module installed in the charging service terminal, so that the identity recognition module responds to the key negotiation request, uses the corresponding key encryption algorithm to generate a key pair, and obtains the first encryption key and the first decryption key. In this way, since the key pair is also generated in the identity recognition module, the risk of leakage and tampering of the key pair at the charging service terminal is reduced.

[0165] Step 422: The charging service terminal sends the second token verification information and the first encryption key to the quantum key service terminal.

[0166] Step 405b: The quantum key service end receives the second token verification information and the first encryption key sent by the charging service terminal.

[0167] In an embodiment of the present application, the charging service terminal sends the first encryption key to the quantum key service end, realizing the agreed process of encrypting information between the charging service terminal and the quantum key service end, and ensuring that subsequent encryption and decryption processing can be performed accurately.

[0168] Step 423: The charging service terminal stores the first decryption key through the identity recognition module.

[0169] In an embodiment of the present application, after generating the first encryption key and the first decryption key, the identity recognition module stores the identity recognition module in a storage area corresponding to the identity recognition module, so that the identity recognition module can subsequently use the first decryption key to decrypt the information encrypted using the first encryption key.

[0170] Correspondingly, step 406 can be implemented by the following steps: the quantum key server generates a second encryption key after the second token verification information is verified.

[0171] In an embodiment of the present application, after the quantum key service end receives the second token verification information and the first encryption key sent by the filling service terminal, it verifies the second token verification information. After the second token verification information passes the verification, it generates encryption information for encrypting the quantum key transmitted between the quantum key service end and the identity recognition module, that is, the second encryption key.

[0172] Based on the above embodiment, in other embodiments of the present application, before the filling management end executes step 401, it is also used to execute steps 424 to 427:

[0173] Step 424: The charging management terminal determines the module identification information of the identity recognition module installed in the charging service terminal.

[0174] In the embodiment of the present application, the module identification information may be identification information used to uniquely identify the identity module, for example, the module code, module name, module serial number, etc. of the identity module. The module identification information of the identity module installed in the charging service terminal may be sent by the charging service terminal to the charging management terminal.

[0175] Step 425: The charging management terminal determines the start time of the charging operation for the quantum key of the identity recognition module.

[0176] In the embodiment of the present application, the start time determined by the charging management end may be the time when the charging management end sends the authorization token to the charging service terminal.

[0177] Step 426: Charge the management end storage module identification information and start time.

[0178] In the embodiment of the present application, the charging management terminal can store the module identification information as key information and the start time as attribute information when storing. The data storage can be stored in the form of a list or a database.

[0179] Step 427: The charging management end sends record indication information to the quantum key service end.

[0180] The recorded indication information is used to instruct the quantum key server to perform a quantum key charging operation on the identity recognition module.

[0181] In an embodiment of the present application, after the charging management end stores the module identification information and the start time, it sends the record indication information to the quantum key service end so that the quantum key service end starts the corresponding quantum key charging operation.

[0182] Correspondingly, the quantum key server executes step 428:

[0183] Step 428: The quantum key service end receives the record indication information sent by the charging management end.

[0184] The record indication information is used to indicate that the injection operation of the identity recognition module into the quantum key has been recorded.

[0185] Based on the foregoing embodiment, in other embodiments of the present application, before the quantum key service end executes "obtaining the first encryption key" in step 405, it is also used to execute steps 429 to 430:

[0186] Step 429: The quantum key server generates first token verification information based on the authorization token.

[0187] Step 430: The quantum key service end sends the first token verification information to the charging management end, so that the charging management end verifies the first token verification information and determines whether to send the record indication information.

[0188] Correspondingly, the charging management terminal is used to execute steps 431 to 432:

[0189] Step 431: The charging management end receives the first token verification information sent by the quantum key service end.

[0190] Among them, the first token verification information is generated by the quantum key server based on the authorization token.

[0191] Step 432: The charging management end verifies the first token verification information and the authorization token to obtain a third verification result.

[0192] In an embodiment of the present application, the filling management end verifies the filling management end sent by the quantum key service end to determine whether the quantum key service end has received the correct authorization token, and further ensures the reliability of subsequent operations related to the authorization token or the first token verification information.

[0193] Correspondingly, step 427 can be implemented by the following steps: if the third verification result indicates that the first token verification information is verified successfully, send record indication information to the quantum key service end.

[0194] In an embodiment of the present application, after the third verification result indicates that the first token verification information has been verified, it indicates that the identity of the quantum key service end is reliable. Therefore, the filling management end can send a record indication information to the quantum key service end to formally start the quantum key filling process.

[0195] Based on the above embodiment, in other embodiments of the present application, before the filling service terminal executes step 403, it is also used to execute step 433 and steps 437 to 439:

[0196] Step 433: The charging service terminal sends an authentication request to the charging management terminal.

[0197] The authentication request is used to request identity authentication of the identity recognition module.

[0198] In the embodiment of the present application, after detecting that an identity recognition module is installed at the identity recognition module installation position, the charging service terminal generates an authentication request to the charging management terminal, requesting the charging management terminal to perform identity authentication processing on the installed identity recognition module.

[0199] Correspondingly, the filling management end executes steps 434 to 436 and step 440:

[0200] Step 434: The charging management terminal receives the authentication request sent by the charging service terminal.

[0201] The authentication request is used to request identity authentication of the identity recognition module.

[0202] Step 435: The charging management terminal responds to the authentication request and determines the first identity authentication information corresponding to the identity recognition module.

[0203] In the embodiment of the present application, the first identity authentication information is the identity authentication information generated by the charging management end for the identity recognition module when the manufacturer produces the identity recognition module. After receiving the authentication request, the charging management end determines the first identity authentication information corresponding to the identity recognition module.

[0204] Step 436: The charging management terminal sends the first identity authentication information to the charging service terminal.

[0205] Step 437: The recharging service terminal receives the first identity authentication information sent by the recharging management terminal.

[0206] The first identity authentication information is the authentication information pre-assigned by the charging management terminal to the identity recognition module.

[0207] Step 438: The filling service terminal performs authentication processing on the first identity authentication information and the pre-stored second identity authentication information through the identity recognition module to obtain an authentication result.

[0208] In the embodiment of the present application, after the manufacturer manufactures the identity recognition module and the identity recognition module leaves the factory, the manufacturer applies to the charging management terminal in advance for the second identity authentication information of the identity recognition module, and charges the second identity authentication information into the identity recognition module, so as to subsequently authenticate the identity recognition module. The identity recognition module in the charging service terminal performs matching authentication processing on the received first identity authentication information and the second identity authentication information, determines whether the two match, for example, whether the two are the same, and obtains an authentication result.

[0209] Step 439: If the authentication result indicates that the first identity authentication information matches the second identity authentication information, the recharging service terminal sends an identity authentication pass message to the recharging management terminal.

[0210] In an embodiment of the present application, when the authentication result indicates that the first identity authentication information does not match the second identity authentication information, the recharging service terminal does not perform subsequent operations. Further, the recharging service terminal may generate a prompt message indicating that the identity authentication of the identity recognition module has failed.

[0211] When the authentication result indicates that the first identity authentication information matches the second identity authentication information, for example, when the first identity authentication information is identical to the second identity authentication information, the charging service terminal sends an identity authentication pass message to the charging management terminal.

[0212] Step 440: The recharging management terminal receives the identity authentication pass message sent by the recharging service terminal.

[0213] The identity authentication pass message is generated after the charging service terminal performs authentication processing on the first identity authentication information.

[0214] After the filling management terminal executes step 440, it executes step 401. In this way, after the filling management terminal determines that the identity authentication of the identity recognition module installed at the filling service terminal has passed, the subsequent corresponding operations on the identity recognition module are executed, thereby ensuring the reliability of the subsequent related operations.

[0215] Based on the foregoing embodiment, in other embodiments of the present application, the quantum key service end is further used to execute step 441:

[0216] Step 441: If a charging control operation is detected, the quantum key service end sends charging indication information corresponding to the charging control operation to the charging service terminal.

[0217] The charging instruction information indicates charging the quantum key into the identity recognition module in the charging service terminal.

[0218] In an embodiment of the present application, the charging control operation may be detected by the quantum key service end when the operator operates the quantum key service end, that is, after the quantum key service end detects the charging control operation on the identity recognition module in the charging service terminal, the quantum key service end generates charging indication information and sends the charging indication information to the charging service terminal.

[0219] Correspondingly, step 433 can be implemented by the following steps: if the filling indication information sent by the quantum key service end is received, the filling service terminal sends an authentication request to the filling management end.

[0220] In an embodiment of the present application, after the charging service terminal receives the charging indication information sent by the quantum key service end, the charging service terminal responds to the charging indication information, generates an authentication request, and sends the authentication request to the charging management end.

[0221] Based on the above embodiment, in other embodiments of the present application, after the filling service terminal executes step 419, it is further used to execute step 442:

[0222] Step 442: The charging service terminal sends the second token verification information and the stored indication information to the quantum key service end.

[0223] The stored indication information is used to indicate that m quantum keys have been stored.

[0224] In an embodiment of the present application, after the identity recognition module stores m quantum keys, stored indication information is generated, and the stored indication information is sent to the quantum key service end through the filling service terminal. At the same time, the filling service terminal also sends second token verification information to the quantum key service end.

[0225] Correspondingly, the quantum key server is used to execute steps 443 to 446:

[0226] Step 443: The quantum key service end receives the second token verification information and the stored indication information sent by the charging service terminal.

[0227] The stored indication information is used to indicate that m quantum keys have been stored.

[0228] Step 444: After the second token verification information is verified, the quantum key server responds with the stored indication information, detects whether the quantum key assigned to the identity recognition module has been sent, and obtains the detection result.

[0229] In an embodiment of the present application, the quantum key server verifies the received second token verification information. After the second token verification information is verified, it responds with stored indication information to detect whether all quantum keys allocated to the identity recognition module have been sent to the identity recognition module to obtain a detection result.

[0230] Step 445: When the detection result indicates that the quantum key assigned to the identity recognition module has not been completely sent, the quantum key server repeatedly executes the step of "determining the m quantum keys assigned to the identity recognition module" until the detection result indicates that the quantum key assigned to the identity recognition module has been completely sent.

[0231] In an embodiment of the present application, when the detection result indicates that the quantum key assigned to the identity recognition module has not been sent, that is, when it is necessary to continue to send the quantum key to the identity recognition module, the quantum key server repeats the steps of "determining the m quantum keys assigned to the identity recognition module" to step 445 in step 414 until all the quantum keys assigned to the identity recognition module are sent to the identity recognition module.

[0232] Step 446: When the detection result indicates that the quantum key assigned to the identity recognition module has been sent, the quantum key service end sends the first token verification information and the charging end indication information to the charging management end.

[0233] The filling completion indication information is used to indicate that the filling operation of filling the identity recognition module with the quantum key has been completed.

[0234] In this way, when the detection result indicates that the quantum key assigned to the identity recognition module has been sent, the quantum key service end generates charging end indication information, and sends the first token verification information and the charging end indication information to the charging management end.

[0235] Correspondingly, the filling management terminal is also used to execute steps 447 to 451:

[0236] Step 447: The charging management end receives the first token verification information and charging end indication information sent by the quantum key service end.

[0237] Step 448: The charging management end verifies the first token verification information and the authorization token to obtain a fourth verification result.

[0238] In the embodiment of the present application, the charging management end uses the authorization token to verify the first token verification information and obtain a fourth verification result. When the first token verification information matches the authorization token, the fourth verification result is determined to be that the first token verification information has passed the verification, and when the first token verification information does not match the authorization token, the fourth verification result is determined to be that the first token verification information has not passed the verification.

[0239] Step 449: If the fourth verification result indicates that the verification of the first token verification information is successful, the charging management end responds with the charging end indication information and determines the end time of the charging operation.

[0240] In an embodiment of the present application, when at least the first token verification information fails the verification in the fourth verification result, the charging management end does not perform related operations. Further, an alarm prompt message may be generated to facilitate the corresponding personnel or initiate a leakage risk investigation.

[0241] Step 450: The charging management terminal stores the end time.

[0242] Step 451: The filling management terminal records the completion of the filling operation.

[0243] Based on the above embodiment, in other embodiments of the present application, before the filling service terminal executes step 412, steps 452 to 453 may also be executed:

[0244] Step 452: The charging service terminal generates second token verification information based on the authorization token.

[0245] In the embodiment of the present application, the second token verification information is generated by the charging service terminal processing the authorization token.

[0246] Step 453: The charging service terminal stores the second token verification information.

[0247] Based on the foregoing embodiments, in other embodiments of the present application, "the second token verification information is verified successfully" can be achieved through the following steps: using the authorization token to verify the second token verification information to obtain a first verification result; wherein the first verification result indicates that the second token verification information is verified successfully, or the second token verification information is verified failed; or, using the first token verification information to verify the second token verification information to obtain the first verification result.

[0248] Based on the foregoing embodiments, in other embodiments of the present application, "first token verification information verification" can be achieved through the following steps: using an authorization token to verify the first token verification information to obtain a second verification result; wherein the second verification result indicates that the first token verification information verification is successful, or the first token verification information verification is unsuccessful; or, using the second token verification information to verify the first token verification information to obtain a second verification result.

[0249] Based on the foregoing embodiments, in other embodiments of the present application, the embodiments of the present application provide an organizational structure for implementing a quantum key injection method, referring to Figure 5 As shown, it includes: quantum cryptography service platform, charging center, charging terminal, USIM card and card dealer; among them: quantum cryptography service platform corresponds to the aforementioned quantum key service end, charging center corresponds to the aforementioned charging management end, charging terminal corresponds to the aforementioned charging service terminal, and USIM card corresponds to the aforementioned identity recognition module. Correspondingly, based on Figure 5The organizational structure shown is explained by taking the charging terminal as a terminal device deployed in a communication service business hall, such as a handheld device. When a user needs to charge a quantum key for a USIM card, the USIM card is inserted into the charging terminal, and the charging terminal charges the inserted USIM card with a quantum key through the Internet. The premise is that: in the production preparation stage, the charging center generates a security credential and sends it to the card dealer offline or in a traditional secure tunnel. When the card dealer obtains the USIM card in production, it presets a security credential for the USIM card. Figure 5 The process corresponding to the direction of the arrow in the figure includes the following steps:

[0250] Step a101: The quantum cryptography service platform sends a charging instruction to the charging terminal.

[0251] Among them, step a101 may be a step of optional execution, that is, step a101 may not be executed. The charging instruction corresponds to the aforementioned charging control operation, and the quantum cryptography service platform sends the charging instruction to the charging terminal only after the relevant personnel perform the corresponding operation on the quantum cryptography service platform.

[0252] Step a102: The filling terminal sends an authentication request to the filling center.

[0253] The authentication request is used to request identity authentication of the USIN card and to request to obtain the security credential hash value corresponding to the security credential of the USIM card.

[0254] Step a103: The filling center provides the filling terminal with a hash value of the security credential.

[0255] The charging center responds to the received authentication request, obtains the security credential hash value corresponding to the USIM card, and provides the security credential hash value to the charging terminal.

[0256] Step a104: The charging terminal sends a charging request to the USIM card.

[0257] The refill request carries a security credential hash value provided by the refill center, and the security credential hash value matches the aforementioned first identity authentication information.

[0258] Step a105, the self-authentication module in the USIM card performs a security credential hash value verification operation. If the security credential hash value verification passes, execute step a106, otherwise, end the operation.

[0259] The specific process of the USIM card performing the security credential hash value verification operation is: verifying whether the security credential hash value matches the security credential pre-stored in the USIM card. The security credential corresponds to the aforementioned second identity authentication information.

[0260] Step a106: The USIM card returns an identity authentication pass instruction to the charging terminal.

[0261] Among them, the identity authentication instruction indicates that the security credential hash value has been verified, and the subsequent related quantum key injection operations can be authorized.

[0262] Step a107: The charging terminal sends an authorization notification message to the charging center.

[0263] Among them, the authorization notification message is used to notify the charging center that the quantum key charging authorization for the USIN card has been obtained.

[0264] Step a108: The filling center sends an authorization token to the filling terminal.

[0265] The authorization token can be recorded as sToken. This process corresponds to the aforementioned process of sending a recharge permission message including an authorization token. After receiving the authorization notification message sent by the recharge terminal, the recharge center generates an authorization token corresponding to the USIM card, and then sends the authorization token to the recharge terminal.

[0266] Step a109: the charging terminal sends a notification message including an authorization token to the quantum cryptographic service platform.

[0267] Step a110: The quantum cryptography service platform verifies the authorization token, and after the authorization token is verified, sends the authorization token hash value to the charging center.

[0268] The authorization token hash value is obtained by processing the authorization token.

[0269] Step a111, the charging center verifies the authorization token hash value. After the authorization token hash value passes the verification, the charging center sends a verification pass notification message to the quantum cryptography service platform, and the charging center records the start of this charging.

[0270] The implementation process of the filling center verifying the hash value of the authorization token may be: verifying whether the hash value of the authorization token matches the authorization token.

[0271] Step a112: After receiving the verification pass notification message, the quantum cryptography service platform sends the authorization token hash value and key negotiation request to the charging terminal.

[0272] Step a113: The charging terminal verifies the hash value of the authorization token, and after the hash value of the authorization token is verified, only forwards the key negotiation request to the USIM card.

[0273] Step a114: After receiving the key negotiation request, the USIM card generates a public key Public-Key and a private key Secret-Key using a key generation algorithm, and then sends the public key Public-Key to the charging terminal.

[0274] The USIM card stores the private key Secret-Key in its own storage area.

[0275] Step a115: The charging terminal sends the public key Public-Key and the hash value of the authorization token to the quantum cryptographic service platform.

[0276] Step a116: The quantum cryptography service platform verifies the authorization token hash value, and after the authorization token hash value passes the verification, the quantum cryptography service platform generates a secure channel key Channel-Key.

[0277] Step a117: The quantum cryptography service platform uses the public key Public-Key to encrypt the secure channel key Channel-Key to obtain Encryption-Channel-Key.

[0278] Among them, Encryption-Channel-Key=Encryption(Channel-Key, Public-Key).

[0279] Step a118: The quantum cryptography service platform sends the Encryption-Channel-Key and the authorization token hash value to the USIM card through the charging terminal.

[0280] Step a119: The charging terminal verifies the hash value of the authorization token, and when the hash value of the authorization token passes the verification, the charging terminal only sends the Encryption-Channel-Key to the USIM card.

[0281] Step a120: The USIM card uses the private key Secret-Key to decrypt the Encryption-Channel-Key to obtain the secure channel key Channel-Key.

[0282] The decryption process can be recorded as Channel-Key=Decryption(Encryption-Channel-Key, Secret-Key).

[0283] Step a121: The USIM card sends the Channel-Key hash value and the authorization token hash value to the quantum cryptographic service platform through the charging terminal.

[0284] The Channel-Key hash value can be recorded as Hash-Channel-Key=Hash(Channel-Key), which is the hash value obtained after the USIN card performs hash processing on the Channel-Key.

[0285] Step a122, the quantum cryptography service platform verifies the authorization token hash value and Hash-Channel-Key. After the authorization token hash value and Hash-Channel-Key are verified, the Channel-Key is used to encrypt one or more quantum keys QK to obtain Encryption (QK, Channel-Key), and the Encryption (QK, Channel-Key) and the authorization token hash value are sent to the charging terminal.

[0286] Among them, quantum cryptography uses Channel-Key to encrypt one or more quantum keys QK, and the process of obtaining Encryption(QK, Channel-Key) can be recorded as: Encryption-QK=Encryption(QK, Channel-Key).

[0287] Step a123: The charging terminal verifies the hash value of the authorization token, and after the hash value of the authorization token is verified, the charging terminal sends Encryption (QK, Channel-Key) to the USIM card.

[0288] Step a124: The USIM card uses Channel-Key to decrypt Encryption (QK, Channel-Key) to obtain one or more quantum keys QK.

[0289] Among them, the USIM card uses Channel-Key to decrypt Encryption (QK, Channel-Key) to obtain one or more quantum keys QK. The process can be recorded as: QK = Decryption (Encryption-QK, Channel-Key)

[0290] Step a125: The USIM card writes one or more quantum keys QK obtained by decryption into its own key storage pool.

[0291] Step a126: The USIM card sends a writing completion notification message and the authorization token hash value to the quantum cryptographic service platform through the charging terminal.

[0292] Step a127, the quantum cryptography service platform verifies the authorization token hash value, and after the authorization token hash value verification is passed, if it is detected that the quantum cryptography service platform has more quantum keys QK that need to be written to the USIM card, then the quantum cryptography service platform repeats the process from step a122 "use Channel-Key to encrypt one or more quantum keys QK, obtain Encryption (QK, Channel-Key), and send Encryption (QK, Channel-Key) and the authorization token hash value to the charging terminal" to step a127 until all the quantum keys to be written to the USIM card are written to the USIM card.

[0293] Step a128: If the quantum cryptography service platform has no more quantum keys QK to be written to the USIM card, the quantum cryptography service platform sends a charging completion message and an authorization token hash value to the charging center.

[0294] Step a129: After the filling center verifies the hash value of the authorization token, it records the end of this filling event.

[0295] In this way, the charging center creates a security credential, saves a copy locally, and sends the security credential to the USIM card manufacturer to pre-load the security credential into the USIM card. In this way, before the charging starts, the USIM card can authenticate the charging center based on the security credential, so that after the attacker tampers with the authorization token in individual USIM cards at the USIM card manufacturer's location, it is difficult for the attacker to tamper with the authorization token of the charging center, resulting in individual USIM cards failing to pass the authentication, thereby making the USIM card scrapped and unable to further perform quantum key charging, thereby preventing the leakage or theft of quantum keys.

[0296] Furthermore, after the USIM card is authenticated, the charging center also issues an authorization token sToken to the charging terminal, and the charging terminal also sends sToken to the quantum cryptography service platform, so that the quantum cryptography service platform requests the charging center to verify the sToken, thereby realizing that the charging center, the charging terminal and the quantum security cryptography service platform have all authenticated the other parties.

[0297] Furthermore, in each information transmission interaction between the charging terminal and the quantum cryptography service platform, sToken is used to perform session verification on the corresponding hash value to prevent man-in-the-middle attacks.

[0298] Furthermore, the public key and private key are generated by the USIM card and then sent to the quantum cryptography server platform through a secure channel similar to the Hypertext Transfer Protocol Secure (https), which reduces the cost of storing the public key, saves time, and provides protection for the public key.

[0299] To summarize, the charging center is the SIM card management unit for the entire network. It authenticates SIM cards to prevent counterfeiting. During the charging process, the quantum key plaintext will not appear in any intermediate device or link. Instead, the quantum cryptography service platform encrypts the quantum key and sends it directly to the USIM card through the charging terminal. The USIM card performs decryption and encryption, which reduces the possibility of the quantum key being leaked in plaintext. During the charging process, the quantum cryptography service platform records the relevant information of the quantum key charged to each USIM card, which can be traced and analyzed later. In this way, the security of the quantum key is guaranteed.

[0300] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0301] The quantum key charging method provided in the embodiment of the present application determines the authorization token corresponding to the identity recognition module installed in the charging service terminal through the charging management end, and after sending the authorization token to the charging service terminal, the charging service terminal receives the authorization token sent by the charging management end, and sends a charging permission message including the authorization token to the quantum key service end. If the charging permission message including the authorization token sent by the charging service terminal is received, the quantum key service end obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain first encrypted information, and then sends first token verification information and the first encrypted information to the charging service terminal. After the charging service terminal receives the first token information and the first encrypted information sent by the quantum key service end, after the first token verification information is verified, the first decryption key is used to decrypt the first encrypted information through the identity recognition module to obtain the second encryption key, and sends the first token verification information and the first encrypted information to the charging service terminal. After the identification module generates second encryption key verification information based on the second encryption key, it sends the stored second token verification information and the second encryption key verification information to the quantum key server. The quantum key server receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, determines the m quantum keys allocated to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain the second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal. After the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key server, after the first token verification information is verified, uses the second encryption key to decrypt the second encryption information through the identity recognition module to obtain the m quantum keys, and finally stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. Identification module, in this way, the identity recognition module uses the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and stores them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of filling quantum keys, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0302] Based on the above embodiments, the embodiments of the present application provide a first quantum key filling device, which is applied to a quantum key service end. The device can be applied to Figures 1-2 and Figure 4 In the quantum key injection method provided in the corresponding embodiment, refer to Figure 6 As shown, the first quantum key injection device 5 may include: an acquisition unit 51, a first generation unit 52, an encryption processing unit 53, a first sending unit 54 and a first determination unit 55; wherein:

[0303] The acquiring unit 51 is configured to acquire the first encryption key upon receiving a recharging permission message including an authorization token sent by the recharging service terminal; wherein the authorization token is authorization information allocated by the recharging management terminal to the identity recognition module installed in the recharging service terminal;

[0304] A first generating unit 52, configured to generate a second encryption key corresponding to the identity recognition module;

[0305] The encryption processing unit 53 is used to encrypt the second encryption key using the first encryption key to obtain the first encrypted information;

[0306] The first sending unit 54 is used to send the first token verification information and the first encrypted information to the charging service terminal, so that after the first token verification information passes the verification of the charging service terminal, the first encrypted information is decrypted by the identity recognition module based on the first decryption key to obtain the second encryption key, and the first token verification information has an associated relationship with the authorization token;

[0307] The acquisition unit 51 is further configured to receive second token verification information and second encryption key verification information sent by the charging service terminal; wherein the second encryption key verification information is associated with the second encryption key;

[0308] A first determining unit 55 is used to determine m quantum keys allocated to the identity recognition module after the second token verification information and the second encryption key verification information are both verified; wherein the second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1;

[0309] An encryption processing unit 53 is used to encrypt the m quantum keys using a second encryption key to obtain second encrypted information;

[0310] The first sending unit 54 is used to send the first token verification information and the second encrypted information to the filling service terminal, so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

[0311] In other embodiments of the present application, when the acquisition unit executes the step of acquiring the first encryption key, it can be implemented by the following steps:

[0312] Sending first token verification information and a key negotiation request to a charging service terminal;

[0313] The second token verification information and the first encryption key sent by the filling service terminal are received.

[0314] In other embodiments of the present application, the first generating unit is specifically used to implement the following steps:

[0315] After the second token verification information is verified, a second encryption key is generated.

[0316] In other embodiments of the present application, before obtaining the first encrypted password, the obtaining unit is further configured to perform the following steps:

[0317] Receive the record indication information sent by the charging management end; wherein the record indication information is used to indicate that the charging operation of charging the identity recognition module with the quantum key has been recorded.

[0318] In other embodiments of the present application, before the acquiring unit executes the step of acquiring the first encryption key, it is further configured to execute the following steps:

[0319] Based on the authorization token, generate first token verification information;

[0320] The first token verification information is sent to the charging management end, so that the charging management end verifies the first token verification information and determines whether to send the record indication information.

[0321] In other embodiments of the present application, after the first sending unit executes the step of sending the first token verification information and the second encrypted information to the refill service terminal, the device further includes: a second receiving unit, a responding unit and a repeating execution unit; wherein:

[0322] A second receiving unit is used to receive second token verification information and stored indication information sent by the filling service terminal; wherein the stored indication information is used to indicate that m quantum keys have been stored;

[0323] A response unit, used for responding to the stored indication information after the second token verification information is verified, detecting whether the quantum key assigned to the identity recognition module has been sent, and obtaining a detection result;

[0324] a repeating execution unit, configured to, when the detection result indicates that the quantum key assigned to the identity recognition module has not been completely sent, repeatedly execute the step of “determining the m quantum keys assigned to the identity recognition module” until a detection result indicates that the quantum key assigned to the identity recognition module has been completely sent;

[0325] The first sending unit is also used to send the first token verification information and the charging end indication information to the charging management end when the detection result indicates that the quantum key allocated to the identity recognition module has been sent; wherein the charging end indication information is used to indicate that the charging operation of charging the quantum key to the identity recognition module has been completed.

[0326] In other embodiments of the present application, the first sending unit is also used to send charging indication information corresponding to the charging control operation to the charging service terminal if a charging control operation is detected; wherein the charging indication information indicates charging the quantum key for the identity recognition module in the charging service terminal.

[0327] In other embodiments of the present application, the device further includes: a first verification unit; wherein:

[0328] A first verification unit, configured to verify the second token verification information using the authorization token to obtain a first verification result; wherein the first verification result indicates that the second token verification information is verified successfully, or that the second token verification information is not verified successfully;

[0329] Or, a first verification unit is used to verify the second token verification information using the first token verification information to obtain a first verification result.

[0330] It should be noted that the process of information interaction between the units and modules in this embodiment can refer to the description in other embodiments and will not be repeated here.

[0331] The first quantum key charging device provided in the embodiment of the present application, if receiving a charging permission message including an authorization token sent by a charging service terminal, the quantum key service end obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain first encryption information, and then sends first token verification information and the first encryption information to the charging service terminal, receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, determines the m quantum keys allocated to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal, so that after the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key service end, after the first token verification information is verified, the second encryption information is decrypted by the identity recognition module using the second encryption key to obtain m quantum keys, and stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module. In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. In this way, the identity recognition module can use the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and store them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of quantum key filling, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0332] Based on the above embodiments, the embodiments of the present application provide a second quantum key injection device, which is applied to a injection service terminal equipped with an identity recognition module. The device can be applied to Figures 1 to 4 In the quantum key injection method provided in the corresponding embodiment, refer to Figure 7 As shown, the second quantum key injection device 6 may include: a first receiving unit 61, a decryption processing unit 62, a second generating unit 63, a second sending unit 64 and a first storage unit 65; wherein:

[0333] The first receiving unit 61 is used to receive the authorization token sent by the charging management end; wherein the authorization token is the token information allocated to the identity recognition module by the charging management end after the identity recognition module passes the identity authentication of the charging management end;

[0334] A second sending unit 64 is used to send a filling permission message including an authorization token to the quantum key service end;

[0335] The first receiving unit 61 is further used to receive the first token verification information and the first encryption information sent by the quantum key service end; wherein the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management end to the identity recognition module;

[0336] The decryption processing unit 62 is used to decrypt the first encrypted information using the first decryption key through the identity recognition module to obtain a second encryption key after the first token verification information is verified; wherein the first decryption key is stored in the identity recognition module;

[0337] A second generating unit 63, configured to generate second encryption key verification information based on the second encryption key through the identity recognition module;

[0338] A second sending unit 64 is used to send the stored second token verification information and the second encryption key verification information to the quantum key service end;

[0339] The first receiving unit 61 is further used to receive the first token verification information and the second encryption information sent by the quantum key service end; wherein the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified;

[0340] The decryption processing unit 62 is further configured to, after the first token verification information is verified, decrypt the second encrypted information using the second encryption key through the identity recognition module to obtain m quantum keys;

[0341] The first storage unit 65 is used to store m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.

[0342] In other embodiments of the present application, before the first receiving unit executes the step of receiving the first token verification information and the first encryption information sent by the quantum key service end, the first receiving unit is further used to receive the first token verification information and the key negotiation request sent by the quantum key service end;

[0343] The second generating unit is further configured to generate a first encryption key and a first decryption key by responding to the key negotiation request through the identity recognition module after the first token verification information is verified;

[0344] The second sending unit is further used to send the second token verification information and the first encryption key to the quantum key service end;

[0345] The first storage unit is also used to store the first decryption key through the identity recognition module.

[0346] In other embodiments of the present application, before the first receiving unit executes the step of receiving the authorization token sent by the filling management terminal, the device further includes: an authentication unit; wherein:

[0347] The second sending unit is further used to send an authentication request to the charging management end; wherein the authentication request is used to request identity authentication of the identity recognition module;

[0348] The second receiving unit is further used to receive the first identity authentication information sent by the charging management terminal; wherein the first identity authentication information is the authentication information pre-assigned by the charging management terminal to the identity recognition module;

[0349] An authentication unit, configured to perform authentication processing on the first identity authentication information and the pre-stored second identity authentication information through the identity recognition module to obtain an authentication result;

[0350] The second sending unit is further configured to send an identity authentication pass message to the charging management terminal if the authentication result indicates that the first identity authentication information matches the second identity authentication information.

[0351] In other embodiments of the present application, before the second sending unit executes the step of sending the stored second token verification information and the second encryption key verification information to the quantum key service end, the device further includes: a second storage unit; wherein:

[0352] The second generating unit is further used to generate second token verification information based on the authorization token;

[0353] The second storage unit is also used to store second token verification information.

[0354] In an embodiment of the present application, after the first storage unit executes the step of storing m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module, the second sending unit is also used to send second token verification information and stored indication information to the quantum key server; wherein the stored indication information is used to indicate that m quantum keys have been stored.

[0355] In other embodiments of the present application, the device method further includes: a second verification unit; wherein:

[0356] A second verification unit, configured to verify the first token verification information using the authorization token to obtain a second verification result; wherein the second verification result indicates that the first token verification information is verified successfully, or that the first token verification information is not verified successfully;

[0357] Or, a second verification unit is used to verify the first token verification information using the second token verification information to obtain a second verification result.

[0358] In other embodiments of the present application, when the second sending unit executes the step of sending the authentication request to the filling management end, it can be implemented by the following steps:

[0359] If the charging instruction information sent by the quantum key server is received, an authentication request is sent to the charging management end.

[0360] It should be noted that the process of information interaction between the units and modules in this embodiment can refer to the description in other embodiments and will not be repeated here.

[0361] The second quantum key filling device provided in the embodiment of the present application receives the authorization token sent by the filling management end through the filling service terminal, and sends a filling permission message including the authorization token to the quantum key service end, so that after the quantum key service end receives the filling permission message including the authorization token sent by the filling service terminal, it obtains the first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain the first encrypted information, and then sends the first token verification information and the first encrypted information to the filling service terminal. After the filling service terminal receives the first token information and the first encrypted information sent by the quantum key service end, after the first token verification information is verified, the first encryption information is decrypted by the identity recognition module using the first decryption key to obtain the second encryption key, and generates a second encryption key verification information based on the second encryption key through the identity recognition module. After receiving the information, the stored second token verification information and the second encryption key verification information are sent to the quantum key service end, so that the quantum key service end receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, the m quantum keys assigned to the identity recognition module are determined, and the m quantum keys are encrypted with the second encryption key to obtain the second encrypted information, and the first token verification information and the second encrypted information are sent to the charging service terminal. In this way, after the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key service end, after the first token verification information is verified, the second encryption key is used to decrypt the second encrypted information through the identity recognition module to obtain the m quantum keys, and finally the m quantum keys are stored in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. In this way, the identity recognition module can use the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and store them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped. This solves the problem of leakage risk in the current process of quantum key filling, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0362] Based on the above embodiments, the embodiments of the present application provide a third quantum key injection device, which is applied to the injection management end. The device can be applied to Figures 2 to 4 In the quantum key injection method provided in the corresponding embodiment, refer to Figure 7 As shown, the third quantum key injection device 7 may include: a second determination unit 71 and a third sending unit 72; wherein:

[0363] A second determining unit 71, used to determine an authorization token corresponding to an identity recognition module installed in the filling service terminal;

[0364] The third sending unit 72 is used to send the authorization token to the filling service terminal, so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

[0365] In other embodiments of the present application, before the second determination unit executes the step of determining the authorization token corresponding to the identity recognition module installed in the filling service terminal, the device further includes: a third storage unit; wherein:

[0366] The second determining unit is further used to determine the module identification information of the identity recognition module installed in the filling service terminal;

[0367] The second determining unit is further used to determine the start time of the quantum key filling operation for the identity recognition module;

[0368] A third storage unit, used for storing module identification information and start time;

[0369] The third sending unit is also used to send record indication information to the quantum key service end; wherein the record indication information is used to instruct the quantum key service end to perform a quantum key charging operation on the identity recognition module.

[0370] In other embodiments of the present application, before the second determining unit executes the step of determining the module identification information of the identity recognition module installed in the filling service terminal, the device further includes: a third receiving unit; wherein:

[0371] A third receiving unit is used to receive an authentication request sent by the filling service terminal; wherein the authentication request is used to request identity authentication of the identity recognition module;

[0372] The second determining unit is further used to respond to the authentication request and determine the first identity authentication information corresponding to the identity recognition module;

[0373] The third sending unit is further used to send the first identity authentication information to the charging service terminal;

[0374] The third receiving unit is further used to receive an identity authentication success message sent by the charging service terminal; wherein the identity authentication success message is generated after the charging service terminal performs authentication processing on the first identity authentication information.

[0375] In other embodiments of the present application, after the third sending unit executes the step of sending the record indication information to the quantum key service end, the device further includes: a third verification unit; wherein:

[0376] The third receiving unit is further used to receive first token verification information sent by the quantum key service end; wherein the first token verification information is generated by the quantum key service end based on the authorization token;

[0377] The third verification unit is used to verify the first token verification information and the authorization token to obtain a third verification result.

[0378] In other embodiments of the present application, when the third sending unit executes the step of sending the record indication information to the quantum key service end, it can be implemented by the following steps:

[0379] If the third verification result indicates that the first token verification information is verified successfully, a record indication message is sent to the quantum key service end.

[0380] In other embodiments of the present application, after the third sending unit executes the step of sending the recording instruction information to the quantum key service end, the device further includes: a recording unit; wherein:

[0381] The third receiving unit is further used to receive the first token verification information and the charging end indication information sent by the quantum key service end;

[0382] The third verification unit is further used to verify the first token verification information and the authorization token to obtain a fourth verification result;

[0383] The second determining unit is further configured to determine the end time of the charging operation in response to the charging end indication information if the fourth verification result indicates that the first token verification information has been verified;

[0384] The third storage unit is also used to store the end time;

[0385] A recording unit is used to record the end of the filling operation.

[0386] It should be noted that the process of information interaction between the units and modules in this embodiment can refer to the description in other embodiments and will not be repeated here.

[0387] The third quantum key filling device provided in the embodiment of the present application determines the authorization token corresponding to the identity recognition module installed in the filling service terminal through the filling management end, and sends the authorization token to the filling service terminal, so that the filling service terminal receives the authorization token sent by the filling management end, and sends a filling permission message including the authorization token to the quantum key service end. If the filling permission message including the authorization token sent by the filling service terminal is received, the quantum key service end obtains a first encryption key, generates a second encryption key corresponding to the identity recognition module, and uses the first encryption key to encrypt the second encryption key to obtain first encrypted information, and then sends first token verification information and the first encrypted information to the filling service terminal. After the filling service terminal receives the first token information and the first encrypted information sent by the quantum key service end, after the first token verification information is verified, the first decryption key is used to decrypt the first encrypted information through the identity recognition module to obtain the second encryption key, and sends the first token verification information and the first encrypted information to the filling service terminal. After the copy identification module generates the second encryption key verification information based on the second encryption key, it sends the stored second token verification information and the second encryption key verification information to the quantum key server. The quantum key server receives the second token verification information and the second encryption key verification information sent by the charging service terminal, and after the second token verification information and the second encryption key verification information are both verified, determines the m quantum keys allocated to the identity recognition module, uses the second encryption key to encrypt the m quantum keys to obtain the second encryption information, and sends the first token verification information and the second encryption information to the charging service terminal. After the charging service terminal receives the first token verification information and the second encryption information sent by the quantum key server, after the first token verification information is verified, the second encryption information is decrypted by the identity recognition module using the second encryption key to obtain the m quantum keys, and finally stores the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.In this way, after the charging service terminal receives the authorization token sent by the charging management end, it notifies the quantum key service end that the quantum key charging can be performed through a charging permission message including the authorization token. Then, the quantum key service end uses the first encryption key to encrypt the second encryption key communicated between the quantum key service end and the identity recognition module installed in the charging service terminal, and sends it to the identity recognition module. After determining that the identity recognition module has received the second encryption key and that the second encryption key received by the identity recognition module is correct, the second encryption key that only the identity recognition module has is used to encrypt the m quantum keys allocated to the identity recognition module to obtain the second encrypted information, and the second encrypted information is sent to the identity recognition module. Identification module, in this way, the identity recognition module uses the second encryption key to decrypt the received second encrypted information to obtain m quantum keys, and stores them in the storage area of ​​the identity recognition module. During the whole process, only the quantum key server and the identity recognition module have the second encryption key, which ensures the security of the transmitted quantum key. In the whole process, the corresponding verification information is verified based on the authorization token to ensure that the transmitted information will be discovered in time when it is swapped, which solves the problem of leakage risk in the current process of filling quantum keys, and proposes a quantum key filling method to ensure the security of the quantum key and the feasibility of the quantum key filling process.

[0388] Based on the above embodiments, the embodiments of the present application provide a quantum key filling system, which can be applied to the quantum key filling method provided in the above embodiments, with reference to Fig. 9 As shown, the quantum key filling system 8 at least includes: a quantum key service end 81, a filling service terminal 82 equipped with an identity recognition module, and a filling management end 83; wherein:

[0389] The quantum key server 81 is used to implement Figures 1-2 and Figure 4 The implementation process of the quantum key injection method provided in the corresponding embodiment will not be repeated here;

[0390] The filling service terminal 82 is used to implement Figures 1 to 4 The implementation process of the quantum key injection method provided in the corresponding embodiment will not be repeated here;

[0391] The filling management terminal 83 is used to implement Figures 2 to 4 The implementation process of the quantum key injection method provided in the corresponding embodiment will not be repeated here.

[0392] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, referred to as a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement reference Figures 1-2 and Figure 4 , Figures 1 to 4 ,or Figures 2 to 4 The implementation process of the quantum key injection method provided in the corresponding embodiment will not be repeated here.

[0393] Based on the aforementioned embodiments, the embodiments of the present application also provide a computer program product, including a computer program, which can be executed by a processor of a quantum key service terminal, or a processor of a charging service terminal, or a charging management terminal to complete any of the aforementioned method steps.

[0394] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0395] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0396] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0397] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0398] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A quantum key injection method, characterized in that: The method is applied to a quantum key service end, and the method comprises: If a recharging permission message including an authorization token is received from the recharging service terminal, a first encryption key is obtained; wherein the authorization token is authorization information assigned by the recharging management end to the identity recognition module installed in the recharging service terminal; Generate a second encryption key corresponding to the identity recognition module; Using the first encryption key to encrypt the second encryption key to obtain first encrypted information; sending first token verification information and the first encrypted information to the refill service terminal, so that after the first token verification information passes the verification of the refill service terminal, the first encrypted information is decrypted by the identity recognition module based on the first decryption key to obtain the second encryption key, and the first token verification information is associated with the authorization token; Receiving second token verification information and second encryption key verification information sent by the filling service terminal; wherein the second encryption key verification information is associated with the second encryption key; After both the second token verification information and the second encryption key verification information are verified, determining m quantum keys allocated to the identity recognition module; wherein the second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1; Using the second encryption key to encrypt the m quantum keys to obtain second encrypted information; The first token verification information and the second encrypted information are sent to the filling service terminal, so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

2. The method according to claim 1, characterized in that The obtaining of the first encryption key comprises: sending the first token verification information and the key negotiation request to the charging service terminal; The second token verification information and the first encryption key sent by the filling service terminal are received.

3. The method according to claim 2, characterized in that The generating a second encryption key corresponding to the identity recognition module includes: After the second token verification information is verified, the second encryption key is generated.

4. The method according to claim 1, characterized in that Before obtaining the first encrypted password, the method further includes: Receive record indication information sent by the charging management end; wherein the record indication information is used to indicate that a charging operation of charging the identity recognition module with a quantum key has been recorded.

5. The method according to claim 1, characterized in that: Before obtaining the first encryption key, the method further includes: Based on the authorization token, generate the first token verification information; The first token verification information is sent to the recharging management end, so that the recharging management end verifies the first token verification information and determines whether to send record indication information.

6. The method according to claim 1, characterized in that After sending the first token verification information and the second encrypted information to the filling service terminal, the method further includes: Receiving the second token verification information and stored indication information sent by the filling service terminal; wherein the stored indication information is used to indicate that m of the quantum keys have been stored; After the second token verification information is verified, responding to the stored indication information, detecting whether the quantum key assigned to the identity recognition module has been sent, and obtaining a detection result; If the detection result indicates that the quantum key assigned to the identity recognition module has not been completely sent, repeat the step of "determining the m quantum keys assigned to the identity recognition module" until the detection result indicates that the quantum key assigned to the identity recognition module has been completely sent; When the detection result indicates that the quantum key allocated to the identity recognition module has been sent, the first token verification information and the charging end indication information are sent to the charging management end; wherein the charging end indication information is used to indicate that the charging operation of charging the quantum key to the identity recognition module has been completed.

7. The method according to claim 1, characterized in that The method further comprises: If a charging control operation is detected, charging instruction information corresponding to the charging control operation is sent to the charging service terminal; wherein the charging instruction information indicates charging the quantum key for the identity recognition module in the charging service terminal.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Using the authorization token to verify the second token verification information to obtain a first verification result; wherein the first verification result indicates that the second token verification information is verified successfully, or that the second token verification information is not verified successfully; Or, the second token verification information is verified using the first token verification information to obtain the first verification result.

9. A quantum key injection method, characterized in that: The method is applied to a filling service terminal equipped with an identity recognition module, and the method comprises: Receive an authorization token sent by the charging management end; wherein the authorization token is token information allocated to the identity recognition module by the charging management end after the identity recognition module passes the identity authentication of the charging management end; Sending a filling permission message including the authorization token to the quantum key service end; Receive first token verification information and first encryption information sent by the quantum key service end; wherein the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management end to the identity recognition module; After the first token verification information is verified, the first encrypted information is decrypted by the identity recognition module using a first decryption key to obtain a second encryption key; wherein the first decryption key is stored in the identity recognition module; generating second encryption key verification information based on the second encryption key by the identity recognition module; Sending the stored second token verification information and the second encryption key verification information to the quantum key service end; Receiving the first token verification information and the second encryption information sent by the quantum key service end; wherein the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified; After the first token verification information is verified, the second encrypted information is decrypted by the identity recognition module using the second encryption key to obtain m quantum keys; The m quantum keys are stored in a key storage area of ​​the identity recognition module through the identity recognition module.

10. The method according to claim 9, characterized in that Before receiving the first token verification information and the first encryption information sent by the quantum key service end, the method further includes: Receiving the first token verification information and the key negotiation request sent by the quantum key service end; After the first token verification information is verified, responding to the key negotiation request through the identity recognition module to generate the first encryption key and the first decryption key; Sending the second token verification information and the first encryption key to the quantum key service end; The first decryption key is stored by the identity recognition module.

11. The method according to claim 9, characterized in that Before receiving the authorization token sent by the charging management terminal, the method further includes: Sending an authentication request to the charging management terminal; wherein the authentication request is used to request identity authentication of the identity recognition module; Receiving first identity authentication information sent by the filling management terminal; wherein the first identity authentication information is authentication information pre-assigned by the filling management terminal to the identity recognition module; Performing authentication processing on the first identity authentication information and the pre-stored second identity authentication information through the identity recognition module to obtain an authentication result; If the authentication result indicates that the first identity authentication information matches the second identity authentication information, an identity authentication pass message is sent to the charging management terminal.

12. The method according to claim 9, characterized in that Before sending the stored second token verification information and the second encryption key verification information to the quantum key service end, the method further includes: Based on the authorization token, generate the second token verification information; The second token verification information is stored.

13. The method according to claim 9, characterized in that After storing the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module, the method further includes: Send the second token verification information and the stored indication information to the quantum key service end; wherein the stored indication information is used to indicate that m of the quantum keys have been stored.

14. The method according to any one of claims 9 to 13, characterized in that: The method further comprises: Using the authorization token to verify the first token verification information to obtain a second verification result; wherein the second verification result indicates that the first token verification information is verified successfully, or that the first token verification information is not verified successfully; Or, the first token verification information is verified using the second token verification information to obtain the second verification result.

15. The method according to claim 11, characterized in that The sending of the authentication request to the charging management terminal includes: If the filling indication information sent by the quantum key service end is received, the authentication request is sent to the filling management end.

16. A quantum key injection method, characterized in that: The method is applied to a filling management end, and the method comprises: Determine the authorization token corresponding to the identity recognition module installed in the charging service terminal; Send the authorization token to the filling service terminal so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

17. The method according to claim 16, characterized in that Before determining the authorization token corresponding to the identity recognition module installed in the filling service terminal, the method further includes: Determining module identification information of an identity recognition module installed in a charging service terminal; Determining a start time of a quantum key filling operation for the identity recognition module; storing the module identification information and the start time; Sending record indication information to a quantum key service end; wherein the record indication information is used to instruct the quantum key service end to perform a quantum key charging operation for the identity recognition module.

18. The method according to claim 17, characterized in that Before determining the module identification information of the identity recognition module installed in the filling service terminal, the method further includes: Receiving an authentication request sent by a filling service terminal; wherein the authentication request is used to request identity authentication of the identity recognition module; In response to the authentication request, determining first identity authentication information corresponding to the identity recognition module; sending the first identity authentication information to the filling service terminal; Receive an identity authentication success message sent by the filling service terminal; wherein the identity authentication success message is generated after the filling service terminal performs authentication processing on the first identity authentication information.

19. The method according to claim 17, characterized in that After sending the record indication information to the quantum key service end, the method further includes: Receiving first token verification information sent by the quantum key service end; wherein the first token verification information is generated by the quantum key service end based on the authorization token; The first token verification information and the authorization token are verified to obtain a third verification result.

20. The method according to claim 19, characterized in that The sending of the record indication information to the quantum key service end includes: If the third verification result indicates that the first token verification information is verified successfully, the record indication information is sent to the quantum key service end.

21. The method according to claim 17, characterized in that After sending the record indication information to the quantum key service end, the method further includes: Receiving first token verification information and charging end indication information sent by the quantum key service end; Verifying the first token verification information and the authorization token to obtain a fourth verification result; If the fourth verification result indicates that the first token verification information is verified successfully, responding to the charging end indication information, determining the end time of the charging operation; storing the end time; The end of the filling operation is recorded.

22. A first quantum key injection device, characterized in that: The device is applied to a quantum key service end, and comprises: an acquisition unit, a first generation unit, an encryption processing unit, a first sending unit and a first determination unit; wherein: The acquisition unit is used to acquire the first encryption key if a recharging permission message including an authorization token is received from the recharging service terminal; wherein the authorization token is authorization information allocated by the recharging management terminal to the identity recognition module installed in the recharging service terminal; The first generating unit is used to generate a second encryption key corresponding to the identity recognition module; The encryption processing unit is used to encrypt the second encryption key using the first encryption key to obtain first encrypted information; The first sending unit is used to send the first token verification information and the first encrypted information to the refill service terminal, so that after the first token verification information passes the verification of the refill service terminal, the first encrypted information is decrypted by the identity recognition module based on the first decryption key to obtain the second encryption key, and the first token verification information is associated with the authorization token; The acquisition unit is further configured to receive second token verification information and second encryption key verification information sent by the filling service terminal; wherein the second encryption key verification information is associated with the second encryption key; The first determination unit is used to determine the m quantum keys allocated to the identity recognition module after the second token verification information and the second encryption key verification information are both verified; wherein the second token verification information is associated with the authorization token, and m is an integer greater than or equal to 1; The encryption processing unit is used to use the second encryption key to encrypt the m quantum keys to obtain second encrypted information; The first sending unit is used to send the first token verification information and the second encrypted information to the filling service terminal, so that the identity recognition module stores the m quantum keys carried in the second encrypted information.

23. A second quantum key injection device, characterized in that: The device is applied to a filling service terminal equipped with an identity recognition module, and comprises: a first receiving unit, a decryption processing unit, a second generating unit, a second sending unit and a first storage unit; wherein: The first receiving unit is used to receive an authorization token sent by the charging management end; wherein the authorization token is the token information allocated by the charging management end to the identity recognition module after the identity recognition module passes the identity authentication of the charging management end; The second sending unit is used to send a filling permission message including the authorization token to the quantum key service end; The first receiving unit is further used to receive first token verification information and first encryption information sent by the quantum key service end; wherein the first token verification information is generated by the quantum cryptography server based on the authorization token allocated by the charging management end to the identity recognition module; The decryption processing unit is used to decrypt the first encrypted information using the first decryption key through the identity recognition module to obtain a second encryption key after the first token verification information is verified; wherein the first decryption key is stored in the identity recognition module; The second generating unit is configured to generate second encryption key verification information based on the second encryption key through the identity recognition module; The second sending unit is used to send the stored second token verification information and the second encryption key verification information to the quantum key service end; The first receiving unit is further used to receive the first token verification information and the second encryption information sent by the quantum key service end; wherein the first token verification information and the second encryption information are sent by the quantum key service end after the second token verification information and the second encryption key verification information are both verified; The decryption processing unit is further configured to, after the first token verification information is verified, decrypt the second encrypted information using the second encryption key through the identity recognition module to obtain m quantum keys; The first storage unit is used to store the m quantum keys in the key storage area of ​​the identity recognition module through the identity recognition module.

24. A third quantum key injection device, characterized in that: The device is applied to a filling management terminal, and comprises: a second determining unit and a third sending unit; wherein: The second determining unit is used to determine the authorization token corresponding to the identity recognition module installed in the filling service terminal; The third sending unit is used to send the authorization token to the filling service terminal, so that the filling service terminal sends the authorization token to the quantum key service end, so that the filling service terminal and the quantum key service end perform verification processing based on the authorization token.

25. A quantum key injection system, characterized in that: The system at least includes: a quantum key service end, a charging service terminal equipped with an identity recognition module, and a charging management end; wherein: The quantum key server is used to implement the steps of the quantum key injection method according to any one of claims 1 to 8; The filling service terminal is used to implement the steps of the quantum key filling method according to any one of claims 9 to 15; The injection management end is used to implement the steps of the quantum key injection method as described in any one of claims 16 to 21.

26. A storage medium, characterized in that The storage medium stores a quantum key injection program, which, when executed, is used to implement the steps of the quantum key injection method as described in any one of claims 1 to 8, or claims 9 to 15, or claims 16 to 21.

27. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the steps of the quantum key injection method according to any one of claims 1 to 8, claims 9 to 15, or claims 16 to 21.

Images