Quantum security service processing system and method based on universal equipment

Abstract

The invention discloses a quantum security service processing system and method. The method comprises the steps that a quantum key center issues key file data to a quantum security privacy device through a universal device; the general device sends the first service data to a quantum security privacy device for identity authentication and integrity verification; when both the identity authentication and the integrity verification are passed, the quantum security privacy device processes the first service data for the first time to obtain second service data, and returns the second service data to the universal device; the universal device judges whether the first service data needs secondary processing according to the secondary processing identifier; if the secondary processing identifier is null, the second service data is stored; the secondary processing identifier is 1, calling the quantum security privacy device to encrypt the second service data to obtain third service data, sending the third service data to the service server to execute secondary processing, obtaining fourth service data, encrypting the fourth service data, and sending the fourth service data to the universal device; and the universal device calls the quantum security privacy device for decryption to obtain and store the fifth service data.

Description

Technical Field

[0001] The present application relates to the field of quantum security technology, and in particular to a quantum security service processing system and method based on general-purpose equipment. Background Art

[0002] Existing general-purpose equipment terminals are used by users to process business, and they often store a large amount of private data. General-purpose equipment terminals can generally be connected to the Internet, so illegal users can launch attacks on data packets through the Internet. To resist this attack, traditional cryptography is often used.

[0003] Traditional cryptography mainly studies digital-based encryption technology, and commonly used algorithms include symmetric encryption (such as AES) and asymmetric encryption (such as RSA). However, with the development of quantum computers, the security of these traditional encryption algorithms on quantum computers has been seriously threatened. Relying on its super computing power, quantum computers can solve mathematical problems that traditional computers take decades or even hundreds of years to solve in a very short time, thereby easily cracking traditional encryption algorithms such as RSA, ECC, AES, and DES. Therefore, in order to improve the security of terminal devices, it is necessary to upgrade terminal devices from general-purpose device terminals that use traditional encryption algorithms to quantum device terminals that support quantum cryptography.

[0004] Traditional cryptography is based on classical computers and digital technology, while quantum cryptography uses the characteristics of quantum physics. The basic information unit (BIT) of a traditional computer is binary and can only take 0 or 1. The basic information unit (QUBIT) of a quantum computer is a quantum bit, which can process multiple states at the same time and has higher computing power. It can be seen that upgrading general-purpose equipment terminals will inevitably require a lot of costs, and even eliminate the original general-purpose equipment and replace it with new terminal equipment, which is undoubtedly not conducive to practical promotion and application. Therefore, how to ensure that the business processing in the general-purpose equipment terminal reaches the security level of quantum security without changing the existing general-purpose equipment terminal is a technical issue that the industry is currently concerned about. Summary of the invention

[0005] Purpose of the invention: This application proposes a quantum security business processing system and method based on universal equipment. The quantum security privacy device of the present invention is connected to the universal equipment. The system of the present invention is used to ensure that the universal equipment terminal, with the assistance of the quantum security privacy device of the present invention, the business running therein can reach the quantum security level.

[0006] Technical solution: The present invention provides a quantum security business processing system based on universal devices, the system comprising a quantum security privacy device, a universal device, and a quantum key center connected in sequence;

[0007] Wherein, the quantum key center is used to issue key file data to the universal device;

[0008] The universal device is used to transmit first business data data1 to the quantum secure privacy device, forward key file data to the quantum secure privacy device, and receive and store second business data data2 from the quantum secure privacy device, and;

[0009] The quantum security privacy device is used to authenticate the identity of the general device and process the first business data data1 for the first time to obtain the second business data data2.

[0010] As an improvement of the present invention, the first business data data1 includes first business type data, first application information data of the business application to which the first business data belongs, a first processing indication for the first business type data, and a secondary processing identifier of whether secondary processing is required, wherein the secondary processing identifier is 1 when secondary processing is required, otherwise the secondary processing identifier is empty.

[0011] As an improvement of the present invention, the system further includes a service server connected to the universal device and the quantum key center;

[0012] The quantum key center is also used to issue the key file data to the business server;

[0013] The general device is also used to determine whether the first business data data1 needs secondary processing, and if the first business data data1 needs secondary processing, call the quantum security privacy device to encrypt the second business data data2 to obtain the third business data data3, receive the key location information from the quantum security privacy device or the business server, send the third business data data3 to the business server, receive the encrypted fourth business data data4 from the business server, and call the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data5;

[0014] The service server is used for secondary processing the third service data data3 to obtain the fourth service data data4, and encrypting the fourth service data data4 and sending it to the general device;

[0015] The quantum security privacy device is also used to perform encryption operations on the second business data data2 and decryption operations on the encrypted fourth business data data4.

[0016] As an improvement of the present invention, the quantum security privacy device comprises: a communication area, an isolation area and a privacy area; the isolation area is respectively connected to the communication area and the privacy area for communication; wherein:

[0017] The communication area is used to interact with the general device to obtain the first business data data1 and the encrypted fourth business data data4; the communication area includes a data acquisition unit and a communication protocol unit, and the data acquisition unit is communicatively connected with the communication protocol unit; wherein: the communication protocol unit is pre-configured with a plurality of communication protocols for the quantum security privacy device to establish a communication link with the general device; the data acquisition unit is used to obtain the first business data data1 and the encrypted fourth business data data4 from the general device through the communication link;

[0018] The isolation area is used to filter the first business data data1 and the encrypted fourth business data data4 and transmit them to the privacy area, and transmit the second business data data2 and the fifth business data data5 from the privacy area to the communication protocol unit; the isolation area includes a data transmission unit and a data filtering unit, and the data transmission unit is communicatively connected to the data filtering unit; the data filtering unit is also communicatively connected to the data acquisition unit, and the data transmission unit is also communicatively connected to the communication protocol unit; wherein: the data filtering unit is configured with a whitelist and / or a blacklist, which is used to filter the first business data data1 and the encrypted fourth business data data4 sent via the data acquisition unit according to the whitelist and / or the blacklist; the data transmission unit is used to transmit the first business data data1 and the encrypted fourth business data data4 filtered by the data filtering unit, and transmit the second business data data2 and the fifth business data data5 from the privacy area to the communication protocol unit;

[0019] The privacy zone is used to authenticate the identity of the general device, perform integrity verification operations and initial processing on the first business data data1, and perform encryption and decryption on the first business data data1 and the encrypted fourth business data data4 to obtain the second business data data2 and the fifth business data data5; the privacy zone includes an input unit, a main control chip, an encryption and decryption unit, a key storage unit, an authentication unit, a business processing unit, and an output unit; the main control chip is respectively communicated with the input unit, the authentication unit, the encryption and decryption unit, the business processing unit and the key storage unit, the encryption and decryption unit is also communicated with the key storage unit, the output unit is also communicated with the data transmission unit and the encryption and decryption unit, and the input unit is also communicated with the data transmission unit; wherein: the input unit is used to receive the first business data data1 and the encrypted fourth business data data4 from the data transmission unit business data data4; the main control chip is used to receive the first processing instruction and the first business type data forwarded by the input unit, and based on the received first processing instruction, performs the corresponding first operation on the first business type data; the encryption and decryption unit is used to perform encryption or decryption operations on the first business data data1 and the encrypted fourth business data data4 according to the first processing instruction forwarded by the main control chip; the key storage unit is used to store key file data, and provide encryption keys and decryption keys for the encryption and decryption unit; the authentication unit is used to store the identity of the quantum security privacy device, and to verify the integrity of the received first business data data1; the business processing unit is configured with multiple business blocks, and each business block is respectively installed with a second business application corresponding to the first business application in the general device for processing the first business data data1.

[0020] As an improvement of the present invention, the isolation area further includes a touch screen, which is communicatively connected with the input unit and the output unit in the privacy area and is used to receive user instructions and display business result data.

[0021] As an improvement of the present invention, a quantum security service processing method based on a general device is also provided, which is applied to the quantum security service processing system described above, and the quantum security service processing method comprises the following steps:

[0022] Step 1: The quantum key center issues key file data to the general device, and the general device forwards the key file data to the quantum security privacy device for storage; the general device sends the first business data data1 to the quantum security privacy device, and the quantum security privacy device authenticates the general device and verifies the integrity of the first business data data1;

[0023] Step 2: In response to the identity authentication and integrity verification in step 1 being passed, the quantum security privacy device performs a first processing on the first business data data1, obtains the second business data data2 after the first processing, and returns the second business data data2 to the general device;

[0024] Step 3: The general device determines whether the first business data data1 needs secondary processing according to the secondary processing identifier in the stored first business data data1;

[0025] Step 4: In response to the secondary processing flag in step 3 being empty, the general device stores the second service data data2 and ends the service processing operation.

[0026] As an improvement of the present invention, the specific process of step 2 is:

[0027] Step 2-1: After the identity authentication and integrity verification are passed, the quantum security privacy device notifies the main control chip in the privacy zone of the quantum security privacy device to parse the first application information data from the first business data data1, instructs the business processing unit in the privacy zone to select a business block, and maps the corresponding second business application in the business block according to the first application information data;

[0028] Step 2-2: the main control chip in the privacy zone instructs the second service application to read the first service type data and the first processing instruction, and the second service application processes the first service type data for the first time according to the first processing instruction to obtain the second service data data2 after the first processing;

[0029] Step 2-3: The quantum security privacy device returns the second business data data2 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area of ​​the quantum security privacy device, and the communication protocol unit in the communication area of ​​the quantum security privacy device.

[0030] As an improvement of the present invention, a quantum security service processing method based on a general device is also provided, which is applied to the quantum security service processing system described above, and the quantum security service processing method comprises the following steps:

[0031] Steps 1 to 4 are the same as described above;

[0032] Step 5: In response to the secondary processing flag in step 3 being 1, the general device calls the quantum security privacy device to encrypt the second business data data2, obtains the third business data data3 and sends it to the business server. The business server performs secondary processing to obtain the fourth business data data4, encrypts the fourth business data data4 and sends it to the general device;

[0033] Step 6: The general device calls the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data5.

[0034] As an improvement of the present invention, the specific process of step 5 is as follows:

[0035] Step 5-1: The general device checks the secondary processing identifier in the first business data data1, and when the secondary processing identifier is 1, calls the quantum security privacy device to obtain a first encryption key k1 from the key storage unit in the privacy area of ​​the quantum security privacy device for the second business data data2 in plain text, and records the key location information of the first encryption key k1;

[0036] Step 5-2: The encryption and decryption unit in the privacy zone of the quantum secure privacy device uses the first key k1 to perform an encryption operation on the second business data data2 in plain text to obtain the first ciphertext M1=data2⊕k1, wherein the first ciphertext M1 is the third business data data3, and the key position information of the first encryption key k1 and the third business data data3 are sent to the general device via the output unit in the privacy zone, the data transmission unit in the isolation zone of the quantum secure privacy device, and the communication protocol unit in the communication zone of the quantum secure privacy device;

[0037] Step 5-3: the general device forwards the key location information of the first encryption key k1 and the third business data data3 to the business server, the business server initiates a key application to the quantum key center, the quantum key center issues key file data to the business server, the business server obtains the first decryption key k1' from the key file data according to the key location information of the first encryption key k1, uses the first decryption key k1' to decrypt the third business data data3 to obtain the decrypted second business data data2', performs a secondary processing operation on the decrypted second business data data2', and obtains the fourth business data data4;

[0038] Step 5-4: The business server obtains the second encryption key k2 from the key file data for the fourth business data data4, records the key location information of the second encryption key k2, uses the second encryption key k2 to perform an encryption operation on the fourth business data data4 to obtain the second ciphertext M2=data4⊕k2, and sends the key location information of the second encryption key k2 and the second ciphertext M2 to the general device.

[0039] As an improvement of the present invention, the specific process of step 6 is as follows:

[0040] Step 6-1: The general device forwards the key location information of the second encryption key k2 to the quantum secure privacy device, and the key storage unit in the privacy area of ​​the quantum secure privacy device receives and stores the key location information of the second encryption key k2;

[0041] Step 6-2: The key storage unit in the privacy area of ​​the quantum security privacy device obtains the second decryption key k2' from the key file data therein according to the key location information of the second encryption key k2 and sends it to the encryption and decryption unit in the privacy area. The encryption and decryption unit uses the second decryption key k2' to decrypt the second ciphertext M2 to obtain the fifth business data data5, and sends the fifth business data data5 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area, and the communication protocol unit in the communication area. The general device stores the fifth business data data5.

[0042] Beneficial effects:

[0043] 1. Quantum security privacy devices are external hardware devices that are connected to general-purpose devices to complete the security processing of business data in general-purpose device terminals. General-purpose devices only need to maintain their inherent storage and transmission functions. No hardware modification is required, only software installation is required, which effectively reduces the cost of use;

[0044] 2. Quantum security privacy devices exist in various forms. They can be independent quantum security privacy cards or integrated into existing wearable devices such as bracelets. They are easy to carry and can meet most current application scenarios, greatly improving user experience.

[0045] 3. The business data processing process is separated from general-purpose devices and carried out in quantum security privacy devices and business servers. Since the external devices connected are all general-purpose devices, they cannot directly communicate with quantum security privacy devices, and bad users cannot interfere with the business data processing process in quantum security privacy devices. At the same time, data transmission in the Internet communication link is in ciphertext state, which improves data security and user privacy in the business data processing process to the quantum security level;

[0046] 4. Add identification to the processing of business data, streamline the business data processing flow, simplify the equipment used in the system when some processing is marked as unnecessary, and save system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 This is a schematic diagram of the structure of the quantum security business processing system for this application;

[0049] Figure 2 This is a schematic diagram of the structure of the quantum security privacy device for this application;

[0050] Figure 3 This is a flowchart of the quantum security business processing method for this application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0052] like Figure 1 As shown, the present invention provides a quantum security business processing system.

[0053] In one embodiment of the present invention, the quantum security business processing system of the present invention includes a quantum security privacy device, a general device, and a quantum key center connected in sequence. The quantum key center is used to generate and issue key file data to the general device. The general device is used to transmit the first business data data1 to the quantum security privacy device, forward the key file data to the quantum security privacy device, and receive and store the second business data data2 from the quantum security privacy device. The quantum security privacy device is used to authenticate the identity of the general device, process the first business data data1 for the first time to obtain the second business data data2. In all embodiments of the present invention, each business data includes corresponding business type data, application information data of the business application to which the business data belongs, and processing instructions for the business type data. For example, the business type data may be motion data, the application may be a certain sports APP, and the processing instruction may be the integration of motion data within a period of time, such as the number of steps in a week. In addition, each business data may also include a secondary processing identifier indicating whether secondary processing is required, wherein the secondary processing identifier is 1 when secondary processing is required, otherwise the secondary processing identifier is empty. In an embodiment of the present invention, the first processing includes, for example, format conversion and storage of data; the second processing includes, for example, data needs to be uploaded to a business server for data processing, data is sent to another user through the business server and feedback data from another user on the data is received (for example, social chatting, sending files, etc.).

[0054] In another embodiment of the present invention, the quantum security business processing system of the present invention further includes a business server connected to the general device and the quantum key center. In the presence of the business server, the quantum key center is also used to issue the key file data to the business server, and the key file data is the same as the key file data issued by the quantum key center to the general device. The general device is also used to determine whether the first business data data1 needs secondary processing, and if it is determined that the first business data data1 needs secondary processing, call the quantum security privacy device to encrypt the second business data data2 to obtain the third business data data3, receive the key location information from the quantum security privacy device or the business server, send the third business data data3 to the business server, receive the encrypted fourth business data data4 from the business server, and call the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data. The business server processes the third business data data3 to obtain the fourth business data data4, and performs an encryption operation on the fourth business data data4 before transmitting it. The quantum security privacy device is also used to perform an encryption operation on the second business data data2, and a decryption operation on the encrypted fourth business data data4.

[0055] like Figure 2 As shown, in all the embodiments of the present invention described above, the quantum security privacy device includes a communication area, an isolation area and a privacy area, wherein the isolation area is communicatively connected to the communication area and the privacy area respectively.

[0056] Specifically, the communication area in the quantum security privacy device is used to interact with the general device to obtain business data, specifically, the unprocessed first business data data1 and the encrypted fourth business data data4. As shown in the context, the first business data data1 is the business data to be processed that is transmitted for the first time from the general device. The communication area includes a data acquisition unit and a communication protocol unit, and the data acquisition unit is communicatively connected to the communication protocol unit. The communication protocol unit is pre-configured with a variety of communication protocols, such as: WiFi communication protocol (for example, local area network communication protocol), BT communication protocol, NFC communication protocol, and the quantum security privacy device of the present invention establishes a communication link with the general device through these communication protocols provided by the communication protocol unit. The data acquisition unit is used to obtain the first business data data1 and the encrypted fourth business data data4 from the general device through the communication link.

[0057] Specifically, the isolation zone in the quantum security privacy device is used to filter the first business data data1 and the encrypted fourth business data data4 and transmit them to the privacy zone, and transmit the business result data from the privacy zone (such as the second business data data2 after the first processing of the first business data data1 and the fifth business data data5 after the decryption operation of the encrypted fourth business data data4) to the communication protocol unit. The isolation zone includes a data transmission unit and a data filtering unit, and the data transmission unit is connected to the data filtering unit; the data filtering unit is also connected to the data acquisition unit, and the data transmission unit is also connected to the communication protocol unit. The data filtering unit is configured with a white list and / or a black list, which is used to send the general device to the data acquisition unit, and the business data to be processed (such as the unprocessed first business data data1 and the encrypted fourth business data data4) forwarded by the data acquisition unit is filtered according to the white list and / or the black list, and the business data that passes the data filtering is sent to the data transmission unit. The data filtering unit can also be used to count the data received by the quantum security privacy device, and store the operation of filtering the data in the form of a log for subsequent inspection. The data filtering unit can also be used to audit the data, by collecting, screening and analyzing a large amount of data in a variety of ways, to find audit clues, so that the data can be applied more efficiently and accurately in the future. The data transmission unit is a data transmission channel, which is used to transmit the business data filtered by the data filtering unit (such as the first business data data1, the encrypted fourth business data data4), and the business result data from the privacy zone (such as the second business data data2, the fifth business data data5) to the communication protocol unit, more specifically, to the general device through the established communication link.

[0058] Specifically, the privacy zone in the quantum security privacy device is used to authenticate the identity of the general device, perform integrity verification operations and first processing on the first business data data1, and perform encryption and decryption and authentication operations on the first business data data1 and the encrypted fourth business data data4 to obtain the second business data data2 and the fifth business data data5; the privacy zone includes an input unit, a main control chip, an encryption and decryption unit, a key storage unit, an authentication unit, a business processing unit, and an output unit; the main control chip is respectively connected to the input unit, the authentication unit, the encryption and decryption unit, the business processing unit, and the key storage unit, the encryption and decryption unit is also connected to the key storage unit, the output unit is also connected to the data transmission unit and the encryption and decryption unit, and the input unit is also connected to the data transmission unit; wherein: the input unit is used to receive the first business data data1 and the encrypted fourth business data data4 from the data transmission unit, each of which includes business type data to be processed and processing instructions for the business type data. The main control chip is used to receive the processing instructions and business type data forwarded by the input unit, and based on the received processing instructions, performs the corresponding first operation on the business type data. The encryption and decryption unit is used to perform encryption or decryption operations on the first business data data1 and the encrypted fourth business data data4 according to the processing instructions forwarded by the main control chip. The key storage unit is used to store keys and provide encryption keys and decryption keys for the encryption and decryption unit. The authentication unit is used to store the identity of the quantum security privacy device and to verify the integrity of the received first business data data1. The business processing unit is a specific execution unit for processing business data. The business processing unit can be divided into multiple business blocks according to the business type. Each business block is respectively installed with a second business application mapped from the first business application in the general device, so as to perform business processing on the business data later. It should be noted that the first business application in the general device corresponds one-to-one to the second business application in the quantum security privacy device.

[0059] For example, if the processing instruction received by the main control chip is to process the business data, the main control chip forwards the processing instruction and the business data to the business processing unit for data processing. For another example, if the processing instruction received by the main control chip is to encrypt and decrypt the business data, the main control chip forwards the assistant instruction and the business data to the encryption and decryption unit for encryption and decryption.

[0060] The isolation area of ​​the quantum security privacy device can also be equipped with a touch screen, which serves as an input device of the quantum security privacy device, and the user can send instructions to the quantum security privacy device through the touch screen. Correspondingly, for such a quantum security privacy device, each of a part of the business blocks in the business processing unit of the device can also be installed with the second business application of the quantum security privacy device itself. The input unit in the privacy zone is also used to receive the user's instructions sent via the touch screen of the quantum security privacy device of the present invention, and the output unit is also used to directly display the processing results of the business data by the quantum security privacy device on the touch screen of the quantum security privacy device of the present invention.

[0061] In an embodiment of the present invention, the quantum security privacy device can be in the form of an external device, such as a USB flash drive or a USB shield; it can also be a wearable device, such as a smart watch or a sports bracelet.

[0062] like Figure 3 As shown, the present invention also provides a quantum security service processing method, which is applied to the quantum security service processing system described above to achieve service processing operations that reach the quantum security level. In an embodiment of the present invention, the general device can be various mobile phones, PCs, printers and other terminals currently on the market. The quantum security service processing method includes the following steps:

[0063] Step 1: The quantum key center issues key file data to the general device, and the general device forwards the key file data to the quantum security privacy device for storage; the general device sends the first business data data1 to the quantum security privacy device, and the quantum security privacy device authenticates the general device and verifies the integrity of the first business data data1;

[0064] In the embodiment of the present invention, the specific process of identity authentication is:

[0065] Step (1): The universal device establishes a communication link with the communication protocol unit in the communication area of ​​the quantum security privacy device. Based on the communication link, the quantum security privacy device adds the product identity information of the universal device to the white list of the data filtering unit in the isolation area. The product identity information of the universal device may be a serial number that uniquely represents the product identity of the universal device, and the product identity information is recorded as b.

[0066] Step (2): The universal device obtains the product identity information of the quantum security privacy device through the communication link; the product identity information of the quantum security privacy device may be a factory device code, or may be another serial number that can uniquely represent the product identity of the quantum security privacy device, and the product identity information is recorded as a;

[0067] Step (3): Based on the product identity information a and its own product identity information b, the universal device obtains identity certificates A and B that can represent unique identities from the identity issuance center in the quantum key center. Identity certificate A corresponds to the quantum security privacy device, and identity certificate B corresponds to the universal device. At the same time, the identity issuance center synchronizes the issued identity certificates A and B to the quantum key center so that the quantum key center can subsequently authenticate the legitimacy of the identities of the quantum security privacy device and the universal device. The identity issuance center can be a working unit deployed in the quantum key center or an independent third-party organization.

[0068] The identity in this step can be, for example, the digital certificate mentioned in the patent "Digital Certificate Generation, Identity Authentication Method and Quantum CA Certification Center and System" with application number 2022101851462, and the identity issuance process is the issuance process of the digital certificate;

[0069] Step (4): The general device receives identity certificate A and identity certificate B, and sends the identity certificate B of the quantum security privacy device to the quantum security privacy device;

[0070] Step (5): The universal device uses identity certificate A and identity certificate B to initiate an authentication application to the subkey center.

[0071] Step (6): The quantum key center responds to the authentication application in steps (1)-(5), determines whether to allow the quantum security privacy device to use the key service of the quantum key center, and feeds back the result to the general device.

[0072] Specifically, the authentication application received by the quantum key center includes the identity certificate A of the general device and the identity certificate B of the quantum security privacy device. The quantum key center uses the identity certificates of the general device and the quantum security privacy device stored locally to authenticate the identity certificates A and B received in steps 1-5. Only when the identity authentication of A and B passes, the quantum key center passes the authentication and allows the quantum security privacy device B connected to the general device a to use the key service of the quantum key center; otherwise, as long as the identity authentication of either party fails, the quantum key center fails the authentication and refuses to provide the key service of the quantum key center to the quantum security privacy device b.

[0073] The identity authentication process in this step can adopt, for example, the identity authentication method mentioned in the patent "Digital Certificate Generation, Identity Authentication Method and Quantum CA Certification Center and System" with application number 2022101851462.

[0074] In the embodiment of the present invention, the specific process of integrity verification is:

[0075] Step (a): The general device obtains a set of n-bit quantum random numbers from the quantum key center, where n can be 128 or 256, etc. The specific length of the quantum random number is determined according to the security requirements during actual use. The quantum security privacy device generates an n-order irreducible polynomial P1(x) based on this set of random numbers, and records the string consisting of the coefficients of each term of the irreducible polynomial P1(x) except the highest term as str1. The general device negotiates the key with the quantum security privacy device and obtains the shared keys r, t, and u respectively. The shared key here can be obtained from the quantum key center or from the local key pool of either party.

[0076] Step (b): The universal device generates a first hash function h using the irreducible polynomial P1(x) and the shared key r p1,r and use the first hash function h p1,r Perform hash calculation on the first service data data1 to obtain a first hash value h p1,r (data1); then use the shared keys t and u to hash the first hash value h p1,r (data1) and string str1 are encrypted to obtain the authentication file M:

[0077] M=(h p1,r (data1)⊕t,str1⊕u).

[0078] The general device uses the authentication file M as a verification code and sends it to the quantum security privacy device together with the first business data data1, so that the quantum security privacy device can subsequently perform the authentication process based on the authentication file M.

[0079] Step (c): Based on the received first business data data1, the authentication unit of the quantum security privacy device parses the authentication file M as a verification code and the first business type data cont therein.

[0080] Step (d): The encryption and decryption unit of the quantum security privacy device uses the shared keys t and u to decrypt the authentication file M and obtain the decrypted hash value h p1,r ′(data1), string str1 ′ , and the hash value h p1,r '(data1) and string str1 ′ Sent to the authentication unit via the main control chip.

[0081] Step (e): The authentication unit of the quantum security privacy device is based on the string str1 ′ and the shared key r to generate a hash function h p1′,r ′, and use the hash function to perform hash calculation on the first business type data cont obtained by parsing to obtain a hash value hp1′,r ′(cont). The calculated hash value h p1′,r ′(cont) and the decrypted hash value h p1,r ′(data1) is compared. If the two hash values ​​are consistent, the comparison passes and the integrity verification passes. If the hash values ​​are inconsistent, the comparison fails, the business data has been tampered with during transmission, and the integrity verification fails.

[0082] Step 2: In response to the identity authentication and integrity verification in step 1 being passed, the quantum security privacy device performs a first processing on the first business data data1, obtains the second business data data2 after the first processing, and returns the second business data data2 to the general device;

[0083] Specifically:

[0084] Step 2-1: After the identity authentication and integrity verification are passed, the quantum security privacy device notifies the main control chip in the privacy zone of the quantum security privacy device to parse the first application information data from the first business data data1, instructs the business processing unit in the privacy zone to select a business block, and maps the corresponding second business application in the business block according to the first application information data;

[0085] Step 2-2: the main control chip in the privacy zone instructs the second service application to read the first service type data and the first processing instruction, and the second service application processes the first service type data for the first time according to the first processing instruction to obtain the processed second service data data2;

[0086] Step 2-3: The quantum security privacy device returns the second business data data2 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area of ​​the quantum security privacy device, and the communication protocol unit in the communication area of ​​the quantum security privacy device.

[0087] Step 3: The general device determines whether the first business data data1 needs secondary processing according to the secondary processing identifier in the stored first business data data1;

[0088] Step 4: In response to the secondary processing flag in step 3 being empty, that is, no secondary processing is required, the general device stores the second business data data2 and ends the business processing operation.

[0089] At this time, the participants in the quantum security business processing method of the present invention are the quantum security privacy device, the universal device terminal and the quantum key center in the system of the present invention. There is no need for the participation of the business server, which simplifies the system of the present invention, streamlines the processing flow of business data and effectively saves system resources.

[0090] When the secondary processing flag in step 3 is 1, the quantum security service processing method of the present invention further includes the following steps, which require the participation of the service server in the system of the present invention:

[0091] Step 5: In response to the secondary processing mark in step 3 indicating that secondary processing is required, the general device calls the quantum security privacy device to encrypt the second business data data2, obtains the third business data data3 and sends it to the business server. The business server performs secondary processing to obtain the fourth business data data4, encrypts the fourth business data data4 and sends it to the general device;

[0092] Specifically:

[0093] Step 5-1: The general device checks the secondary processing identifier in the first business data data1, and when the secondary processing identifier is 1, calls the quantum security privacy device to obtain a first encryption key k1 from the key storage unit in the privacy area of ​​the quantum security privacy device for the second business data data2 in plain text, and records the key location information of the first encryption key k1; for the quantum security privacy device, the first encryption key k1 comes from the key file data stored in the key storage unit. For the general device, the encryption and decryption operations can be performed by calling the quantum security privacy device, and the general device itself does not need to perform encryption and decryption operations, that is, it does not need to have a key pool unit for storing keys locally.

[0094] Step 5-2: The encryption and decryption unit in the privacy zone of the quantum secure privacy device uses the first key k1 to perform an encryption operation on the second business data data2 in plain text to obtain the first ciphertext M1=data2⊕k1, wherein the first ciphertext M1 is the third business data data3, and the key position information of the first encryption key k1 and the third business data data3 are sent to the general device via the output unit in the privacy zone, the data transmission unit in the isolation zone of the quantum secure privacy device, and the communication protocol unit in the communication zone of the quantum secure privacy device;

[0095] Step 5-3: The general device forwards the key location information of the first encryption key k1 and the third business data data3 to the business server. The business server initiates a key application to the quantum key center. The quantum key center issues key file data to the business server. The business server obtains the first decryption key k1' from the key file data according to the key location information of the first encryption key k1, and uses the first decryption key k1' to decrypt the third business data data3 to obtain the decrypted second business data data2'. A secondary processing operation is performed on the decrypted second business data data2' to obtain the fourth business data data4. It should be noted that the secondary processing operation in this step is roughly the same as the process of the first processing operation, which will not be repeated here.

[0096] Step 5-4: The business server obtains the second encryption key k2 from the key file data for the fourth business data data4, records the key location information of the second encryption key k2, uses the second encryption key k2 to perform an encryption operation on the fourth business data data4 to obtain the second ciphertext M2=data4⊕k2, and sends the key location information of the second encryption key k2 and the second ciphertext M2 to the general device.

[0097] Step 6: The general device calls the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data5.

[0098] Specifically:

[0099] Step 6-1: The general device forwards the key location information of the second encryption key k2 to the quantum secure privacy device, and the key storage unit in the privacy zone of the quantum secure privacy device receives and stores the key location information of the second encryption key k2; it should be noted that the key storage unit in the privacy zone of the quantum secure privacy device has stored the same key file data as that of the business server;

[0100] Step 6-2: The key storage unit in the privacy area of ​​the quantum security privacy device obtains the second decryption key k2' from the key file data therein according to the key location information of the second encryption key k2 and sends it to the encryption and decryption unit in the privacy area. The encryption and decryption unit uses the second decryption key k2' to decrypt the second ciphertext M2 to obtain the fifth business data data5, and sends the fifth business data data5 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area, and the communication protocol unit in the communication area. The general device stores the fifth business data data5.

[0101] In steps 5 to 6, the universal device exists as a forwarding channel between the quantum security privacy device and the business server, where the relevant processing of business data is performed in the external quantum security privacy device and the universal business server, and the universal device terminal itself does not require hardware modification.

[0102] At this time, in the quantum security privacy device, the input unit receives instruction data from two sources, the processing instruction in the business data sent by the general device received from the data transmission unit, or the user instruction received from the touch screen. In response to the input unit receiving the user instruction, the output unit sends the processed data only to the touch screen for display; in response to the input unit receiving the processing instruction, the output unit sends the processed data to the touch screen for display, and also uses the method in step 2 to synchronize the processed data to the general device, and the general device displays the information required by the user on the touch screen according to the user instruction.

Claims

1. A quantum security service processing system based on general-purpose equipment, characterized in that: The system includes a quantum security privacy device, a universal device, and a quantum key center connected in sequence; Wherein, the quantum key center is used to issue key file data to the universal device; The universal device is used to transmit first business data data1 to the quantum secure privacy device, forward key file data to the quantum secure privacy device, and receive and store second business data data2 from the quantum secure privacy device, and; The quantum security privacy device is used to authenticate the identity of the general device and process the first business data data1 for the first time to obtain the second business data data2.

2. The quantum security service processing system based on general-purpose equipment according to claim 1, characterized in that: The first business data data1 includes first business type data, first application information data of the business application to which the first business data belongs, a first processing indication for the first business type data, and a secondary processing identifier of whether secondary processing is required, wherein the secondary processing identifier is 1 when secondary processing is required, otherwise the secondary processing identifier is empty.

3. The quantum security service processing system based on general-purpose equipment according to claim 2, characterized in that: The system also includes a service server connected to the universal device and the quantum key center; The quantum key center is also used to issue the key file data to the business server; The general device is also used to determine whether the first business data data1 needs secondary processing, and if the first business data data1 needs secondary processing, call the quantum security privacy device to encrypt the second business data data2 to obtain the third business data data3, receive the key location information from the quantum security privacy device or the business server, send the third business data data3 to the business server, receive the encrypted fourth business data data4 from the business server, and call the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data5; The service server is used for secondary processing the third service data data3 to obtain the fourth service data data4, and encrypting the fourth service data data4 and sending it to the general device; The quantum security privacy device is also used to perform encryption operations on the second business data data2 and decryption operations on the encrypted fourth business data data4.

4. The quantum security service processing system based on general-purpose equipment according to any one of claims 1 to 3, characterized in that: The quantum security privacy device comprises: a communication area, an isolation area and a privacy area; the isolation area is respectively connected to the communication area and the privacy area in communication; wherein: The communication area is used to interact with the general device to obtain the first business data data1 and the encrypted fourth business data data4; the communication area includes a data acquisition unit and a communication protocol unit, and the data acquisition unit is communicatively connected with the communication protocol unit; wherein: the communication protocol unit is pre-configured with a plurality of communication protocols for the quantum security privacy device to establish a communication link with the general device; the data acquisition unit is used to obtain the first business data data1 and the encrypted fourth business data data4 from the general device through the communication link; The isolation area is used to filter the first business data data1 and the encrypted fourth business data data4 and transmit them to the privacy area, and transmit the second business data data2 and the fifth business data data5 from the privacy area to the communication protocol unit; the isolation area includes a data transmission unit and a data filtering unit, and the data transmission unit is communicatively connected to the data filtering unit; the data filtering unit is also communicatively connected to the data acquisition unit, and the data transmission unit is also communicatively connected to the communication protocol unit; wherein: the data filtering unit is configured with a whitelist and / or a blacklist, which is used to filter the first business data data1 and the encrypted fourth business data data4 sent via the data acquisition unit according to the whitelist and / or the blacklist; the data transmission unit is used to transmit the first business data data1 and the encrypted fourth business data data4 filtered by the data filtering unit, and transmit the second business data data2 and the fifth business data data5 from the privacy area to the communication protocol unit; The privacy zone is used to authenticate the identity of the general device, perform integrity verification operations and initial processing on the first business data data1, and perform encryption and decryption on the first business data data1 and the encrypted fourth business data data4 to obtain the second business data data2 and the fifth business data data5; the privacy zone includes an input unit, a main control chip, an encryption and decryption unit, a key storage unit, an authentication unit, a business processing unit, and an output unit; the main control chip is respectively communicated with the input unit, the authentication unit, the encryption and decryption unit, the business processing unit and the key storage unit, the encryption and decryption unit is also communicated with the key storage unit, the output unit is also communicated with the data transmission unit and the encryption and decryption unit, and the input unit is also communicated with the data transmission unit; wherein: the input unit is used to receive the first business data data1 and the encrypted fourth business data data4 from the data transmission unit business data data4; the main control chip is used to receive the first processing instruction and the first business type data forwarded by the input unit, and based on the received first processing instruction, performs the corresponding first operation on the first business type data; the encryption and decryption unit is used to perform encryption or decryption operations on the first business data data1 and the encrypted fourth business data data4 according to the first processing instruction forwarded by the main control chip; the key storage unit is used to store key file data, and provide encryption keys and decryption keys for the encryption and decryption unit; the authentication unit is used to store the identity of the quantum security privacy device, and to verify the integrity of the received first business data data1; the business processing unit is configured with multiple business blocks, and each business block is respectively installed with a second business application corresponding to the first business application in the general device for processing the first business data data1.

5. The quantum security service processing system based on general-purpose equipment according to claim 4, characterized in that: The isolation area also includes a touch screen, which is communicatively connected with the input unit and the output unit in the privacy area and is used to receive user instructions and display business result data.

6. A quantum security service processing method based on general equipment, which is applied to the quantum security service processing system according to claim 1 or 2 or 4 or 5, characterized in that: The quantum security service processing method comprises the following steps: Step 1: The quantum key center issues key file data to the general device, and the general device forwards the key file data to the quantum security privacy device for storage; the general device sends the first business data data1 to the quantum security privacy device, and the quantum security privacy device authenticates the general device and verifies the integrity of the first business data data1; Step 2: In response to the identity authentication and integrity verification in step 1 being passed, the quantum security privacy device performs a first processing on the first business data data1, obtains the second business data data2 after the first processing, and returns the second business data data2 to the general device; Step 3: The general device determines whether the first business data data1 needs secondary processing according to the secondary processing identifier in the stored first business data data1; Step 4: In response to the secondary processing flag in step 3 being empty, the general device stores the second service data data2 and ends the service processing operation.

7. The method for processing quantum security services based on general-purpose equipment according to claim 6, characterized in that: The specific process of step 2 is: Step 2-1: After the identity authentication and integrity verification are passed, the quantum security privacy device notifies the main control chip in the privacy zone of the quantum security privacy device to parse the first application information data from the first business data data1, instructs the business processing unit in the privacy zone to select a business block, and maps the corresponding second business application in the business block according to the first application information data; Step 2-2: the main control chip in the privacy zone instructs the second service application to read the first service type data and the first processing instruction, and the second service application processes the first service type data for the first time according to the first processing instruction to obtain the second service data data2 after the first processing; Step 2-3: The quantum security privacy device returns the second business data data2 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area of ​​the quantum security privacy device, and the communication protocol unit in the communication area of ​​the quantum security privacy device.

8. A quantum security service processing method based on a general device, which is applied to a quantum security service processing system according to any one of claims 3 to 5, characterized in that: The quantum security service processing method comprises the following steps: Steps 1 to 4 are the same as those in claim 6; Step 5: In response to the secondary processing flag in step 3 being 1, the general device calls the quantum security privacy device to encrypt the second business data data2, obtains the third business data data3 and sends it to the business server. The business server performs secondary processing to obtain the fourth business data data4, encrypts the fourth business data data4 and sends it to the general device; Step 6: The general device calls the quantum security privacy device to decrypt the encrypted fourth business data data4 to obtain and store the fifth business data data5.

9. The method for processing quantum security services based on general-purpose equipment according to claim 8, characterized in that: The specific process of step 5 is as follows: Step 5-1: The general device checks the secondary processing identifier in the first business data data1, and when the secondary processing identifier is 1, calls the quantum security privacy device to obtain a first encryption key k1 from the key storage unit in the privacy area of ​​the quantum security privacy device for the second business data data2 in plain text, and records the key location information of the first encryption key k1; Step 5-2: The encryption and decryption unit in the privacy zone of the quantum secure privacy device uses the first key k1 to perform an encryption operation on the second business data data2 in plain text to obtain the first ciphertext M1=data2⊕k1, wherein the first ciphertext M1 is the third business data data3, and the key position information of the first encryption key k1 and the third business data data3 are sent to the general device via the output unit in the privacy zone, the data transmission unit in the isolation zone of the quantum secure privacy device, and the communication protocol unit in the communication zone of the quantum secure privacy device; Step 5-3: the general device forwards the key location information of the first encryption key k1 and the third business data data3 to the business server, the business server initiates a key application to the quantum key center, the quantum key center issues key file data to the business server, the business server obtains the first decryption key k1' from the key file data according to the key location information of the first encryption key k1, uses the first decryption key k1' to decrypt the third business data data3 to obtain the decrypted second business data data2', performs a secondary processing operation on the decrypted second business data data2', and obtains the fourth business data data4; Step 5-4: The business server obtains the second encryption key k2 from the key file data for the fourth business data data4, records the key location information of the second encryption key k2, uses the second encryption key k2 to perform an encryption operation on the fourth business data data4 to obtain the second ciphertext M2=data4⊕k2, and sends the key location information of the second encryption key k2 and the second ciphertext M2 to the general device.

10. The method for processing quantum security services based on general-purpose equipment according to claim 9, characterized in that: The specific process of step 6 is as follows: Step 6-1: The general device forwards the key location information of the second encryption key k2 to the quantum secure privacy device, and the key storage unit in the privacy area of ​​the quantum secure privacy device receives and stores the key location information of the second encryption key k2; Step 6-2: The key storage unit in the privacy area of ​​the quantum security privacy device obtains the second decryption key k2' from the key file data therein according to the key location information of the second encryption key k2 and sends it to the encryption and decryption unit in the privacy area. The encryption and decryption unit uses the second decryption key k2' to decrypt the second ciphertext M2 to obtain the fifth business data data5, and sends the fifth business data data5 to the general device via the output unit in the privacy area, the data transmission unit in the isolation area, and the communication protocol unit in the communication area. The general device stores the fifth business data data5.

Images