Cross-domain user login system, method and device based on quantum key distribution network

Abstract

The invention provides a cross-domain user login system, method and device based on a quantum key distribution network, and the system comprises an access routing service which is used for routing a user request to a corresponding service center; the plurality of service centers are used for receiving and processing user requests and sending key requests and identity authentication requests to the corresponding quantum cryptography service modules; the quantum cryptography service module is used for providing an encryption key for the key request and performing identity authentication for the identity authentication request; the quantum exchange cipher machine is used for receiving the quantum key sent by the quantum random number generator and providing a key service, the quantum key pre-generated by the quantum random number generator is stored in the quantum exchange cipher machine, and the quantum key and the quantum security key stored in the quantum security chip are symmetric keys; and the quantum key distribution module is used for enabling two communication parties to generate and share the same quantum key based on a quantum key distribution protocol, and encrypting and decrypting based on the quantum key. According to the invention, the multi-center scene communication security is improved.

Description

Technical Field

[0001] The present application relates to the field of instant messaging and network security technology, and in particular to a cross-domain user login system, method and device based on a quantum key distribution network. Background Art

[0002] With the rapid development of Internet technology and the expansion of network application systems, various services and resources will be distributed to different domains. Different services and resources are distinguished according to domain division and permission management, so that users in different domains can use them according to different needs. This way of accessing services and resources in different domains involves cross-domain access.

[0003] In order to solve the cross-domain problem, the prior art provides a cross-domain identity authentication method based on a quantum key distribution network, including: sending a key negotiation request to the corresponding quantum key management system, and forwarding it to the quantum key generation system by the quantum key management system, so that the quantum key generation system establishes a relay key negotiation link between quantum key terminals and generates a symmetric authentication key; receiving the authentication request sent by the corresponding user-side terminal, and assigning the authentication key identifier to the user-side terminal based on the authentication request; receiving the login request information sent by the corresponding user-side terminal, and responding to the constructed token ciphertext to the user-side terminal based on the login request information, so that when the user-side terminal accesses the cross-domain identity authentication service system, the token ciphertext is forwarded to the cross-domain identity authentication service system. This solution solves the centralization problem of cross-domain identity authentication and improves the confidentiality and integrity of the distribution of authentication credential data.

[0004] The prior art also provides a cross-trust domain identity authentication method, including an identity authentication service module and an authentication terminal module; the identity authentication service module provides identity token issuance service and authentication service; the identity token issuance service includes the acceptance of identity token application, the packaging of identity tokens and the issuance of identity tokens; the identity token authentication service provides challenge-based identity token authentication, and returns user application system information based on legal tokens, and excludes identity token authentication of illegal users by synchronizing LDAP or CRL; the authentication terminal module includes an identity token application module and a client password module; the identity token application module is responsible for the application and maintenance of identity tokens; the client password module provides client certificates and password operations. This solution realizes one-stop authentication and full network access, solving the current trust problem.

[0005] Applying the solution provided by the existing technology, in the cross-trust domain scenario, each user belongs to a different trust domain, and a multi-center system is formed based on different trust domains, and each center is in a trust domain, and the business centers can communicate with each other. In this way, when a user logs in to the system, the system can assign the request to a certain business center according to a certain strategy. However, in some cases, the user's own identity information may not be in this center, resulting in the failure of cross-domain users to log in to the system. Summary of the invention

[0006] The present application illustrates a cross-domain user login system, method and device based on a quantum key distribution network.

[0007] In the first aspect, the present application shows a cross-domain user login system based on a quantum key distribution network, the system comprising: an access routing service, a plurality of business centers, a quantum cryptographic service module corresponding to each business center, a quantum exchange cryptographic machine, and a quantum key distribution module; wherein,

[0008] The access routing service is used to route user requests sent by users from the client or Web end to the corresponding service center according to a preset algorithm;

[0009] The multiple business centers receive and process the user requests sent by the access routing service, and send key requests and identity authentication requests to corresponding quantum cryptography service modules;

[0010] The quantum cryptography service module is connected to the quantum exchange cryptographic machine and is used to provide an encryption key for the key request and perform identity authentication for the identity authentication request;

[0011] The quantum exchange cryptographic machine is used to receive the quantum key sent by the quantum random number generator and provide key services. The quantum exchange cryptographic machine stores the quantum key pre-generated by the quantum random number generator and is a symmetric key with the quantum security key stored in the quantum security chip;

[0012] The quantum key distribution module is used to enable both communicating parties to generate and share the same quantum key based on the quantum key distribution protocol, and to encrypt and decrypt user data based on the quantum key.

[0013] Optionally, the quantum security chip is specifically used for:

[0014] Through the network and the quantum cryptography service module, the received quantum key sent by the quantum random number generator and the quantum security key are subjected to symmetric entity authentication.

[0015] Optionally, the business center is specifically used to:

[0016] Process user requests for system registration, system login, system query, and system exit.

[0017] Optionally, the access routing service is specifically used for:

[0018] According to a preset algorithm based on at least one influencing factor including load pressure, time consumption, polling, IP address, and user's address, the user request sent from the client or Web end is routed to the corresponding business center.

[0019] Optionally, the system further comprises: a quantum key filling machine;

[0020] The quantum key charging machine is connected to the output end of the quantum cryptographic switch and is used for charging quantum keys.

[0021] Optionally, the system further comprises: a quantum security shield;

[0022] The quantum security shield is used to process key reading and data encryption on the quantum security chip and data and information interaction with the quantum cryptography service module.

[0023] In the second aspect, the present application shows a cross-domain user login method based on a quantum key distribution network, which is applied to the above system, and the method includes:

[0024] The target business center receives the system login request of the target user;

[0025] The target service center inquires whether it contains the user data of the target user. If not, it requests the user data from the candidate service center, which is a plurality of service centers other than the target service center.

[0026] The original service center in the candidate service center that contains the user data requests to obtain the quantum key through the corresponding quantum cryptography service module in the domain;

[0027] The corresponding quantum cryptography service module in the original business center domain generates a shared quantum key through the QKD node in the domain, distributes the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and returns the shared quantum key to the system;

[0028] The original service center encrypts the user data based on the shared quantum key, and transmits the ciphertext to the target service center through the network;

[0029] The target business center receives the ciphertext, applies for the shared quantum key from the quantum cryptography service module in the target business center domain, and uses the shared quantum key to decrypt the ciphertext to obtain decrypted user data;

[0030] The target business center compares the user data carried in the system login request with the decrypted user data, and the user login is successful after authentication.

[0031] Optionally, before the step of the target service center receiving the system login request of the target user, the method further includes:

[0032] The target user requests the registration interface from the client or web end;

[0033] The access routing service routes the user request of the target user to the original service center;

[0034] The original business center creates a user and records user information, and the user information at least includes a user password, a fingerprint, and an identity token.

[0035] Optionally, the step of the target service center receiving a system login request from a target user includes:

[0036] The access routing service responds to the system login request sent by the target user from the client or the Web end, and routes the system login request to the target business center according to a preset algorithm.

[0037] In the third aspect, the present application shows a cross-domain user login device based on a quantum key distribution network, which is applied to the above system, and the device includes:

[0038] A user request receiving module, used for the target business center to receive the system login request of the target user;

[0039] A user data query module, used for the target service center to query whether it contains the user data of the target user, and if not, to request the user data from a candidate service center, wherein the candidate service center is a plurality of service centers other than the target service center;

[0040] A quantum key generation module, used for the original service center in the candidate service center containing the user data to request a quantum key through a corresponding quantum cryptography service module in the domain;

[0041] A quantum key distribution module, which is used for the corresponding quantum cryptography service module in the original business center domain to generate a shared quantum key through the QKD node in the domain, and to distribute the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and to return the shared quantum key to the system;

[0042] A user data encryption module, used for the original business center to encrypt the user data based on the shared quantum key and transmit the ciphertext to the target business center through the network;

[0043] A user data decryption module is used for the target business center to receive the ciphertext, apply for the shared quantum key from the quantum cryptography service module in the target business center domain, and use the shared quantum key to decrypt the ciphertext to obtain the decrypted user data;

[0044] The login authentication module is used for the target business center to compare the user data carried in the system login request with the decrypted user data, and the user login is successful after the authentication is passed.

[0045] Optionally, the user request receiving module is specifically configured to, when the target user requests a registration interface from the client or the Web end, route the user request of the target user to the original service center via the access routing service;

[0046] The device further comprises: an information registration module, which is used for the original service center to create a user and record user information when receiving a user request sent by the user request module. The user information at least comprises a user password, a fingerprint, and an identity token.

[0047] Optionally, the user request receiving module is specifically used to access the routing service response to the system login request sent by the target user from the client or the Web end, and route the system login request to the target business center according to a preset algorithm.

[0048] In a fourth aspect, the present application shows an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the above method when executed by the processor.

[0049] In a fifth aspect, the present application illustrates a computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and the computer program implements the above method when executed by a processor.

[0050] In a sixth aspect, the present application illustrates a computer program product, characterized in that when instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the above method.

[0051] The technical solution provided by this application may have the following beneficial effects:

[0052] The cross-domain user login solution based on the quantum key distribution network provided in this application, on the one hand, uses quantum key distribution QKD technology to ensure that the communicating parties can generate and share a security key known only to both parties, which is used to encrypt and decrypt the communication content, thereby preventing potential eavesdropping and data leakage, thereby improving the security of communication; on the other hand, through quantum key distribution QKD technology, multiple business centers can share a key, so that multiple business centers can use this key to encrypt and decrypt user authentication information (such as passwords, fingerprints, authentication codes and other data) for transmission, in this way, the user's cross-trust domain login is successfully achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 An architecture diagram of a cross-domain user login system based on a quantum key distribution network provided by this application;

[0054] Figure 2 A flow chart of a cross-domain user login method based on a quantum key distribution network provided by this application;

[0055] Figure 3 A structural diagram of a cross-domain user login device based on a quantum key distribution network provided by this application;

[0056] Figure 4 A block diagram of an electronic device provided in this application.

[0057] Figure 5 A block diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] In the solution provided by the prior art, in the cross-trust domain scenario, each user belongs to a different trust domain, and a multi-center system is formed based on different trust domains, and each center is in a trust domain, and the business centers can communicate with each other. In this way, when a user logs in to the system, the system can assign the request to a certain business center according to a certain strategy. However, in some cases, the user's own identity information may not be in this center, resulting in the failure of cross-domain users to log in to the system.

[0060] To solve the above problems, the present application provides a cross-domain user login system, method and device based on a quantum key distribution network. The present application scheme is described in detail below in conjunction with the accompanying drawings.

[0061] Embodiment 1

[0062] See also Figure 1 , is an architecture diagram of a cross-domain user login system based on a quantum key distribution network provided by the present application. Specifically, the cross-domain user login system based on a quantum key distribution network provided by the present application includes: access routing services, multiple business centers ( Figure 1 2 business centers are shown in the figure), quantum cryptography service modules corresponding to each business center, quantum exchange cipher machines (not shown), quantum key distribution modules (i.e. Figure 1 QKD node 1 and QKD node 2 in it).

[0063] The access routing service is used to route the user request sent by the user from the client or the Web end to the corresponding service center according to a preset algorithm. Specifically, the access routing service routes the user request sent by the user from the client or the Web end to the corresponding service center according to a preset algorithm constructed based on at least one influencing factor of load pressure, time consumption, polling, IP address, and user address. The preset algorithm includes but is not limited to load pressure, time consumption, polling, IP address, and user address.

[0064] The multiple business centers receive and process the user requests sent by the access routing service, and send key requests and identity authentication requests to the corresponding quantum cryptography service modules. Specifically, the business center can process user requests for system registration, system login, system query, and system exit, etc. It should be pointed out that the user requests here include but are not limited to the above four situations.

[0065] The quantum cryptography service module is connected to the quantum exchange cryptographic machine and is used to provide encryption keys for the key request and to perform identity authentication for the identity authentication request. Specifically, the quantum cryptography service module realizes data interaction with the instant messaging system and the quantum security chip through the network, and the quantum cryptography management service system is directly connected to the quantum cryptography switch to provide encryption keys and identity authentication functions.

[0066] The quantum exchange cryptographic machine is used to receive the quantum key sent by the quantum random number generator and provide key services. The quantum exchange cryptographic machine stores the quantum key pre-generated by the quantum random number generator and is a symmetric key with the quantum security key stored in the quantum security chip; wherein the quantum random number generator is used to generate the quantum key.

[0067] The quantum key distribution module is used to enable both parties to generate and share the same quantum key based on the quantum key distribution protocol, and to encrypt and decrypt user data based on the quantum key. Specifically, the quantum key distribution module ( Figure 1 The QKD node in the QKD network) is based on the internationally accepted quantum key distribution protocols such as the BB84 protocol and BBM92, allowing the communicating parties to generate and share a random, secure key for encryption and decryption of user data.

[0068] In one scenario, the quantum security chip stores a quantum security key. The quantum security key stored in each quantum security chip and the key pre-stored in the quantum exchange cryptographic machine are symmetric keys, which are specifically used to perform symmetric entity authentication between the quantum key received from the quantum random number generator and the quantum security key through the network and the quantum cryptographic service module.

[0069] Furthermore, the system also includes: a quantum key charging machine, which is connected to the output end of the quantum cryptographic switch and is used for charging quantum keys.

[0070] Furthermore, the system also includes: a quantum security shield, which is used to process key reading, data encryption, and data and information interaction with the quantum cryptography service module on the quantum security chip.

[0071] The cross-domain user login system based on the quantum key distribution network provided by the present application, on the one hand, uses quantum key distribution QKD technology to ensure that the communicating parties can generate and share a security key known only to both parties, which is used to encrypt and decrypt the communication content, thereby preventing potential eavesdropping and data leakage, thereby improving the security of communication; on the other hand, through quantum key distribution QKD technology, multiple business centers can share a key, so that multiple business centers can use this key to encrypt and decrypt user authentication information (such as passwords, fingerprints, authentication codes and other data) for transmission, thereby achieving successful user login across trust domains.

[0072] Embodiment 2

[0073] See also Figure 2 , is a flow chart of a cross-domain user login method based on a quantum key distribution network provided by the present application, which is applied to the system described in Example 1. The method may include the following steps:

[0074] Step S101: The target service center receives a system login request from a target user.

[0075] Specifically, the access routing service responds to the system login request sent by the target user from the client or the Web end, and routes the system login request to the target service center according to a preset algorithm.

[0076] Step S102: the target service center queries whether it contains the user data of the target user. If not, it requests the user data from candidate service centers, which are multiple service centers other than the target service center.

[0077] Step S103: The original service center containing the user data in the candidate service center requests to obtain the quantum key through the corresponding quantum cryptography service module in the domain.

[0078] Step S104: The corresponding quantum cryptography service module in the original business center domain generates a shared quantum key through the QKD node in the domain, distributes the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and returns the shared quantum key to the system.

[0079] Step S105: The original business center encrypts the user data based on the shared quantum key, and transmits the ciphertext to the target business center through the network.

[0080] Step S106: The target business center receives the ciphertext, applies for the shared quantum key from the quantum cryptography service module in the target business center domain, and uses the shared quantum key to decrypt the ciphertext to obtain decrypted user data.

[0081] Step S107: The target business center compares the user data carried in the system login request with the decrypted user data, and the user login is successful after authentication.

[0082] In one case, before the step of the target service center receiving the system login request of the target user, the method may further include the following steps:

[0083] (1) The target user requests the registration interface from the client or web end;

[0084] (2) The access routing service routes the user request of the target user to the original service center;

[0085] (3) The original business center creates a user and records the user information, where the user information includes at least a user password, fingerprint, and identity token.

[0086] The cross-domain user login method based on the quantum key distribution network provided in this application, on the one hand, uses quantum key distribution QKD technology to ensure that the communicating parties can generate and share a security key known only to both parties, which is used to encrypt and decrypt the communication content, thereby preventing potential eavesdropping and data leakage, thereby improving the security of communication; on the other hand, through quantum key distribution QKD technology, multiple business centers can share a key, so that multiple business centers can use this key to encrypt and decrypt user authentication information (such as passwords, fingerprints, authentication codes and other data) for transmission, in this way, the user's cross-trust domain login is successfully achieved.

[0087] The following is a specific example to illustrate the cross-domain user login method based on the quantum key distribution network provided by this application. Figure 1 and Figure 2 , where business center 1 is the original business center that protects user data, and business center 2 is the target business center to be logged in.

[0088] S1. The user requests the registration interface from the client or Web client, and the access routing service routes the user request to the business center 1;

[0089] S2. Business center 1 creates users and records user information, such as user passwords, fingerprints, identity tokens, and other data;

[0090] S3. The user requests the login interface again through the client and Web terminals, and the access routing service routes the user request to the business center 2 according to the routing algorithm;

[0091] S4. Business center 2 queries whether it has stored the user information. If it is found that this business center does not contain user data, business center 2 sends a request to other business centers ( Figure 1 The business center 1) requests user data;

[0092] S5. Since user data is private data and needs to be encrypted for transmission, after receiving the user data request, business center 1 requests a quantum random number key through the quantum cryptography service module corresponding to business center 1;

[0093] S6. The quantum cryptography service module corresponding to the business center 1 generates a shared quantum key through the QKD node 1;

[0094] S7. The quantum cryptography service module corresponding to the business center 1 distributes the shared quantum key to the QKD target node through the quantum network;

[0095] S8. The quantum cryptography service module corresponding to the business center 1 returns the generated shared key to the business system;

[0096] S9. Business center 1 uses the shared quantum key to encrypt the user's private data and transmits the ciphertext to business center 2 via the classical network;

[0097] S10. Business center 2 receives the ciphertext, and business center 2 applies for the corresponding shared quantum key from the corresponding quantum cryptography service module;

[0098] S11. Business center 2 obtains the shared quantum key distributed through the quantum network and decrypts the ciphertext;

[0099] S12. The business center 2 compares the user data carried in the login request with the decrypted user data. If the verification is successful, the user login is successful.

[0100] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0101] Embodiment 3

[0102] See also Figure 3, which is a structural diagram of a cross-domain user login device based on a quantum key distribution network provided by the present application, which is applied to a system including multiple business centers in different domains. The device may include the following modules:

[0103] A user request receiving module 21, used for a target service center to receive a system login request from a target user;

[0104] A user data query module 22, used for the target service center to query whether it contains the user data of the target user, and if not, to request the user data from a candidate service center, wherein the candidate service center is a plurality of service centers other than the target service center;

[0105] A quantum key generation module 23, used for the original service center in the candidate service center containing the user data to request to obtain a quantum key through a corresponding quantum cryptography service module in the domain;

[0106] A quantum key distribution module 24 is used for the corresponding quantum cryptography service module in the original business center domain to generate a shared quantum key through the QKD node in the domain, and to distribute the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and to return the shared quantum key to the system;

[0107] A user data encryption module 25, used for the original business center to encrypt the user data based on the shared quantum key and transmit the ciphertext to the target business center through the network;

[0108] The user data decryption module 26 is used for the target business center to receive the ciphertext, apply for the shared quantum key from the quantum cryptography service module in the target business center domain, and use the shared quantum key to decrypt the ciphertext to obtain the decrypted user data;

[0109] The login authentication module 27 is used for the target business center to compare the user data carried in the system login request with the decrypted user data, and the user login is successful after the authentication is passed.

[0110] In one case, the user request receiving module 21 is specifically configured to route the user request of the target user to the original service center via the access routing service when the target user requests a registration interface from the client or the Web end;

[0111] Furthermore, the device further comprises: an information registration module, which is used for the original business center to create a user and record user information when receiving a user request sent by the user request module, wherein the user information at least comprises a user password, a fingerprint, and an identity token. Accordingly, the user request receiving module 21 is specifically used for accessing the routing service to respond to the system login request sent by the target user from the client or the Web end, and to route the system login request to the target business center according to a preset algorithm.

[0112] The cross-domain user login device based on the quantum key distribution network provided in the present application, on the one hand, uses the quantum key distribution QKD technology to ensure that the communicating parties can generate and share a security key known only to both parties, which is used to encrypt and decrypt the communication content, thereby preventing potential eavesdropping and data leakage, thereby improving the security of communication; on the other hand, through the quantum key distribution QKD technology, multiple business centers can share a key, so that multiple business centers can use this key to encrypt and decrypt user authentication information (such as passwords, fingerprints, authentication codes and other data) for transmission, thereby achieving successful user login across trust domains.

[0113] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0114] Embodiment 4

[0115] Optionally, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0116] Embodiment 5

[0117] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] Embodiment 6

[0119] In a sixth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to execute the method described in any of the above aspects.

[0120] FIG4 is a block diagram of an electronic device 800 shown in the present application. For example, the electronic device 800 may be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0121] Reference Figure 4 , the electronic device 800 may include one or more of the following components: a processing component 802 , a memory 804 , a power component 806 , a multimedia component 808 , an audio component 810 , an input / output (I / O) interface 812 , a sensor component 814 , and a communication component 816 .

[0122] The processing component 802 generally controls the overall operation of the electronic device 800, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 802 may include one or more processors 820 to execute instructions to complete all or part of the steps of the above method. In addition, the processing component 802 may include one or more modules to facilitate the interaction between the processing component 802 and other components. For example, the processing component 802 may include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0123] The memory 804 is configured to store various types of data to support operations on the device 800. Examples of such data include instructions for any application or method operating on the electronic device 800, contact data, phone book data, messages, images, videos, etc. The memory 804 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0124] The power supply component 806 provides power to the various components of the electronic device 800. The power supply component 806 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 800.

[0125] The multimedia component 808 includes a screen that provides an output interface between the electronic device 800 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. When the device 800 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0126] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC), and when the electronic device 800 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 804 or sent via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0127] I / O interface 812 provides an interface between processing component 802 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: home button, volume button, start button, and lock button.

[0128] The sensor assembly 814 includes one or more sensors for providing various aspects of status assessment for the electronic device 800. For example, the sensor assembly 814 can detect the open / closed state of the device 800, the relative positioning of components, such as the display and keypad of the electronic device 800, and the sensor assembly 814 can also detect the position change of the electronic device 800 or a component of the electronic device 800, the presence or absence of contact between the user and the electronic device 800, the orientation or acceleration / deceleration of the electronic device 800, and the temperature change of the electronic device 800. The sensor assembly 814 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 814 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 814 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0129] The communication component 816 is configured to facilitate wired or wireless communication between the electronic device 800 and other devices. The electronic device 800 can access a wireless network based on a communication standard, such as WiFi, a carrier network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast operation information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0130] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0131] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 804 including instructions, and the instructions can be executed by a processor 820 of an electronic device 800 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0132] Figure 5 1 is a block diagram of an electronic device 1900 shown in the present application. For example, the electronic device 1900 may be provided as a server.

[0133] Reference Figure 5 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0134] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™ or the like.

[0135] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0136] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0137] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0138] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0139] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0140] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0141] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0143] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0144] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cross-domain user login system based on quantum key distribution network, characterized in that: The system includes: access routing services, multiple business centers, quantum cryptography service modules corresponding to each business center, quantum exchange cipher machines, and quantum key distribution modules; wherein, The access routing service is used to route user requests sent by users from the client or Web end to the corresponding service center according to a preset algorithm; The multiple business centers receive and process the user requests sent by the access routing service, and send key requests and identity authentication requests to corresponding quantum cryptography service modules; The quantum cryptography service module is connected to the quantum exchange cryptographic machine and is used to provide an encryption key for the key request and perform identity authentication for the identity authentication request; The quantum exchange cryptographic machine is used to receive the quantum key sent by the quantum random number generator and provide key services. The quantum exchange cryptographic machine stores the quantum key pre-generated by the quantum random number generator and is a symmetric key with the quantum security key stored in the quantum security chip; The quantum key distribution module is used to enable both communicating parties to generate and share the same quantum key based on the quantum key distribution protocol, and to encrypt and decrypt user data based on the quantum key.

2. According to claim 1, the cross-domain user login system based on quantum key distribution network is characterized in that: The quantum security chip is specifically used for: Through the network and the quantum cryptography service module, the received quantum key sent by the quantum random number generator and the quantum security key are subjected to symmetric entity authentication.

3. According to claim 1, the cross-domain user login system based on quantum key distribution network is characterized in that: The business center is specifically used for: Process user requests for system registration, system login, system query, and system exit.

4. The cross-domain user login system based on quantum key distribution network according to claim 1 is characterized in that: The access routing service is specifically used for: According to a preset algorithm based on at least one influencing factor including load pressure, time consumption, polling, IP address, and user's address, the user request sent from the client or Web end is routed to the corresponding business center.

5. The cross-domain user login system based on quantum key distribution network according to claim 1 is characterized in that: The system also includes: a quantum key filling machine; The quantum key charging machine is connected to the output end of the quantum cryptographic switch and is used for charging quantum keys.

6. The cross-domain user login system based on quantum key distribution network according to claim 1 is characterized in that: The system also includes: a quantum security shield; The quantum security shield is used to process key reading and data encryption on the quantum security chip and data and information interaction with the quantum cryptography service module.

7. A cross-domain user login method based on quantum key distribution network, characterized in that: Applied to the system according to any one of claims 1 to 6, the method comprises: The target business center receives the system login request of the target user; The target service center inquires whether it contains the user data of the target user. If not, it requests the user data from the candidate service center, which is a plurality of service centers other than the target service center. The original service center in the candidate service center that contains the user data requests to obtain the quantum key through the corresponding quantum cryptography service module in the domain; The corresponding quantum cryptography service module in the original business center domain generates a shared quantum key through the QKD node in the domain, distributes the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and returns the shared quantum key to the system; The original service center encrypts the user data based on the shared quantum key, and transmits the ciphertext to the target service center through the network; The target business center receives the ciphertext, applies for the shared quantum key from the quantum cryptography service module in the target business center domain, and uses the shared quantum key to decrypt the ciphertext to obtain decrypted user data; The target business center compares the user data carried in the system login request with the decrypted user data, and the user login is successful after authentication.

8. The cross-domain user login method based on quantum key distribution network according to claim 7 is characterized in that: Before the step of the target service center receiving the system login request of the target user, the method further includes: The target user requests the registration interface from the client or web end; The access routing service routes the user request of the target user to the original service center; The original business center creates a user and records user information, and the user information at least includes a user password, a fingerprint, and an identity token.

9. The cross-domain user login method based on quantum key distribution network according to claim 7 is characterized in that: The step of the target service center receiving the system login request of the target user comprises: The access routing service responds to the system login request sent by the target user from the client or the Web end, and routes the system login request to the target business center according to a preset algorithm.

10. A cross-domain user login device based on a quantum key distribution network, characterized in that: Applied to the system according to any one of claims 1 to 6, the device comprises: A user request receiving module, used for the target business center to receive the system login request of the target user; A user data query module, used for the target service center to query whether it contains the user data of the target user, and if not, to request the user data from a candidate service center, wherein the candidate service center is a plurality of service centers other than the target service center; A quantum key generation module, used for the original service center in the candidate service center containing the user data to request a quantum key through a corresponding quantum cryptography service module in the domain; A quantum key distribution module, which is used for the corresponding quantum cryptography service module in the original business center domain to generate a shared quantum key through the QKD node in the domain, and to distribute the shared quantum key to the QKD target node in the target business center domain based on the quantum key distribution network, and to return the shared quantum key to the system; A user data encryption module, used for the original business center to encrypt the user data based on the shared quantum key and transmit the ciphertext to the target business center through the network; A user data decryption module is used for the target business center to receive the ciphertext, apply for the shared quantum key from the quantum cryptography service module in the target business center domain, and use the shared quantum key to decrypt the ciphertext to obtain the decrypted user data; The login authentication module is used for the target business center to compare the user data carried in the system login request with the decrypted user data, and the user login is successful after the authentication is passed.

11. The cross-domain user login device based on quantum key distribution network according to claim 10 is characterized in that: The user request receiving module is specifically used for routing the user request of the target user to the original service center by the access routing service when the target user requests the registration interface from the client or the Web end; The device further comprises: an information registration module, which is used for the original service center to create a user and record user information when receiving a user request sent by the user request module. The user information at least comprises a user password, a fingerprint, and an identity token.

12. The cross-domain user login device based on quantum key distribution network according to claim 11 is characterized in that: The user request receiving module is specifically used for: The access routing service responds to the system login request sent by the target user from the client or the Web end, and routes the system login request to the target business center according to a preset algorithm.

13. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the method according to any one of claims 7 to 9 when executed by the processor.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 7 to 9 is implemented.

15. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the method as claimed in any one of claims 7 to 9.

Images