Application program file processing method and device based on quantum key

Abstract

The embodiment of the invention provides an application program file processing method and device based on a quantum key. The method comprises the steps of obtaining an application program file; the application program file is a file obtained after source codes in an application program are packaged; obtaining a target application program file according to the random number pair and the application program file; sending the random number pair to the quantum key service platform, so that the quantum key service platform determines an encryption and decryption key for decrypting the target application program file based on the random number pair; and sending the target application program file to the client, so that the client decrypts the target application program file based on the encryption and decryption key sent in the quantum key service platform. According to the embodiment of the invention, the source code of the application program can be ensured to be always in an encrypted state in transmission and storage processes, and the risk of source code leakage of the application program is greatly reduced.

Description

Technical Field

[0001] The present application relates to the field of software development and application security technology, and in particular to a method and device for processing application files based on quantum keys, an electronic device, and a storage medium. Background Art

[0002] Applications based on the Electron framework (a cross-platform desktop application framework built using JavaScript, HTML, and CSS) will package the source code into an asar (a special archive format) file when packaging, which will be dynamically loaded and interpreted at runtime. asar is an archive format that combines multiple files into one file. It generally does not have a confidentiality function and is easy to be read and redistributed, posing a great security risk.

[0003] Most encryption methods currently used are generally based on symmetric encryption and asymmetric encryption. The keys are stored in applications or encrypted files, or transmitted over the Internet. However, these methods have the risk of keys being cracked, further increasing the possibility of application source code leakage. Summary of the invention

[0004] The embodiment of the present application provides an application file processing method based on quantum key to solve the problem that the methods currently used by most encryption and decryption ASARs are at high risk of being cracked.

[0005] Correspondingly, an embodiment of the present application also provides an application file processing device based on quantum key, an electronic device and a storage medium to ensure the implementation and application of the above method.

[0006] In order to solve the above problems, the embodiment of the present application discloses a method for processing application files based on quantum key, which is applied to a server, and the server is connected to a client and a quantum key service platform respectively. The method includes:

[0007] Obtaining an application file; the application file is a file obtained by packaging the source code in the application;

[0008] Obtaining a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers;

[0009] Sending the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair;

[0010] The target application file is sent to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

[0011] Optionally, obtaining the application file includes:

[0012] Generate the random number pair and determine the file address corresponding to the application file;

[0013] A processing program is called based on the random number pair and the file address, so that the processing program obtains the application file based on the file address; the processing program is used to process the application file.

[0014] Optionally, obtaining a target application file according to the random number pair and the application file includes:

[0015] Using the first random number in the random number pair as the encryption / decryption key, and controlling the processing program to encrypt the application file using the encryption / decryption key to obtain an encrypted application file;

[0016] The second random number in the random number pair is used as a file identifier, and the processing program is controlled to insert the file identifier into the file header of the application file to obtain the target application file.

[0017] The embodiment of the present application also discloses a method for processing application files based on quantum key, which is applied to a client, and the client is connected to a server and a quantum key service platform respectively, and the method includes:

[0018] When receiving the target application file sent by the server, obtaining the key identifier;

[0019] Parsing the target application file to obtain a file identifier and an encrypted application file in the target application file;

[0020] Controlling the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier;

[0021] When the target encryption and decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption and decryption key to obtain the application file; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

[0022] Optionally, when receiving the target application file sent by the server, obtaining the key identifier includes:

[0023] When the target application file sent by the server is received, the quantum security chip is installed; and the key identifier and the quantum key corresponding to the key identifier in the quantum security chip are obtained.

[0024] Optionally, when receiving the target encryption and decryption key sent by the quantum key service platform, decrypting the encrypted application file according to the target encryption and decryption key to obtain the application file, and storing the application file in the memory includes:

[0025] Decrypting the target encryption and decryption key based on the quantum key corresponding to the key identifier to obtain the encryption and decryption key;

[0026] Decrypting the encrypted application file based on the encryption / decryption key to obtain the application file;

[0027] The application program file is stored in the memory.

[0028] The embodiment of the present application also discloses an application file processing device based on quantum key, which is applied to a server, and the server is connected to a client and a quantum key service platform respectively, and the device includes:

[0029] An application file acquisition module, used to acquire an application file; the application file is a file obtained by packaging the source code in the application;

[0030] A target application file module, used to obtain a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers;

[0031] A random number pair sending module, used to send the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair;

[0032] A target application file sending module is used to send the target application file to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

[0033] The embodiment of the present application also discloses an application file processing device based on quantum key, which is applied to a client, and the client is connected to a server and a quantum key service platform respectively, and the device includes:

[0034] A key identification acquisition module, used to acquire the key identification when receiving the target application file sent by the server;

[0035] A target application file parsing module, used to parse the target application file, obtain a file identifier in the target application file and an encrypted application file;

[0036] A key determination module, used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier;

[0037] The target application file decryption module is used to decrypt the encrypted application file according to the target encryption and decryption key to obtain the application file when receiving the target encryption and decryption key sent by the quantum key service platform; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

[0038] An embodiment of the present application also discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the quantum key-based application file processing method as described in any one of the embodiments of the present application.

[0039] The embodiments of the present application also disclose one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes the quantum key-based application file processing method as described in any one of the embodiments of the present application.

[0040] Compared with the prior art, the embodiments of the present application have the following advantages:

[0041] In an embodiment of the present application, at a server, an application file is obtained; the application file is a file obtained by packaging the source code in the application; a target application file is obtained according to a random number pair and the application file; the random number pair includes two random numbers and a correspondence between the two random numbers; the random number pair is sent to the quantum key service platform, so that the quantum key service platform determines an encryption and decryption key for decrypting the target application file based on the random number pair; the target application file is sent to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

[0042] The server in the embodiment of the present application can perform advanced encryption on the application file through the random number pair to obtain the target application file, and transmit the encrypted application file, which can ensure that the source code is always encrypted during the transmission and storage process, greatly reducing the risk of source code leakage. In addition, the server sends the random number pair to the quantum key service platform and stores it, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0043] In an embodiment of the present application, at the client, when the target application file sent by the server is received, a key identifier is obtained; the target application file is parsed to obtain the file identifier and the encrypted application file in the target application file; the quantum key service platform is controlled to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier; when the target encryption and decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption and decryption key to obtain the application file; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

[0044] The client in the embodiment of the present application obtains the corresponding encryption and decryption key and quantum key from the quantum key service platform according to the file identifier and key identifier, realizing a flexible decryption mechanism, ensuring the decryption security of the application file, and avoiding source code leakage. In addition, the client realizes the secure management and use of the quantum key through the quantum key service platform, ensuring the security and reliability of the decryption process. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a connection diagram based on multi-party communication of the present application;

[0046] Figure 2 It is a flowchart of a step of an embodiment of a method for processing an application file based on a quantum key of the present application;

[0047] Figure 3 is a flowchart of another embodiment of a method for processing an application file based on a quantum key of the present application;

[0048] Figure 4 This is a flowchart of another embodiment of a method for processing an application file based on a quantum key of the present application;

[0049] Figure 5 It is a structural block diagram of an embodiment of an application file processing device based on quantum key of the present application;

[0050] Figure 6It is a structural block diagram of another embodiment of an application file processing device based on quantum key of the present application;

[0051] Figure 7 It is a schematic diagram of the structure of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0053] A method for protecting the source code of an Electron framework application is proposed in an embodiment of the present application. Specifically, the embodiment of the present application uses a charged symmetric quantum key to protect the encryption and decryption keys of an asar file. Each time the program is run, a pair of quantum keys is consumed. The quantum keys are stored in a quantum security chip on the client. The encryption and decryption keys are encrypted using quantum keys and transmitted over the Internet, ultimately protecting the asar file from being stolen and redistributed.

[0054] In order to further solve the problem mentioned in the background technology that most of the current methods used for encrypting and decrypting asar files are at high risk of being cracked, the embodiment of the present application proposes a quantum key application file processing method, which is suitable for packaging and running Windows applications based on the Electron framework on computers with Windows (operating system interface and application interface) operating system, involving the Electron framework, electron-builder (a tool for packaging applications), and a quantum key service platform.

[0055] Reference Figure 1 , is a connection diagram based on multi-party communication of the present application. Specifically, the server and the client are connected, and the server and the client are respectively connected to the quantum key service platform.

[0056] Reference Figure 2 , is a flowchart of an embodiment of a method for processing an application file based on a quantum key of the present application, which includes the following steps on the server side:

[0057] Step 201, obtaining an application file; the application file is a file obtained by packaging the source code in the application;

[0058] In the Electron framework, when electron-builder packages an Electron application, it packages the source code in the application into an asar file (application file). That is, the asar file can be understood as a packaged application.

[0059] In an embodiment of the present application, the server uses the asar file address as a parameter and calls the asar processing program, so that the asar processing program obtains the application file and then processes the application file to obtain the target application file.

[0060] Step 202: obtaining a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers;

[0061] The server in the embodiment of the present application processes the application file (asar file) according to the two random numbers in the random number pair to obtain the target application file.

[0062] Specifically, the server generates two 256-bit random numbers A and B according to a random algorithm, that is, the first random number and the second random number in the random number pair, where random number A is used as the file ID (Identity Document), and random number B is used as the encryption and decryption key. The asar handler is called with random number A, random number B and asar file address as parameters. The asar handler will use random number B and SM4 algorithm to encrypt the asar file to generate file C, and insert random number A into the header of file C to generate an encrypted asar file containing the file ID, which is the target application file in the example of this application.

[0063] A random algorithm is an algorithm used to generate random numbers. Random numbers are widely used in computer science in fields such as encryption, simulation, and games. Common random algorithms include: pseudo-random number generator (PRNG), true random number generator (TRNG), etc.

[0064] Pseudo-random number generator (PRNG): such as linear congruential generator (LCG), Mersenne Twister algorithm, etc. The random numbers generated by these algorithms are actually pseudo-random because they are generated based on an initial seed (seed) and have a certain periodicity.

[0065] True random number generator (TRNG): Random numbers generated based on physical processes such as hardware noise and quantum phenomena. The random numbers generated by these algorithms are truly random numbers, which are unpredictable and non-repeatable.

[0066] In an embodiment of the present application, the process of generating a first random number and a second random number according to a random algorithm comprises the following steps: selecting a suitable random algorithm according to the application scenario, such as a pseudo-random number generator or a true random number generator; for a pseudo-random number generator, a seed needs to be initialized. The seed can be a timestamp, hardware noise, user input, etc.; calling a random algorithm to generate random numbers. For a pseudo-random number generator, the generated random number sequence is based on the seed and has a certain periodicity. For a true random number generator, the generated random number is a true random number that is unpredictable and non-repeatable; the generated random number is used as a file ID and encryption and decryption key.

[0067] The embodiment of the present application generates two 256-bit random numbers A and B by using a random algorithm, and uses them as file IDs and encryption and decryption keys, thereby ensuring the security and uniqueness of the random number pair. Moreover, each time a new random number pair is generated, it can be ensured that the key used for each encryption is unique, which increases the difficulty of cracking and further improves the security of the application source code. The random number A is inserted into the encrypted asar file header as the file ID to ensure the uniqueness and identifiability of the file.

[0068] Step 203: Send the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair;

[0069] The server in the embodiment of the present application will send the file ID and encryption and decryption keys (random numbers A and B) to the quantum key service platform and store them one-to-one in the database, that is, the server sends the random number pair to the database in the quantum key service platform for storage.

[0070] At this time, the quantum key service platform can determine the corresponding encryption and decryption key based on the random number pair stored in the database and the file ID sent by the client, so that the encryption and decryption key can be sent to the client to decrypt the target application file.

[0071] In the process of transmitting information from the server to the quantum key service platform, the quantum key service platform and the server are placed in the same secure local area network. Since the secure local area network usually has strict access control and firewall policies to ensure that only authorized devices and users can access it, the random number pair is transmitted through the secure local area network to ensure that it is not intercepted and tampered with, thereby improving the security of the application source code. In addition, since man-in-the-middle attacks usually occur in public networks, attackers can intercept and tamper with communication data, so the quantum key service platform and the server are placed in the same secure local area network, and the communication path between the quantum key service platform and the server is shorter, reducing the possibility of man-in-the-middle attacks, and also ensuring that the random number pair is not intercepted and tampered with, thereby improving the security of the application source code.

[0072] Step 204: Send the target application file to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

[0073] After obtaining the target application file, the server in the embodiment of the present application will use electron-builder to package the target application file and generate an application installation package. The application installation package is directly sent to the client through the ordinary network so that the client can decrypt the target application file and obtain the original application file. The client will decrypt the target application file based on the encryption and decryption key sent by the quantum key service platform.

[0074] After receiving the target application file, the client automatically requests the encryption and decryption key from the subkey service platform and uses the key to decrypt the file, which simplifies the manual operation steps and reduces the errors and risks of human operation. In addition, the target application file contains the file ID, and the client can identify and decrypt the corresponding file based on the file ID to ensure the correctness and reliability of the decryption process.

[0075] The server in the embodiment of the present application can perform advanced encryption on the application file through the random number pair to obtain the target application file, and transmit the encrypted application file, which can ensure that the source code is always encrypted during the transmission and storage process, greatly reducing the risk of source code leakage. In addition, the server sends the random number pair to the quantum key service platform and stores it, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0076] In one embodiment of the present application, the step 201, obtaining the application file, includes:

[0077] Generate the random number pair and determine the file address corresponding to the application file;

[0078] A processing program is called based on the random number pair and the file address, so that the processing program obtains the application file based on the file address; the processing program is used to process the application file.

[0079] In the embodiment of the present application, the server will first create an asar processing program. Creating an asar processing program means writing a processing program in any language that can be used to write Windows programs. The asar processing program can encrypt the asar file using the SM4 encryption algorithm and insert the file ID into the beginning of the encrypted asar file. The target asar file can be updated without changing the file location through the asar processing program, ensuring the integrity and consistency of the application file.

[0080] Furthermore, since the asar handler is written independently, it can be called by hooks or other arbitrary programs without affecting the normal flow of the host program.

[0081] Subsequently, the server generates two 256-bit random numbers A and B according to a random algorithm, determines the correspondence between random numbers A and B, and stores the random numbers A and B, and the correspondence between random numbers A and B as random number pairs. At the same time, the file address corresponding to the application file is also determined.

[0082] The asar handler is called with the first and second random numbers in the random number pair and the asar file address as parameters, and the asar handler determines the application file based on the file address. The asar handler will then encrypt the application file using the SM4 encryption algorithm and insert the file ID at the beginning of the encrypted application file.

[0083] In one embodiment of the present application, the step 202 of obtaining the target application file according to the random number pair and the application file includes:

[0084] Using the first random number in the random number pair as the encryption / decryption key, and controlling the processing program to encrypt the application file using the encryption / decryption key to obtain an encrypted application file;

[0085] The second random number in the random number pair is used as a file identifier, and the processing program is controlled to insert the file identifier into the file header of the application file to obtain the target application file.

[0086] The asar processing program in the embodiment of the present application will use the random number B (the first random number in the random number pair) and the SM4 algorithm to encrypt the asar file (application file) to generate file C (encrypted application file), and insert the random number A (the second random number in the random number pair) into the header of file C to generate an encrypted asar file (target application file) containing a file ID.

[0087] SM4 is a symmetric encryption algorithm with high security and efficiency. It is suitable for encrypting application source code. In the embodiment of the present application, the SM4 encryption algorithm is used to encrypt the application file, ensuring the security of the encryption process.

[0088] By using the first random number in the random number pair as the encryption and decryption key, the uniqueness and unpredictability of the key are ensured; by using the second random number in the random number pair as the file identifier to insert into the encrypted ASAR file header, the uniqueness and identifiability of the file are ensured, and the insertion of the file identifier allows the encrypted file to be correctly identified and decrypted, improving the security of the encryption process. Each time a new random number pair is generated, it can be ensured that the key used for each encryption is unique, which increases the difficulty of cracking and further improves the security of the application.

[0089] The server in the embodiment of the present application can perform advanced encryption on the application file through the random number pair to obtain the target application file, and transmit the encrypted application file, which can ensure that the source code is always encrypted during the transmission and storage process, greatly reducing the risk of source code leakage. In addition, the server sends the random number pair to the quantum key service platform and stores it, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0090] Reference Figure 3 , shows a flowchart of another embodiment of the method for processing application files based on quantum keys of the present application, which includes the following steps on the client side:

[0091] Step 301: when receiving the target application file sent by the server, obtaining a key identifier;

[0092] In an embodiment of the present application, the quantum cryptography service platform generates 2N quantum random numbers, N of which are used as key identifiers and the other N are used as quantum keys. The key identifiers correspond to the quantum keys one-to-one. The quantum keys and their corresponding key identifiers are stored in the database of the quantum cryptography service platform. At the same time, the key identifiers and quantum keys are distributed to the quantum key charging machine through the QKD (Quantum Key Distribution) network. The quantum key charging machine charges the quantum keys and their corresponding key identifiers into the quantum security chip offline.

[0093] When receiving the target application file sent by the server, the client needs to obtain the original application file based on the target application file. However, the client does not store the encryption and decryption key for decrypting the encrypted application file in the target application file. Therefore, it is necessary to apply for the encryption and decryption key from the quantum key service platform. However, in order to ensure the security of the encryption and decryption key sent by the quantum key service platform, it is necessary to encrypt the encryption and decryption key with a quantum key to ensure the security of the encryption and decryption key, thereby ensuring the security of the encrypted application file.

[0094] The quantum key service platform needs to use a key identifier to determine its corresponding quantum key. In actual applications, the client can directly send a confirmation signal to the quantum key service platform, and then the quantum key service platform directly determines an unused quantum key and its corresponding key identifier. After encrypting the encryption and decryption key based on the quantum key, the encrypted encryption and decryption key and key identifier are returned to the client, so that the client can determine its corresponding quantum key based on the key identifier and then decrypt the encrypted encryption and decryption key.

[0095] However, if the quantum key service platform directly returns the key identifier to the client, since the key identifier is not encrypted, it may be intercepted and leaked during transmission. The attacker may perform a replay attack based on the intercepted key identifier, which may threaten the security of the quantum key and further affect the security of the target application file.

[0096] Therefore, in the embodiment of the present application, when receiving the target application file sent by the server, the client needs to insert the quantum security chip and then obtain an unused quantum security key ID (key identifier) ​​from the quantum security chip.

[0097] In addition, the key identifier in the quantum security chip is usually consumable and will be marked as used after each use to ensure that the key identifier will not be reused. If the quantum key service platform directly returns the key identifier to the client, the non-repeatability of the key identifier cannot be ensured.

[0098] Step 302: Parse the target application file to obtain a file identifier and an encrypted application file in the target application file;

[0099] After the client receives the target application file sent by the server, it needs to process the target application file accordingly to obtain the original application file. By parsing the target application file, the client can separate the encrypted application file and perform subsequent decryption operations.

[0100] Therefore, in an embodiment of the present application, the client installs and opens the application, parses the target application file through the application, separates the file identifier in the header and the encrypted application file, and after obtaining the file identifier and the encrypted application file, the client can use the file identifier to request the corresponding encryption and decryption key from the sub-key service platform, and use the key to decrypt the encrypted application file to obtain the original application file.

[0101] By parsing the target application file, the embodiment of the present application can automatically process the separation of file identification and encrypted application file by the client, simplifying the manual operation steps, reducing the errors and risks of human operation, and this process is efficient and reliable, ensuring the smooth progress of the decryption process.

[0102] Step 303: Control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier;

[0103] In an embodiment of the present application, after determining the key identifier and the file identifier, the client will send the key identifier and the file identifier to the quantum key service platform, and the quantum key service platform will retrieve the corresponding quantum key and encryption and decryption key according to the key identifier and the file identifier.

[0104] Specifically, after parsing the target application file, the client obtains the file identifier and the encrypted application file, and the client sends the file identifier and key identifier (the unused quantum security key ID obtained from the quantum security chip) to the quantum key service platform. The quantum key service platform receives the key identifier and file identifier sent by the client, and prepares to search and match the key. The quantum key service platform searches for the corresponding quantum key based on the key identifier. The quantum key and the key identifier correspond one-to-one to ensure the uniqueness and non-replicability of the quantum key. The quantum key service platform searches for the corresponding encryption and decryption key based on the file identifier. The encryption and decryption key corresponds one-to-one to the file identifier, ensuring the uniqueness and non-repeatability of the key used to decrypt the encrypted application file.

[0105] Step 304: When the target encryption and decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption and decryption key to obtain the application file; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

[0106] After the quantum key service platform has determined the quantum key and encryption and decryption key, it will also use the quantum key to encrypt the encryption and decryption key to obtain the target encryption and decryption key, ensuring the security of the encryption and decryption key during transmission, and return the target encryption and decryption key to the client, ensuring that only the client can decrypt the encrypted encryption and decryption key, preventing the key from being intercepted and cracked during transmission.

[0107] The target encryption and decryption key in the embodiment of the present application is encrypted with a quantum key. Even if it is intercepted, the interceptor cannot use the target encryption and decryption key to decrypt the encrypted application file, further improving the security of the application source code.

[0108] When the client receives the target encryption and decryption key returned by the quantum key service platform, it will use the key to decrypt the target application file to obtain the original application file.

[0109] Specifically, the client uses the quantum key in the quantum security chip to decrypt the target encryption and decryption key, and uses the decrypted encryption and decryption key to decrypt the encrypted application file to obtain the original application file.

[0110] The target encryption and decryption key in the embodiment of the present application is obtained by encrypting the encryption and decryption key by the quantum key service platform based on the quantum key, ensuring the security of the encryption and decryption key during transmission. In addition, only the client can decrypt the encrypted encryption and decryption key, preventing the encryption and decryption key from being intercepted and cracked during transmission.

[0111] In addition, the client uses the quantum key in the quantum security chip to decrypt the target encryption and decryption key to ensure the security and reliability of the decryption process. The quantum key in the quantum security chip has extremely high security and can prevent the quantum key from being intercepted and cracked, thereby improving the security of the target encryption and decryption key.

[0112] The client in the embodiment of the present application can also decrypt different encrypted application files according to different target encryption and decryption keys, realizing a dynamic key decryption mechanism, avoiding the problem of increased risk of application source code leakage caused by encrypting and decrypting encrypted application files with the same encryption and decryption key, improving the flexibility and adaptability of the decryption process, and ensuring the correctness and reliability of the decryption operation.

[0113] The client in the embodiment of the present application obtains the corresponding encryption and decryption key and quantum key from the quantum key service platform according to the file identifier and key identifier, realizing a flexible decryption mechanism, ensuring the decryption security of the application file, and avoiding source code leakage. In addition, the client realizes the secure management and use of the quantum key through the quantum key service platform, ensuring the security and reliability of the decryption process.

[0114] In one embodiment of the present application, the step 301, when receiving the target application file sent by the server, obtaining the key identifier, includes:

[0115] When the target application file sent by the server is received, the quantum security chip is installed; and the key identifier and the quantum key corresponding to the key identifier in the quantum security chip are obtained.

[0116] Since the target application file is encrypted, when the client receives the target application file sent by the server, the client needs to decrypt it to obtain the original application file.

[0117] After receiving the target application file, the client needs to install a quantum security chip, which is a hardware device used to store and manage quantum keys to ensure the security and uniqueness of the keys. The quantum security chip in the embodiment of the present application stores N key identifiers and quantum keys corresponding to the N key identifiers.

[0118] The client will obtain an unused key identifier from the quantum security chip. The key identifier is used to uniquely identify the quantum key, ensuring the uniqueness and non-repeatability of the quantum key.

[0119] The target encryption and decryption key still needs to be decrypted based on the quantum key subsequently. Therefore, in the embodiment of the present application, while obtaining the key identifier, it is also necessary to obtain the quantum key corresponding to the key identifier so that the target encryption and decryption key can be decrypted based on the quantum key corresponding to the key identifier subsequently.

[0120] Since quantum security chips are usually equipped with hardware-level protection mechanisms, such as anti-tampering circuits, encrypted storage, etc., the embodiments of the present application store the key identifier and quantum key required to be used by the client in the quantum security chip to ensure that the quantum key is protected in a hardware-level security environment, prevent external attacks and tampering, ensure the security of the quantum key during storage and transmission, and prevent the quantum key from being stolen and cracked.

[0121] Moreover, in the embodiment of the present application, a key identifier and its corresponding quantum key in the quantum secure medium will be consumed each time, that is, the quantum key in the quantum secure medium will be marked as used after each use to ensure that the key will not be reused. This mechanism prevents the quantum key from being stolen and replayed, ensures the security of the quantum key, and further improves the security of the application source code.

[0122] In one embodiment of the present application, the step 304, when receiving the target encryption and decryption key sent by the quantum key service platform, decrypting the encrypted application file according to the target encryption and decryption key to obtain the application file, and storing the application file in the memory, includes:

[0123] Decrypting the target encryption and decryption key based on the quantum key corresponding to the key identifier to obtain the encryption and decryption key;

[0124] Decrypting the encrypted application file based on the encryption / decryption key to obtain the application file;

[0125] The application program file is stored in the memory.

[0126] In an embodiment of the present application, after receiving the target encryption and decryption key sent by the quantum key service platform, the client uses the key to decrypt the encrypted application file, obtains the original application file, and stores the application file in the memory.

[0127] Specifically, the client uses the quantum key in the quantum security chip to decrypt the target encryption and decryption key to obtain the original encryption and decryption key; the client uses the decrypted encryption and decryption key to decrypt the encrypted application file to obtain the original application file. During this decryption process, the security of the encrypted application file during transmission and storage is ensured to prevent the file from being tampered with and replaced; the client stores the decrypted application file in memory instead of on the disk, ensuring that the application file is not stored in plain text on the disk, preventing the file from being illegally accessed and stolen.

[0128] The client can store the decrypted application files in memory instead of on disk in the following ways:

[0129] 1. Memory-Mapped Files:

[0130] Memory-mapped files are a technology that maps file contents to the process address space. With memory-mapped files, applications can operate file contents directly in memory without loading the file contents into memory.

[0131] Specifically, the client creates a memory-mapped file and writes the decrypted application file content into the memory-mapped file, and then maps the memory-mapped file into the address space of the process, so that the application can operate the file content directly in the memory. The client can operate the decrypted application file content in the memory without writing the file content to the disk.

[0132] Memory-mapped files can improve the efficiency of file operations and reduce disk I / O operations. They are suitable for scenarios where file contents need to be read and written frequently.

[0133] 2. Memory Cache:

[0134] Memory caching is a technology that stores data in memory. With memory caching, applications can store decrypted application file contents in memory without writing the file contents to disk.

[0135] Specifically, the client creates a memory cache and stores the decrypted application file content in the memory cache. The client can operate the decrypted application file content in the memory cache without writing the file content to the disk.

[0136] Memory cache can improve the efficiency of data access and reduce disk I / O operations. It is suitable for scenarios where data needs to be accessed frequently.

[0137] 3. In-Memory Database:

[0138] An in-memory database is a database that stores data in memory. With an in-memory database, an application can store the decrypted application file contents in memory without writing the file contents to disk.

[0139] The client creates a memory database and stores the decrypted application file content in the memory database. The client can operate the decrypted application file content in the memory database without writing the file content to the disk.

[0140] In-memory databases can improve the efficiency of data access and reduce disk I / O operations, making them suitable for scenarios where data needs to be accessed frequently.

[0141] By storing the decrypted application files in memory, the client can ensure that the application files are not stored in plain text on the disk, preventing the application files from being illegally accessed and stolen, thereby further improving the overall security and reliability of the application.

[0142] The client in the embodiment of the present application obtains the corresponding encryption and decryption key and quantum key from the quantum key service platform according to the file identifier and key identifier, realizing a flexible decryption mechanism, ensuring the decryption security of the application file, and avoiding source code leakage. In addition, the client realizes the secure management and use of the quantum key through the quantum key service platform, ensuring the security and reliability of the decryption process.

[0143] Reference Figure 4 , is a flowchart of another embodiment of an application file processing method based on quantum key of the present application, comprising the following steps:

[0144] Step 401: The quantum key service platform generates and distributes quantum keys;

[0145] The quantum key service platform generates 2N quantum random numbers, N of which are used as key identifiers and the other N are used as quantum keys. The key identifiers correspond to the quantum keys one by one. The quantum keys and their key identifiers are saved in the database of the quantum key service platform and distributed to the quantum key charging machine through QKD. The quantum key charging machine charges the quantum keys and their key identifiers into the quantum security chip offline.

[0146] Step 402, the server creates an ASAR processing program;

[0147] The server creates an ASAR processing program. Creating an ASAR processing program means writing the processing program in any language that can be used to write Windows programs. The ASAR processing program can use the SM4 encryption algorithm to encrypt application files and insert file identifiers into the encrypted application files.

[0148] Step 403: The server processes the application file and packages it;

[0149] The server generates a 256-bit first random number and a second random number according to a random algorithm, wherein the first random number is used as an encryption and decryption key, and the second random number is used as a file identifier. The server uses the first random number, the second random number and the file address of the application file as parameters to call the asar processing program, which uses the first random number and the SM4 algorithm to encrypt the application file to generate an encrypted application file, inserts the second random number into the header of the encrypted application file to generate a target application file containing a file identifier, uses electron-builder to package the target application file, generates an application installation package, and sends the application installation package directly to the client through a common network;

[0150] Step 404: The server sends the file identifier and encryption and decryption key to the quantum key service platform;

[0151] The server sends the file identifier and encryption and decryption key to the quantum key service platform and stores them one by one in the database. The quantum key service platform and the server are in the same secure local area network;

[0152] Step 405: The client parses the target application file;

[0153] The client inserts the quantum security chip, installs and opens the application, and the application parses the target application file, separates the file identifier in the header, and encrypts the application file;

[0154] Step 406: The client obtains the target encryption and decryption key;

[0155] The client application obtains the encryption and decryption key by obtaining an unused key identifier from the quantum security chip, and sending the key identifier and file identifier to the quantum key service platform. The quantum key service platform takes out the encryption and decryption key and quantum key according to the file identifier and key identifier, encrypts the encryption and decryption key with the quantum key, obtains the target encryption and decryption key, and returns it to the client.

[0156] Step 407: The client obtains the application file.

[0157] The client application uses the quantum key in the quantum security chip to decrypt the target encryption and decryption key returned by the quantum key service platform, and uses the decrypted encryption and decryption key to decrypt the encrypted application file, obtains the application file and stores it in the memory, and the application interprets and executes the application file in the memory.

[0158] The embodiment of the present application can solve the problem that the methods currently used for most encryption and decryption ASARs are at high risk of being cracked through the above method, thereby solving the problem of source code leakage of applications based on the Electron framework, and preventing applications based on the Electron framework from being stolen and redistributed.

[0159] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0160] On the basis of the above embodiments, this embodiment also provides an application file processing device based on quantum key, which is applied in a server.

[0161] Reference Figure 5, shows a structural block diagram of an embodiment of an application file processing device based on quantum key of the present application, which may specifically include the following modules:

[0162] The application file acquisition module 501 is used to acquire the application file; the application file is a file obtained by packaging the source code in the application;

[0163] A target application file module 502 is used to obtain a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers;

[0164] A random number pair sending module 503, used to send the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair;

[0165] The target application file sending module 504 is used to send the target application file to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

[0166] On the basis of the above embodiments, this embodiment also provides another application file processing device based on quantum key, which is applied in the client.

[0167] Reference Figure 6 , shows a structural block diagram of another embodiment of an application file processing device based on quantum key of the present application, which may specifically include the following modules:

[0168] A key identification acquisition module 601 is used to acquire a key identification when receiving a target application file sent by the server;

[0169] A target application file parsing module 602, used to parse the target application file to obtain a file identifier and an encrypted application file in the target application file;

[0170] A key determination module 603, used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier;

[0171] The target application file decryption module 604 is used to decrypt the encrypted application file according to the target encryption and decryption key to obtain the application file when receiving the target encryption and decryption key sent by the quantum key service platform; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

[0172] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0173] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0174] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as terminal devices and servers (clusters). Figure 7 An exemplary apparatus 700 that can be used to implement various embodiments described in this application is schematically illustrated.

[0175] For one embodiment, Figure 7 An exemplary apparatus 700 is shown having one or more processors 702, a control module (chip set) 704 coupled to at least one of the processor(s) 702, a memory 706 coupled to the control module 704, a non-volatile memory (NVM) / storage device 708 coupled to the control module 704, one or more input / output devices 710 coupled to the control module 704, and a network interface 712 coupled to the control module 704.

[0176] The processor 702 may include one or more single-core or multi-core processors, and the processor 702 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 700 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0177] In some embodiments, the apparatus 700 may include one or more computer-readable media (e.g., memory 706 or NVM / storage device 708) having instructions 714 and one or more processors 702 combined with the one or more computer-readable media and configured to execute the instructions 714 to implement a module to perform the actions described in the present disclosure.

[0178] For one embodiment, the control module 704 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 702 and / or any suitable device or component in communication with the control module 704 .

[0179] The control module 704 may include a memory controller module to provide an interface to the memory 706. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0180] The memory 706 may be used, for example, to load and store data and / or instructions 714 for the device 700. For one embodiment, the memory 706 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 706 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0181] For one embodiment, control module 704 may include one or more input / output controllers to provide an interface to NVM / storage device 708 and input / output device(s) 710 .

[0182] For example, NVM / storage 708 may be used to store data and / or instructions 714. NVM / storage 708 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0183] NVM / storage device 708 may include storage resources that are physically part of the device on which apparatus 700 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 708 may be accessed via input / output device(s) 710 over a network.

[0184] (One or more) input / output devices 710 may provide an interface for the apparatus 700 to communicate with any other appropriate device, and the input / output device 710 may include a communication component, an audio component, a sensor component, etc. The network interface 712 may provide an interface for the apparatus 700 to communicate through one or more networks, and the apparatus 700 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0185] For one embodiment, at least one of the processor(s) 702 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 704. For one embodiment, at least one of the processor(s) 702 may be packaged together with the logic of one or more controllers of the control module 704 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 702 may be integrated on the same die with the logic of one or more controllers of the control module 704. For one embodiment, at least one of the processor(s) 702 may be integrated on the same die with the logic of one or more controllers of the control module 704 to form a system-on-chip (SoC).

[0186] In various embodiments, the apparatus 700 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the apparatus 700 may have more or fewer components and / or a different architecture. For example, in some embodiments, the apparatus 700 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0187] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0188] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0189] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0190] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable quantum key-based application file processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable quantum key-based application file processing terminal device generate instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable quantum key-based application file processing terminal device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable quantum key-based application file processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0193] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0194] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0195] The above is a detailed introduction to a quantum key-based application file processing method and device, an electronic device and a storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing application files based on quantum keys, characterized in that: Applied to a server, the server is connected to a client and a quantum key service platform respectively, and the method comprises: Obtaining an application file; the application file is a file obtained by packaging the source code in the application; Obtaining a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers; Sending the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair; The target application file is sent to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

2. The method according to claim 1, characterized in that The obtaining of the application file comprises: Generate the random number pair and determine the file address corresponding to the application file; A processing program is called based on the random number pair and the file address, so that the processing program obtains the application file based on the file address; the processing program is used to process the application file.

3. The method according to claim 2, characterized in that The step of obtaining a target application file according to the random number pair and the application file comprises: Using the first random number in the random number pair as the encryption / decryption key, and controlling the processing program to encrypt the application file using the encryption / decryption key to obtain an encrypted application file; The second random number in the random number pair is used as a file identifier, and the processing program is controlled to insert the file identifier into the file header of the application file to obtain the target application file.

4. A method for processing application files based on quantum keys, characterized in that: Applied to a client, the client is connected to a server and a quantum key service platform respectively, and the method includes: When receiving the target application file sent by the server, obtaining the key identifier; Parsing the target application file to obtain a file identifier and an encrypted application file in the target application file; Controlling the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier; When the target encryption and decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption and decryption key to obtain the application file; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

5. The method according to claim 4, characterized in that When receiving the target application file sent by the server, obtaining the key identifier includes: When the target application file sent by the server is received, the quantum security chip is installed; and the key identifier and the quantum key corresponding to the key identifier in the quantum security chip are obtained.

6. The method according to claim 5, characterized in that When receiving the target encryption and decryption key sent by the quantum key service platform, decrypting the encrypted application file according to the target encryption and decryption key to obtain the application file, and storing the application file in the memory, including: Decrypting the target encryption and decryption key based on the quantum key corresponding to the key identifier to obtain the encryption and decryption key; Decrypting the encrypted application file based on the encryption / decryption key to obtain the application file; The application program file is stored in the memory.

7. An application file processing device based on quantum key, characterized in that: Applied to a server, the server is connected to a client and a quantum key service platform respectively, and the device comprises: An application file acquisition module, used to acquire an application file; the application file is a file obtained by packaging the source code in the application; A target application file module, used to obtain a target application file according to a random number pair and the application file; the random number pair includes two random numbers and a corresponding relationship between the two random numbers; A random number pair sending module, used to send the random number pair to the quantum key service platform, so that the quantum key service platform determines the encryption and decryption key for decrypting the target application file based on the random number pair; A target application file sending module is used to send the target application file to the client, so that the client decrypts the target application file based on the encryption and decryption key sent from the quantum key service platform.

8. An application file processing device based on quantum key, characterized in that: Applied to a client, the client is connected to a server and a quantum key service platform respectively, and the device comprises: A key identification acquisition module, used to acquire the key identification when receiving the target application file sent by the server; A target application file parsing module, used to parse the target application file, obtain a file identifier in the target application file and an encrypted application file; A key determination module, used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption and decryption key corresponding to the file identifier; The target application file decryption module is used to decrypt the encrypted application file according to the target encryption and decryption key to obtain the application file when receiving the target encryption and decryption key sent by the quantum key service platform; the target encryption and decryption key is obtained by the quantum key service platform encrypting the encryption and decryption key based on the quantum key.

9. An electronic device, characterized in that: include: processor; and A memory having executable code stored thereon, which, when executed, enables the processor to execute the quantum key-based application file processing method as described in any one of claims 1-3 or 4-6.

10. One or more machine-readable media having executable codes stored thereon, which, when executed, cause a processor to execute the quantum key-based application file processing method as described in any one of claims 1-3 or 4-6.

Images