A quantum key-based application file processing method and device

Abstract

Embodiments of the present application provide a kind of application file processing method and device based on quantum key, obtain application file;The application file is the file obtained after the source code in application is packed;According to random number pair and the application file, obtain target application file;The random number pair is sent to the quantum key service platform, to make the quantum key service platform based on the random number pair determine the encryption and decryption key for decrypting the target application file;The target application file is sent to the client, to make the client based on the encryption and decryption key sent in the quantum key service platform to the target application file is decrypted.This embodiment of the present application can ensure that application source code is always in the encryption state in transmission and storage process, greatly reduce the risk of application source code leakage.

Description

Technical Field

[0001] This application relates to the fields of software development and application security technology, and in particular to a quantum key-based application file processing method and apparatus, an electronic device, and a storage medium. Background Technology

[0002] Applications built on the Electron framework (a framework for building cross-platform desktop applications using JavaScript, HTML, and CSS) package their source code into an asar (a special archive format) file during packaging. At runtime, this asar is dynamically loaded and interpreted. Asar is an archive format that combines multiple files into a single file; it generally lacks security features, is easily read and redistributed, and poses significant security risks.

[0003] Most encryption methods currently in use are based on symmetric and asymmetric encryption, with keys stored in the application or encrypted files, or distributed over the internet. However, these methods are susceptible to key cracking, further increasing the possibility of application source code leakage. Summary of the Invention

[0004] This application provides a quantum key-based application file processing method to address the problem that most current encryption and decryption methods used by ASAR are at high risk of being cracked.

[0005] Accordingly, embodiments of this application also provide an application file processing device based on quantum key distribution, an electronic device, and a storage medium to ensure the implementation and application of the above methods.

[0006] To address the aforementioned issues, this application discloses a quantum key-based application file processing method applied to a server, wherein the server is connected to a client and a quantum key service platform, and the method includes:

[0007] Obtain the application file; the application file is the file obtained by packaging the source code in the application.

[0008] The target application file is obtained based on the random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers;

[0009] The random number pair is sent to the quantum key service platform so that the quantum key service platform can determine the encryption / decryption key used to decrypt the target application file based on the random number pair;

[0010] The target application file is sent to the client, so that the client can decrypt the target application file based on the encryption / decryption key sent in the quantum key service platform.

[0011] Optionally, obtaining the application file includes:

[0012] Generate the random number pair and determine the file address corresponding to the application file;

[0013] The processor is invoked based on the random number pair and the file address, so that the processor can obtain the application file based on the file address; the processor is used to process the application file.

[0014] Optionally, obtaining the target application file based on the random number pair and the application file includes:

[0015] The first random number in the random number pair is used as the encryption / decryption key, and the processing program is controlled to use the encryption / decryption key to encrypt the application file to obtain an encrypted application file.

[0016] The second random number in the random number pair is used as a file identifier, and the processing program is controlled to insert the file identifier into the file header of the application file to obtain the target application file.

[0017] This application also discloses a quantum key-based application file processing method, applied to a client, wherein the client is connected to a server and a quantum key service platform, and the method includes:

[0018] When the target application file sent by the server is received, the key identifier is obtained;

[0019] Parse the target application file to obtain the file identifier and encrypted application file within the target application file;

[0020] The quantum key service platform is controlled to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier;

[0021] When the target encryption / decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption / decryption key to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

[0022] Optionally, obtaining the key identifier upon receiving the target application file sent by the server includes:

[0023] When the target application file sent by the server is received, the quantum security chip is installed; the key identifier and the quantum key corresponding to the key identifier are obtained from the quantum security chip.

[0024] Optionally, the step of decrypting the encrypted application file according to the target encryption / decryption key sent by the quantum key service platform upon receiving the target encryption / decryption key, obtaining the application file, and storing the application file in memory includes:

[0025] The target encryption / decryption key is decrypted based on the quantum key corresponding to the key identifier to obtain the encryption / decryption key;

[0026] The encrypted application file is decrypted using the encryption / decryption key to obtain the application file.

[0027] The application file is stored in the memory.

[0028] This application also discloses a quantum key-based application file processing device, applied to a server, wherein the server is connected to a client and a quantum key service platform, and the device includes:

[0029] An application file acquisition module is used to acquire application files; the application file is a file obtained by packaging the source code in the application.

[0030] The target application file module is used to obtain the target application file based on the random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers.

[0031] A random number pair sending module is used to send the random number pair to the quantum key service platform, so that the quantum key service platform can determine the encryption / decryption key for decrypting the target application file based on the random number pair;

[0032] The target application file sending module is used to send the target application file to the client, so that the client can decrypt the target application file based on the encryption / decryption key sent in the quantum key service platform.

[0033] This application also discloses a quantum key-based application file processing device for a client, wherein the client is connected to a server and a quantum key service platform, and the device includes:

[0034] The key identifier acquisition module is used to acquire the key identifier when the target application file sent by the server is received;

[0035] The target application file parsing module is used to parse the target application file to obtain the file identifier and encrypted application file in the target application file;

[0036] The key determination module is used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier;

[0037] The target application file decryption module is used to decrypt the encrypted application file according to the target encryption / decryption key when it receives the target encryption / decryption key sent by the quantum key service platform, so as to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

[0038] This application also discloses an electronic device, including: a processor; and a memory storing executable code thereon, wherein when the executable code is executed, the processor executes any of the quantum key-based application file processing methods described in this application.

[0039] This application also discloses one or more machine-readable media storing executable code thereon, which, when executed, causes a processor to execute any of the quantum key-based application file processing methods described in this application.

[0040] Compared with the prior art, the embodiments of this application have the following advantages:

[0041] In this embodiment, at the server, an application file is obtained; the application file is a file obtained by packaging the source code of the application; a target application file is obtained based on a random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers; the random number pair is sent to the quantum key service platform so that the quantum key service platform determines the encryption / decryption key for decrypting the target application file based on the random number pair; the target application file is sent to the client so that the client decrypts the target application file based on the encryption / decryption key sent by the quantum key service platform.

[0042] In this embodiment, the server can perform advanced encryption on the application file using random number pairs to obtain the target application file. Furthermore, the encrypted application file is transmitted, ensuring that the source code remains encrypted throughout transmission and storage, significantly reducing the risk of source code leakage. In addition, the server sends the random number pairs to the quantum key distribution platform for storage, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0043] In this embodiment, at the client end, when a target application file sent by the server is received, a key identifier is obtained; the target application file is parsed to obtain a file identifier and an encrypted application file; the quantum key service platform is controlled to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier; when a target encryption / decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption / decryption key to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

[0044] In this embodiment, the client obtains the corresponding encryption / decryption key and quantum key from the quantum key service platform based on the file identifier and key identifier, thus implementing a flexible decryption mechanism to ensure the security of application file decryption and prevent source code leakage. Furthermore, the client, through the quantum key service platform, achieves secure management and use of the quantum key, ensuring the security and reliability of the decryption process. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of a connection based on multi-party communication according to this application;

[0046] Figure 2 This is a flowchart illustrating the steps of an embodiment of an application file processing method based on quantum key distribution according to this application.

[0047] Figure 3 This is a flowchart illustrating the steps of another embodiment of the application file processing method based on quantum key distribution in this application.

[0048] Figure 4 This is a flowchart illustrating the steps of another embodiment of the application file processing method based on quantum key distribution in this application.

[0049] Figure 5 This is a structural block diagram of an embodiment of an application file processing device based on quantum key distribution according to this application.

[0050] Figure 6This is a structural block diagram of another embodiment of the application file processing device based on quantum key distribution in this application;

[0051] Figure 7 This is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0052] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] This application proposes a method for protecting the source code of an Electron framework application. Specifically, this application uses a charged symmetric quantum key to protect the encryption and decryption keys of an asar file. Each time the program runs, a pair of quantum keys is consumed. The quantum keys are stored in a quantum-safe chip on the client side. The encryption and decryption keys are encrypted using the quantum key and transmitted over the Internet, ultimately protecting the asar file from being stolen and redistributed.

[0054] To further address the issue mentioned in the background art that most current methods for encrypting and decrypting ASAR files are at high risk of being cracked, this application proposes a quantum key application file processing method. This method is applicable to packaging and running Windows applications based on the Electron framework on computers with Windows operating systems (both the operating system interface and the application interface). It involves the Electron framework, electron-builder (a tool for packaging applications), and a quantum key service platform.

[0055] Reference Figure 1 This is a connection diagram based on multi-party communication according to this application. Specifically, the server and the client are connected, and the server and the client are respectively connected to the quantum key service platform.

[0056] Reference Figure 2 This is a flowchart illustrating the steps of an embodiment of a quantum key-based application file processing method according to this application. On the server side, it includes the following steps:

[0057] Step 201: Obtain the application file; the application file is the file obtained by packaging the source code in the application.

[0058] In the Electron framework, when electron-builder packages an Electron application, it packages the source code of the application into an asar file (application file). In other words, the asar file can be understood as the packaged application.

[0059] In this embodiment, the server calls the asar processor with the asar file address as a parameter, so that the asar processor obtains the application file, processes the application file, and obtains the target application file.

[0060] Step 202: Obtain the target application file based on the random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers;

[0061] In this embodiment, the server processes the application file (asar file) based on two random numbers in a random number pair to obtain the target application file.

[0062] Specifically, the server generates two 256-bit random numbers A and B according to a random algorithm, which are the first and second random numbers in the random number pair. Random number A is used as the file ID (Identity Document), and random number B is used as the encryption / decryption key. The server calls the asar processing program with random number A, random number B, and the asar file address as parameters. The asar processing program uses random number B and the SM4 algorithm to encrypt the asar file and generate file C. Random number A is inserted into the header of file C to generate an encrypted asar file containing the file ID, which is the target application file in this application example.

[0063] A random number generator is an algorithm used to generate random numbers. Random numbers are widely used in computer science, including encryption, simulation, and games. Common random number generators include pseudo-random number generators (PRNGs) and true random number generators (TRNGs).

[0064] Pseudo-random number generators (PRNGs): such as the Linear Congruence Generator (LCG) and the Mersenne Twister algorithm. The random numbers generated by these algorithms are actually pseudo-random because they are generated based on an initial seed and have a certain periodicity.

[0065] True random number generators (TRNGs): These generate random numbers based on physical processes such as hardware noise and quantum phenomena. The random numbers generated by these algorithms are truly random, possessing unpredictability and non-repeatability.

[0066] In this embodiment, the process of generating the first and second random numbers according to the random algorithm is as follows: A suitable random algorithm is selected based on the application scenario, such as a pseudo-random number generator or a true random number generator; for a pseudo-random number generator, a seed needs to be initialized. The seed can be a timestamp, hardware noise, user input, etc.; the random algorithm is then called to generate random numbers. For a pseudo-random number generator, the generated random number sequence is seed-based and has a certain periodicity. For a true random number generator, the generated random numbers are truly random, unpredictable, and non-repeatable; the generated random numbers are used as the file ID and encryption / decryption key.

[0067] This application embodiment generates two 256-bit random numbers A and B using a random algorithm, and uses them as the file ID and encryption / decryption key. This ensures the security and uniqueness of the random number pair. Furthermore, generating a new random number pair each time ensures that the key used for encryption is unique each time, increasing the difficulty of cracking and further enhancing the security of the application source code. Inserting random number A as the file ID into the header of the encrypted asar file ensures the file's uniqueness and identifiability.

[0068] Step 203: Send the random number pair to the quantum key service platform so that the quantum key service platform can determine the encryption / decryption key for decrypting the target application file based on the random number pair;

[0069] In this embodiment, the server sends the file ID and encryption / decryption keys (random numbers A and B) to the quantum key service platform and stores them in the database accordingly. That is, the server sends the random number pairs to the database of the quantum key service platform for storage.

[0070] At this point, the quantum key service platform can determine the corresponding encryption / decryption key based on the random number pairs stored in the database and the file ID sent by the client. This key can then be sent to the client to decrypt the target application file.

[0071] During the transmission of information from the server to the quantum key service platform, placing the quantum key service platform and the server within the same secure local area network (LAN) ensures that only authorized devices and users can access the network, as secure LANs typically have strict access controls and firewall policies. This prevents the random number pairs from being intercepted or tampered with during transmission, thus enhancing the security of the application's source code. Furthermore, since man-in-the-middle attacks typically occur on public networks, allowing attackers to intercept and tamper with communication data, placing the quantum key service platform and server within the same secure LAN shortens the communication path between them, reducing the likelihood of man-in-the-middle attacks. This again ensures that the random number pairs are not intercepted or tampered with, further improving the security of the application's source code.

[0072] Step 204: Send the target application file to the client so that the client can decrypt the target application file based on the encryption / decryption key sent in the quantum key service platform.

[0073] In this embodiment, after obtaining the target application file, the server uses electron-builder to package the target application file and generate an application installation package. The application installation package is sent directly to the client via a normal network so that the client can decrypt the target application file to obtain the original application file. The client will decrypt the target application file based on the encryption and decryption key sent by the quantum key service platform.

[0074] After receiving the target application file, the client automatically requests the encryption / decryption key from the quantum key service platform and uses this key to decrypt the file. This simplifies manual operations and reduces human error and risk. Furthermore, the target application file contains a file ID, which the client can use to identify and decrypt the corresponding file, ensuring the correctness and reliability of the decryption process.

[0075] In this embodiment, the server can perform advanced encryption on the application file using random number pairs to obtain the target application file. Furthermore, the encrypted application file is transmitted, ensuring that the source code remains encrypted throughout transmission and storage, significantly reducing the risk of source code leakage. In addition, the server sends the random number pairs to the quantum key distribution platform for storage, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0076] In one embodiment of this application, step 201, obtaining the application file, includes:

[0077] Generate the random number pair and determine the file address corresponding to the application file;

[0078] The processor is invoked based on the random number pair and the file address, so that the processor can obtain the application file based on the file address; the processor is used to process the application file.

[0079] In this embodiment, the server first creates an asar file processing program. Creating an asar file processing program means writing a program in any language capable of writing Windows programs. The asar file processing program can encrypt the asar file using the SM4 encryption algorithm and insert the file ID at the beginning of the encrypted asar file. The asar file processing program can update the target asar file without changing its location, ensuring the integrity and consistency of the application files.

[0080] Furthermore, since the asar handler is written independently, it can be called by hooks or other arbitrary programs without affecting the normal flow of the host program.

[0081] Subsequently, the server generates two 256-bit random numbers A and B according to a random algorithm, determines the correspondence between random numbers A and B, and stores the random numbers A and B, as well as their correspondence, as a random number pair. At the same time, it also determines the file address corresponding to the application file.

[0082] Using the first and second random numbers from the random number pair, along with the address of the asar file, as parameters, the asar processor is invoked. The asar processor then determines the application file based on the file address. Subsequently, the asar processor encrypts the application file using the SM4 encryption algorithm and inserts the file ID at the beginning of the encrypted application file.

[0083] In one embodiment of this application, step 202, obtaining the target application file based on the random number pair and the application file, includes:

[0084] The first random number in the random number pair is used as the encryption / decryption key, and the processing program is controlled to use the encryption / decryption key to encrypt the application file to obtain an encrypted application file.

[0085] The second random number in the random number pair is used as a file identifier, and the processing program is controlled to insert the file identifier into the file header of the application file to obtain the target application file.

[0086] In this embodiment of the application, the asar processing program uses random number B (the first random number in the random number pair) and the SM4 algorithm to encrypt the asar file (application file) to generate file C (encrypted application file), and inserts random number A (the second random number in the random number pair) into the header of file C to generate an encrypted asar file (target application file) containing a file ID.

[0087] SM4 is a symmetric encryption algorithm with high security and efficiency, suitable for encrypting application source code. In this embodiment, the SM4 encryption algorithm is used to encrypt application files, ensuring the security of the encryption process.

[0088] By using the first random number from the random number pair as the encryption / decryption key, the uniqueness and unpredictability of the key are ensured. The second random number from the random number pair is inserted as a file identifier into the header of the encrypted .asar file, ensuring the file's uniqueness and recognizability. The insertion of the file identifier also allows the encrypted file to be correctly identified and decrypted, improving the security of the encryption process. Generating a new random number pair each time ensures that the key used for each encryption is unique, increasing the difficulty of cracking and further enhancing the application's security.

[0089] In this embodiment, the server can perform advanced encryption on the application file using random number pairs to obtain the target application file. Furthermore, the encrypted application file is transmitted, ensuring that the source code remains encrypted throughout transmission and storage, significantly reducing the risk of source code leakage. In addition, the server sends the random number pairs to the quantum key distribution platform for storage, ensuring that the association between the key and the file is securely managed, providing a reliable basis for the subsequent decryption process.

[0090] Reference Figure 3 This diagram illustrates a flowchart of another embodiment of the application file processing method based on quantum key distribution, which includes the following steps on the client side:

[0091] Step 301: When the target application file sent by the server is received, obtain the key identifier;

[0092] In this embodiment, the quantum cryptography service platform generates 2N quantum random numbers, of which N are used as key identifiers and the other N are used as quantum keys. The key identifiers and quantum keys are in one-to-one correspondence. The quantum keys and their corresponding key identifiers are stored in the database of the quantum cryptography service platform. At the same time, the key identifiers and quantum keys are distributed to the quantum key injector through the QKD (Quantum Key Distribution) network. The quantum key injector injects the quantum keys and their corresponding key identifiers into the quantum security chip offline.

[0093] When the client receives the target application file sent by the server, it needs to obtain the original application file based on the target application file. However, the client does not store the encryption / decryption key used to decrypt the encrypted application file in the target application file. Therefore, it needs to apply for the encryption / decryption key from the quantum key service platform. However, in order to ensure the security of the encryption / decryption key sent by the quantum key service platform, it is necessary to encrypt the encryption / decryption key with a quantum key to ensure the security of the encryption / decryption key, and thus ensure the security of the encrypted application file.

[0094] In a quantum key distribution platform, a key identifier is used to determine the corresponding quantum key. In practical applications, the client can directly send a confirmation signal to the quantum key distribution platform. The platform then determines an unused quantum key and its corresponding key identifier. Based on this quantum key, the platform encrypts the encryption / decryption key and returns the encrypted encryption / decryption key and the key identifier to the client. This allows the client to determine the corresponding quantum key based on the key identifier and then decrypt the encrypted encryption / decryption key.

[0095] However, if the quantum key service platform directly returns the key identifier to the client, the key identifier may be intercepted and leaked during transmission because it is not encrypted. Attackers may use the intercepted key identifier to launch a replay attack, which would threaten the security of the quantum key and thus affect the security of the target application files.

[0096] Therefore, in this embodiment of the application, when the target application file is received from the server, the client needs to insert a quantum-safe chip and then obtain an unused quantum-safe key ID (key identifier) ​​from the quantum-safe chip.

[0097] Furthermore, the key identifiers in quantum-safe chips are typically consumable and are marked as used after each use to ensure that the key identifiers are not reused. If the quantum key service platform directly returns the key identifiers to the client, it cannot guarantee the non-repeatability of the key identifiers.

[0098] Step 302: Parse the target application file to obtain the file identifier and encrypted application file in the target application file;

[0099] After receiving the target application file sent by the server, the client needs to process the target application file to obtain the original application file. By parsing the target application file, the client can separate the encrypted application file and perform subsequent decryption operations.

[0100] Therefore, in this embodiment, the client installs and opens the application, parses the target application file through the application, separates the file identifier in the header and the encrypted application file. After obtaining the file identifier and the encrypted application file, the client can use the file identifier to request the corresponding encryption / decryption key from the quantum key service platform, and use the key to decrypt the encrypted application file to obtain the original application file.

[0101] This application embodiment automates the separation of file identifiers and encrypted application files by parsing the target application file, simplifying manual operation steps, reducing human error and risk, and ensuring the smooth progress of the decryption process by parsing the target application file.

[0102] Step 303: Control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier;

[0103] In this embodiment of the application, after the client determines the key identifier and the file identifier, it sends the key identifier and the file identifier to the quantum key service platform. The quantum key service platform retrieves the corresponding quantum key and encryption / decryption key according to the key identifier and the file identifier, respectively.

[0104] Specifically, after parsing the target application file, the client obtains the file identifier and the encrypted application file. The client then sends the file identifier and key identifier (an unused quantum security key ID obtained from the quantum-safe chip) to the quantum key service platform. Upon receiving the key identifier and file identifier from the client, the quantum key service platform prepares to search for and match the key. The platform searches for the corresponding quantum key based on the key identifier; the quantum key and key identifier are uniquely matched, ensuring the uniqueness and non-replicability of the quantum key. Similarly, the platform searches for the corresponding encryption / decryption key based on the file identifier; this key is also uniquely matched with the file identifier, ensuring the uniqueness and non-repeatability of the key used to decrypt the encrypted application file.

[0105] Step 304: When the target encryption / decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption / decryption key to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

[0106] Once the quantum key service platform determines the quantum key and the encryption / decryption key, it will use the quantum key to encrypt the encryption / decryption key to obtain the target encryption / decryption key. This ensures the security of the encryption / decryption key during transmission. The target encryption / decryption key is then returned to the client, ensuring that only the client can decrypt the encrypted key, preventing the key from being intercepted and cracked during transmission.

[0107] The target encryption / decryption key in this embodiment is encrypted using quantum key distribution. Even if intercepted, the interceptor cannot use the target encryption / decryption key to decrypt the encrypted application file, further enhancing the security of the application source code.

[0108] When the client receives the target encryption / decryption key returned by the quantum key service platform, it will use the key to decrypt the target application file and obtain the original application file.

[0109] Specifically, the client uses the quantum key within the quantum-safe chip to decrypt the target encryption / decryption key, and then uses the decrypted encryption / decryption key to decrypt the encrypted application file, obtaining the original application file.

[0110] The target encryption / decryption key in this embodiment is obtained by encrypting the encryption / decryption key based on quantum key distribution using a quantum key distribution platform. This ensures the security of the encryption / decryption key during transmission. Furthermore, only the client can decrypt the encrypted encryption / decryption key, preventing it from being intercepted and cracked during transmission.

[0111] In addition, the client uses the quantum key in the quantum-safe chip to decrypt the target encryption / decryption key, ensuring the security and reliability of the decryption process. The quantum key in the quantum-safe chip has extremely high security, which can prevent the quantum key from being intercepted and cracked, thereby improving the security of the target encryption / decryption key.

[0112] The client in this embodiment can also decrypt different encrypted application files according to different target encryption and decryption keys, realizing a dynamic key decryption mechanism. This avoids the problem of increased risk of application source code leakage caused by using the same encryption and decryption key to encrypt and decrypt encrypted application files, improves the flexibility and adaptability of the decryption process, and ensures the correctness and reliability of the decryption operation.

[0113] In this embodiment, the client obtains the corresponding encryption / decryption key and quantum key from the quantum key service platform based on the file identifier and key identifier, thus implementing a flexible decryption mechanism to ensure the security of application file decryption and prevent source code leakage. Furthermore, the client, through the quantum key service platform, achieves secure management and use of the quantum key, ensuring the security and reliability of the decryption process.

[0114] In one embodiment of this application, step 301, obtaining the key identifier when the target application file sent by the server is received, includes:

[0115] When the target application file sent by the server is received, the quantum security chip is installed; the key identifier and the quantum key corresponding to the key identifier are obtained from the quantum security chip.

[0116] Because the target application file is encrypted, when the client receives the target application file sent by the server, the client needs to decrypt it to obtain the original application file.

[0117] After receiving the target application file, the client needs to install a quantum-safe chip. A quantum-safe chip is a hardware device used to store and manage quantum keys, ensuring their security and uniqueness. In this embodiment, the quantum-safe chip stores N key identifiers and the corresponding quantum keys for each identifier.

[0118] The client will obtain an unused key identifier from the quantum-safe chip. The key identifier is used to uniquely identify the quantum key, ensuring the uniqueness and non-repeatability of the quantum key.

[0119] The target encryption / decryption key still needs to be decrypted using quantum key mapping. Therefore, in this embodiment, while obtaining the key identifier, it is also necessary to obtain the quantum key corresponding to the key identifier so that the target encryption / decryption key can be decrypted using the quantum key corresponding to the key identifier.

[0120] Since quantum-safe chips are typically equipped with hardware-level protection mechanisms, such as anti-tampering circuits and encrypted storage, this application embodiment stores the key identifier and quantum key required by the client in the quantum-safe chip to ensure that the quantum key is protected in a hardware-level security environment, prevent external attacks and tampering, ensure the security of the quantum key during storage and transmission, and prevent the quantum key from being stolen and cracked.

[0121] Furthermore, in this embodiment, each use consumes a key identifier and its corresponding quantum key in the quantum-safe medium. That is, the quantum key in the quantum-safe medium is marked as used after each use, ensuring that the key is not reused. This mechanism prevents the quantum key from being stolen and replay attacks, ensuring the security of the quantum key and further improving the security of the application source code.

[0122] In one embodiment of this application, step 304, when the target encryption / decryption key sent by the quantum key service platform is received, decrypting the encrypted application file according to the target encryption / decryption key to obtain the application file, and storing the application file in memory, includes:

[0123] The target encryption / decryption key is decrypted based on the quantum key corresponding to the key identifier to obtain the encryption / decryption key;

[0124] The encrypted application file is decrypted using the encryption / decryption key to obtain the application file.

[0125] The application file is stored in the memory.

[0126] In this embodiment, after receiving the target encryption / decryption key sent by the quantum key service platform, the client uses the key to decrypt the encrypted application file, obtains the original application file, and stores the application file in memory.

[0127] Specifically, the client uses the quantum key in the quantum-safe chip to decrypt the target encryption / decryption key, obtaining the original encryption / decryption key. The client then uses the decrypted encryption / decryption key to decrypt the encrypted application file, obtaining the original application file. This decryption process ensures the security of the encrypted application file during transmission and storage, preventing the file from being tampered with or replaced. The client stores the decrypted application file in memory instead of on disk, ensuring that the application file is not stored on disk in plaintext, preventing unauthorized access and theft.

[0128] The client can store the decrypted application file in memory instead of on disk in the following ways:

[0129] 1. Memory-Mapped Files:

[0130] Memory-mapped files are a technique that maps file content to a process's address space. With memory-mapped files, applications can manipulate file content directly in memory without loading the file content into memory.

[0131] Specifically, the client creates a memory-mapped file, writes the decrypted application file content into the memory-mapped file, and then maps the memory-mapped file into the process's address space, allowing the application to directly manipulate the file content in memory. The client can manipulate the decrypted application file content in memory without having to write the file content to disk.

[0132] Memory-mapped files can improve the efficiency of file operations and reduce disk I / O operations, making them suitable for scenarios that require frequent reading and writing of file content.

[0133] 2. Memory Cache:

[0134] Memory caching is a technique for storing data in memory. With memory caching, applications can store the decrypted contents of application files in memory without writing them to disk.

[0135] Specifically, the client creates a memory cache and stores the decrypted application file content in the memory cache. The client can manipulate the decrypted application file content in the memory cache without writing the file content to disk.

[0136] Memory caching can improve the efficiency of data access and reduce disk I / O operations, making it suitable for scenarios that require frequent data access.

[0137] 3. In-Memory Database:

[0138] An in-memory database is a type of database that stores data in memory. With an in-memory database, applications can store the decrypted contents of application files in memory without writing them to disk.

[0139] The client creates an in-memory database and stores the decrypted application file content in the in-memory database. The client can manipulate the decrypted application file content in the in-memory database without writing the file content to disk.

[0140] In-memory databases can improve data access efficiency and reduce disk I / O operations, making them suitable for scenarios that require frequent data access.

[0141] This application embodiment stores the decrypted application file in memory, ensuring that the application file is not stored on the disk in plaintext, thus preventing unauthorized access and theft of the application file and further enhancing the overall security and reliability of the application.

[0142] In this embodiment, the client obtains the corresponding encryption / decryption key and quantum key from the quantum key service platform based on the file identifier and key identifier, thus implementing a flexible decryption mechanism to ensure the security of application file decryption and prevent source code leakage. Furthermore, the client, through the quantum key service platform, achieves secure management and use of the quantum key, ensuring the security and reliability of the decryption process.

[0143] Reference Figure 4 This is a flowchart illustrating the steps of another embodiment of the application file processing method based on quantum key distribution, which includes the following steps:

[0144] Step 401: The quantum key service platform generates and distributes quantum keys;

[0145] The quantum key service platform generates 2N quantum random numbers, of which N are used as key identifiers and the other N are used as quantum keys. The key identifiers and quantum keys are in one-to-one correspondence. The quantum keys and their key identifiers are stored in the database of the quantum key service platform and distributed to the quantum key filling machine through QKD. The quantum key filling machine fills the quantum keys and their key identifiers into the quantum security chip offline.

[0146] Step 402: The server creates an ASAR processing program;

[0147] The server creates an ASAR handler. Creating an ASAR handler refers to writing a handler program in any language that can be used to write Windows programs. The ASAR handler can use the SM4 encryption algorithm to encrypt application files and insert a file identifier into the encrypted application files.

[0148] Step 403: The server processes and packages the application files;

[0149] The server generates a first and a second 256-bit random number based on a random algorithm. The first random number is used as the encryption / decryption key, and the second random number is used as the file identifier. The server calls the asar processor with the first random number, the second random number, and the file address of the application file as parameters. The asar processor uses the first random number and the SM4 algorithm to encrypt the application file, generating an encrypted application file. The second random number is then inserted into the header of the encrypted application file to generate a target application file containing the file identifier. Electron-builder is used to package the target application file, generating an application installation package. The application installation package is then sent directly to the client over a normal network.

[0150] Step 404: The server sends the file identifier and encryption / decryption key to the quantum key service platform;

[0151] The server sends the file identifier and encryption / decryption key to the quantum key service platform and stores them in the database one by one. The quantum key service platform and the server are on the same secure local area network.

[0152] Step 405: The client parses the target application file;

[0153] The client inserts a quantum-safe chip, installs and opens the application, and the application parses the target application file, separating the file identifier in the header and the encrypted application file.

[0154] Step 406: The client obtains the target encryption / decryption key;

[0155] The client application obtains the encryption / decryption key by acquiring an unused key identifier from the quantum-safe chip, sending the key identifier and file identifier to the quantum key service platform, which then extracts the encryption / decryption key and quantum key based on the file identifier and key identifier, respectively, encrypts the encryption / decryption key using the quantum key, obtains the target encryption / decryption key, and returns it to the client.

[0156] Step 407: The client obtains the application file.

[0157] The client application uses the quantum key stored in the quantum-safe chip to decrypt the target encryption / decryption key returned by the quantum key service platform. It then uses the decrypted encryption / decryption key to decrypt the encrypted application file, obtains the application file, and stores it in memory. The application then interprets and executes the application file in memory.

[0158] The embodiments of this application, through the methods described above, can solve the problem that most current encryption and decryption methods used by ASAR are at high risk of being cracked, thereby preventing the leakage of source code for Electron-based applications and preventing the theft and secondary distribution of Electron-based applications.

[0159] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0160] Based on the above embodiments, this embodiment also provides an application file processing device based on quantum key distribution, which is applied in a server.

[0161] Reference Figure 5The diagram illustrates a structural block diagram of an embodiment of an application file processing device based on quantum key distribution, which may specifically include the following modules:

[0162] Application file acquisition module 501 is used to acquire application files; the application file is a file obtained by packaging the source code in the application.

[0163] The target application file module 502 is used to obtain a target application file based on a random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers.

[0164] The random number pair sending module 503 is used to send the random number pair to the quantum key service platform, so that the quantum key service platform can determine the encryption and decryption key for decrypting the target application file based on the random number pair;

[0165] The target application file sending module 504 is used to send the target application file to the client, so that the client can decrypt the target application file based on the encryption and decryption key sent in the quantum key service platform.

[0166] Based on the above embodiments, this embodiment also provides another application file processing device based on quantum key distribution, which is applied in a client.

[0167] Reference Figure 6 The diagram illustrates a structural block diagram of another embodiment of the application file processing device based on quantum key distribution, which may specifically include the following modules:

[0168] The key identifier acquisition module 601 is used to acquire the key identifier when the target application file sent by the server is received;

[0169] The target application file parsing module 602 is used to parse the target application file to obtain the file identifier and encrypted application file in the target application file;

[0170] The key determination module 603 is used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier;

[0171] The target application file decryption module 604 is used to decrypt the encrypted application file according to the target encryption / decryption key when it receives the target encryption / decryption key sent by the quantum key service platform, so as to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

[0172] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0173] This application provides one or more machine-readable media storing instructions that, when executed by one or more processors, cause an electronic device to perform one or more of the methods described in the above embodiments. In this application, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0174] The embodiments of this disclosure can be implemented as an apparatus configured as desired using any suitable hardware, firmware, software, or any combination thereof, including electronic devices such as terminal devices, servers (clusters), etc. Figure 7 An exemplary apparatus 700 is schematically shown that can be used to implement the various embodiments described in this application.

[0175] In one embodiment, Figure 7 An exemplary device 700 is shown, which includes one or more processors 702, a control module (chipset) 704 coupled to at least one of the processors 702, a memory 706 coupled to the control module 704, a non-volatile memory (NVM) / storage device 708 coupled to the control module 704, one or more input / output devices 710 coupled to the control module 704, and a network interface 712 coupled to the control module 704.

[0176] Processor 702 may include one or more single-core or multi-core processors, and processor 702 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 700 can serve as a terminal device, server (cluster), or other device as described in the embodiments of this application.

[0177] In some embodiments, the apparatus 700 may include one or more computer-readable media (e.g., memory 706 or NVM / storage device 708) having instructions 714 and one or more processors 702 that are combined with the one or more computer-readable media and configured to execute the instructions 714 to implement the module and thus perform the actions described in this disclosure.

[0178] In one embodiment, the control module 704 may include any suitable interface controller to provide any suitable interface to at least one of the processors 702 and / or any suitable device or component communicating with the control module 704.

[0179] The control module 704 may include a memory controller module to provide an interface to the memory 706. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0180] Memory 706 may be used, for example, to load and store data and / or instructions 714 for device 700. In one embodiment, memory 706 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 706 may include double data rate type 4 synchronous dynamic random access memory (DDR4 SDRAM).

[0181] In one embodiment, the control module 704 may include one or more input / output controllers to provide an interface to the NVM / storage device 708 and (one or more) input / output devices 710.

[0182] For example, NVM / storage device 708 may be used to store data and / or instructions 714. NVM / storage device 708 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0183] NVM / storage device 708 may include storage resources that are physically part of a device on which device 700 is mounted, or that can be accessed by the device without needing to be part of the device. For example, NVM / storage device 708 may be accessed via a network via one or more input / output devices 710.

[0184] One or more input / output devices 710 may provide an interface for device 700 to communicate with any other suitable device. Input / output devices 710 may include communication components, audio components, sensor components, etc. A network interface 712 may provide an interface for device 700 to communicate via one or more networks. Device 700 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G, 5G, etc., or combinations thereof.

[0185] In one embodiment, at least one of the processors 702 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 704. In one embodiment, at least one of the processors 702 may be logically packaged with one or more controllers of the control module 704 to form a system-in-package (SiP). In one embodiment, at least one of the processors 702 may be integrated with the logic of one or more controllers of the control module 704 on the same die. In one embodiment, at least one of the processors 702 may be integrated with the logic of one or more controllers of the control module 704 on the same die to form a system-on-a-chip (SoC).

[0186] In various embodiments, device 700 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, device 700 may have more or fewer components and / or different architectures. For example, in some embodiments, device 700 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0187] The detection device can use a main control chip as a processor or control module, and sensor data, position information, etc. can be stored in a memory or NVM / storage device. The sensor group can be used as an input / output device, and the communication interface can include a network interface.

[0188] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0189] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0190] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable quantum key-based application file processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable quantum key-based application file processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0191] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable quantum key-based application file processing terminal device to operate in a specific manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable quantum key-based application file processing terminal device, causing a series of operational steps to be executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0193] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0194] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0195] The foregoing has provided a detailed description of a quantum key-based application file processing method and apparatus, an electronic device, and a storage medium. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for processing application files based on quantum key distribution, characterized in that, Applied to a server, which is connected to both a client and a quantum key service platform, the method includes: Obtain the application file; the application file is the file obtained by packaging the source code in the application. The target application file is obtained based on the random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers; The random number pair is sent to the quantum key service platform so that the quantum key service platform can determine the encryption / decryption key used to decrypt the target application file based on the random number pair; The target application file is sent to the client, so that the client can decrypt the target application file based on the encryption / decryption key sent in the quantum key service platform; The step of obtaining the target application file based on the random number pair and the application file includes: The first random number in the random number pair is used as the encryption / decryption key, and the control program uses the encryption / decryption key to encrypt the application file to obtain an encrypted application file. The second random number in the random number pair is used as the file identifier, and the processing program is controlled to insert the file identifier into the file header of the encrypted application file to obtain the target application file.

2. The method according to claim 1, characterized in that, The acquisition of the application file includes: Generate the random number pair and determine the file address corresponding to the application file; The processor is invoked based on the random number pair and the file address, so that the processor can obtain the application file based on the file address; the processor is used to process the application file.

3. A method for processing application files based on quantum key distribution, characterized in that, Applied to a client, wherein the client is connected to both the server and the quantum key service platform, the method includes: When the target application file sent by the server is received, the key identifier is obtained; wherein, the target application file is determined by the application file processing method based on quantum key distribution as described in claim 1; Parse the target application file to obtain the file identifier and encrypted application file within the target application file; The quantum key service platform is controlled to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier; When the target encryption / decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption / decryption key to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

4. The method according to claim 3, characterized in that, The step of obtaining the key identifier when the target application file sent by the server is received includes: When the target application file sent by the server is received, the quantum security chip is installed; the key identifier and the quantum key corresponding to the key identifier are obtained from the quantum security chip.

5. The method according to claim 4, characterized in that, When the target encryption / decryption key sent by the quantum key service platform is received, the encrypted application file is decrypted according to the target encryption / decryption key to obtain the application file, and the application file is stored in memory, including: The target encryption / decryption key is decrypted based on the quantum key corresponding to the key identifier to obtain the encryption / decryption key; The encrypted application file is decrypted using the encryption / decryption key to obtain the application file. The application file is stored in the memory.

6. A quantum key-based application file processing device, characterized in that, The device is applied to a server, which is connected to a client and a quantum key service platform, and includes: An application file acquisition module is used to acquire application files; the application file is a file obtained by packaging the source code in the application. The target application file module is used to obtain the target application file based on the random number pair and the application file; the random number pair contains two random numbers and the correspondence between the two random numbers. A random number pair sending module is used to send the random number pair to the quantum key service platform, so that the quantum key service platform can determine the encryption / decryption key for decrypting the target application file based on the random number pair; The target application file sending module is used to send the target application file to the client, so that the client can decrypt the target application file based on the encryption and decryption key sent in the quantum key service platform; The device further includes: The first random number in the random number pair is used as the encryption / decryption key, and the control program uses the encryption / decryption key to encrypt the application file to obtain an encrypted application file. The second random number in the random number pair is used as the file identifier, and the processing program is controlled to insert the file identifier into the file header of the encrypted application file to obtain the target application file.

7. A quantum key-based application file processing device, characterized in that, The device is applied to a client, which is connected to both the server and the quantum key service platform. The device includes: A key identifier acquisition module is used to acquire a key identifier when a target application file is received from the server; wherein the target application file is determined by the quantum key-based application file processing method described in claim 1. The target application file parsing module is used to parse the target application file to obtain the file identifier and encrypted application file in the target application file; The key determination module is used to control the quantum key service platform to determine the quantum key corresponding to the key identifier and the encryption / decryption key corresponding to the file identifier; The target application file decryption module is used to decrypt the encrypted application file according to the target encryption / decryption key when it receives the target encryption / decryption key sent by the quantum key service platform, so as to obtain the application file; the target encryption / decryption key is obtained by the quantum key service platform encrypting the encryption / decryption key based on the quantum key.

8. An electronic device, characterized in that, include: processor; and A memory having executable code stored thereon, which, when executed, causes the processor to perform the quantum key-based application file processing method as described in any one of claims 1-2 or 3-5.

9. One or more machine-readable media having executable code stored thereon, which, when executed, causes a processor to perform the quantum key-based application file processing method as described in any one of claims 1-2 or 3-5.

Images