Remote registration method and system for password device

Abstract

The embodiment of the invention relates to the technical field of information security and passwords, and discloses a remote registration method and system for password equipment. The remote registration method of the cryptographic device comprises the following steps: connecting a quantum key storage medium; a first quantum key is stored in the quantum key storage medium, the first quantum key is distributed by the quantum secret communication network, and the first quantum key is synchronously stored in the quantum key management platform; encrypting a registration application message of the cryptographic device by using the first quantum key; sending the encrypted registration application message to a quantum key management platform; receiving a registration response message sent by the quantum key management platform; and analyzing the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message. By means of the quantum key storage medium, the first quantum key is obtained to encrypt the interaction information during registration, so that the encrypted interaction information has the capability of resisting cracking attack of a quantum computer, and the security of online registration of the password equipment is ensured.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of information security and cryptographic technology, and in particular to a remote registration method and system for a cryptographic device. Background Art

[0002] In order to manage cryptographic devices, the cryptographic devices need to be issued and registered in the key management platform in advance. The key management platform allocates an identification ID to the cryptographic device and completes the public key exchange between the cryptographic device and the key management platform. Only then can a secure channel be established between the two to enable the platform to manage the cryptographic devices.

[0003] Currently, the issuance and registration of cryptographic devices usually adopts the offline registration method, that is, the cryptographic device submits the device information table, certificate application and supported algorithms to the key management platform offline. The key management platform reviews the submitted information and records the submitted information to the device management information library after the review is passed. Finally, the relevant certificates that have passed the registration are sent to the cryptographic device offline. The cryptographic device imports the relevant certificates to complete the issuance and registration.

[0004] However, the inventors have found that the current offline registration method has at least the following problems: the information submitted and issued during the registration process relies on asymmetric cryptographic technology to ensure the security of the information. With the development of quantum computer technology, the computing power of computers has become more and more advanced. The substantial improvement in computing power will facilitate the cracking of asymmetric cryptographic technology, bringing the risk of private keys being stolen, and then causing the encrypted data transmitted by the secure channel to be cracked. In addition, the offline registration method affects the convenience of information transmission between the cryptographic device and the platform. If the cryptographic device and the platform are in different regions, there is a risk of information leakage when using the network to transmit information, and there will be problems such as increased transportation costs and poor timeliness when using manual information transmission. Summary of the invention

[0005] The purpose of an embodiment of the present invention is to provide a remote registration method for a cryptographic device, which uses a first quantum key distributed by a quantum key distribution network in a quantum key storage medium to protect registration-related information, thereby realizing remote online registration of a cryptographic device, reducing the labor cost caused by an offline registration method, and improving the security of information transmission during the online registration process.

[0006] To solve the above technical problems, an embodiment of the present invention provides a remote registration method for a cryptographic device, which is applied to a cryptographic device, and the method includes: connecting a quantum key storage medium; wherein a first quantum key is stored in the quantum key storage medium, and the first quantum key is distributed by a quantum secure communication network, and the first quantum key is synchronously stored in a quantum key management platform; using the first quantum key to encrypt a registration application message of the cryptographic device; sending the encrypted registration application message to the quantum key management platform; receiving a registration response message sent by the quantum key management platform; parsing the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message.

[0007] An embodiment of the present invention also provides a remote registration method for a cryptographic device, which is applied to a quantum key management platform, and the method includes: receiving an encrypted registration application message sent by a cryptographic device; wherein the registration application message is encrypted using a first quantum key, the first quantum key is stored in a quantum key storage medium, and the first quantum key is distributed by a quantum secure communication network, and the first quantum key is synchronously stored in the quantum key management platform; parsing the registration application message and generating a registration response message; sending the registration response message to the cryptographic device, so that the cryptographic device parses the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message.

[0008] An embodiment of the present invention also provides a remote registration system for a cryptographic device, comprising: a cryptographic device, a quantum key management platform and a quantum key storage medium; wherein the cryptographic device is used to execute the above-mentioned remote registration method for the cryptographic device; and the quantum key management platform is used to execute the above-mentioned remote registration method for the cryptographic device.

[0009] Compared with the prior art, the embodiments of the present invention obtain the first quantum key with the help of a quantum key storage medium, and encrypt the registration application message through the first quantum key, so that the information exchanged between the cryptographic device and the quantum key management platform during the registration process has the ability to resist quantum computer cracking attacks, thereby ensuring the security of the online registration of the cryptographic device, breaking through the geographical restrictions of the cryptographic device registration, improving the convenience of registration, and reducing the labor cost of registration.

[0010] In addition, the registration application message of the cryptographic device is encrypted using the first quantum key, including: using the public key of the quantum key management platform to encrypt the device identification ID of the quantum key storage medium; using the first quantum key to encrypt the basic information of the cryptographic device and the public key of the cryptographic device; sending the encrypted registration application message to the quantum key management platform, including: sending the encrypted device identification ID of the quantum key storage medium, the basic information of the cryptographic device and the public key of the cryptographic device to the quantum key management platform.

[0011] In addition, the registration application message of the cryptographic device is encrypted using the first quantum key, including: using the public key of the quantum key management platform to encrypt the first random number generated by the cryptographic device; using the first quantum key to encrypt the signature information of the first random number; wherein the signature information of the first random number is generated by the quantum key storage medium; sending the encrypted registration application message to the quantum key management platform, including: sending the encrypted first random number and the signature information of the first random number to the quantum key management platform. Carrying the random number in the message sent at each interaction between the cryptographic device and the quantum key management platform helps to prevent replay attacks and improve the security of message interaction.

[0012] In addition, the registration response message includes: a cryptographic device identification ID and a second quantum key encrypted using the first quantum key; parsing the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message, including: parsing the second quantum key of the cryptographic device and the cryptographic device identification ID by calling the first quantum key in the quantum key storage medium.

[0013] In addition, the registration response message also includes: the third quantum key information encrypted by the first quantum key; after receiving the registration response message sent by the quantum key management platform, it also includes: updating the first quantum key stored in the quantum key storage medium according to the parsed third quantum key information. The new first quantum key stored in the updated quantum key storage medium can be used for the registration of the next cryptographic device, which facilitates the recycling of the quantum key storage medium.

[0014] In addition, the first quantum key in the quantum key storage medium is distributed by the issuing registration service to the quantum key management platform, and after the quantum key management platform returns a response to the issuing registration service, the issuing registration service and the quantum key management platform synchronize the application for the first quantum key to the quantum key distribution device.

[0015] In addition, generating a registration response message includes: after the registration application message is reviewed and approved, assigning a cryptographic device identification ID to the cryptographic device, and obtaining a second quantum key from a quantum random number generator QRNG; using the first quantum key to encrypt the second quantum key and the cryptographic device identification ID, and using them as a registration response message; wherein the second quantum key is used as the quantum key of the cryptographic device.

[0016] In addition, generating a registration response message includes: after the registration application message is reviewed and approved, obtaining a third quantum key from a quantum random number generator QRNG; encrypting the third quantum key using a public key of a quantum key storage medium; encrypting the encrypted third quantum key using a first quantum key, and using it as a registration response message; wherein the third quantum key is used to update the first quantum key. The new first quantum key stored in the updated quantum key storage medium can be used for the registration of the next cryptographic device, facilitating the recycling of the quantum key storage medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0018] Figure 1 is a flow chart of a remote registration method for a password device according to a first embodiment of the present invention;

[0019] Figure 2 is a flow chart of a remote registration method for a cryptographic device according to a second embodiment of the present invention;

[0020] Figure 3 is a flow chart of a remote registration method for a cryptographic device according to a third embodiment of the present invention;

[0021] Figure 4 is a schematic diagram of the architecture of a remote distribution and registration system for a password device according to an embodiment of the present invention;

[0022] Figure 5 is a schematic diagram of a process for issuing a quantum key storage medium according to an embodiment of the present invention;

[0023] Figure 6 is a flow chart of a remote registration method for a cryptographic device according to a fourth embodiment of the present invention;

[0024] Figure 7 1 is a schematic diagram of the overall interaction process of a remote registration method for a password device according to an embodiment of the present invention;

[0025] Figure 8 It is a schematic diagram of the structure of a remote registration system for a password device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, it can be understood by those skilled in the art that in the embodiments of the present invention, many technical details are provided to enable readers to better understand the present invention. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present invention can be implemented.

[0027] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present invention. The embodiments may be combined with each other and referenced to each other without contradiction.

[0028] The embodiment of the present invention relates to a remote registration method for a cryptographic device, which is applied to a cryptographic device. The core of the method is: connecting a quantum key storage medium; wherein a first quantum key is stored in the quantum key storage medium, and the first quantum key is distributed by a quantum secure communication network, and the first quantum key is synchronously stored in a quantum key management platform; using the first quantum key to encrypt the registration application message of the cryptographic device; sending the encrypted registration application message to the quantum key management platform; receiving a registration response message sent by the quantum key management platform; parsing the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message. The first quantum key is obtained by means of a quantum key storage medium, and the registration-related information is encrypted by the first quantum key, so that the information exchanged between the cryptographic device and the quantum key management platform has the ability to resist quantum computer cracking attacks, ensuring the security of the online registration of the cryptographic device, breaking through the geographical restrictions of the registration of the cryptographic device, improving the convenience of registration, and reducing the labor cost of registration. The following is a specific description of the implementation details of the remote registration method of the cryptographic device of this embodiment. The following content is only for the convenience of understanding the implementation details provided, and is not necessary for the implementation of this solution.

[0029] The remote registration method of the password device in the first embodiment of the present invention is as follows Figure 1 As shown, specifically including:

[0030] Step 101, connecting the quantum key storage medium.

[0031] Specifically, the quantum key storage medium is a universal intelligent password key that complies with the "GM / T0016-2012 Intelligent Password Key Cryptographic Application Interface Specification". After being issued by the quantum key management platform, the first quantum key can be encrypted and securely stored inside the storage medium. The quantum key storage medium can be in the form of a ferry card, an independent structure that can be disassembled and assembled and can store information, specifically a hardware device with a USB interface (USB key), a small storage (TransFlash, TF) card, etc. When in use, the quantum key storage medium is inserted into the information transmission interface of the cryptographic device, and the cryptographic device connects to the quantum key storage medium through the internally installed management agent software and reads the information stored in the quantum key storage medium.

[0032] Step 102: Encrypt the registration application message of the cryptographic device using the first quantum key.

[0033] Specifically, the first quantum key is used to encrypt the basic information of the cryptographic device, such as the device information table, certificate application, and supported algorithms, and the first quantum key is used to encrypt the public key of the cryptographic device to ensure the security of the public key during transmission and prevent the public key from being cracked by a quantum computer.

[0034] Step 103: Send the encrypted registration application message to the quantum key management platform.

[0035] Step 104: Receive a registration response message sent by the quantum key management platform.

[0036] Specifically, the key management platform reviews the registration application message. After the review is passed, the key management platform will issue a device certificate and return the device certificate, key management system certificate, etc. to the cryptographic device. In order to ensure the security of the transmitted messages, the quantum key management platform will also encrypt the sent messages.

[0037] Step 105: parse the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message.

[0038] Specifically, the parsed second quantum key is imported into the password card / module of the cryptographic device as the quantum key of the cryptographic device. The cryptographic device synchronously stores information such as the cryptographic device identification ID and device certificate in the registration information. In addition, in order to let the quantum key management platform know the reception of the registration information by the cryptographic device, after the registration information is normally received and stored, the cryptographic device will also return the registration result information to the quantum key management platform. The registration result information contains at least the identification ID of the cryptographic device. After receiving the registration result information, the quantum key management platform updates the status of the cryptographic device to registration completed.

[0039] Compared with the prior art, the embodiments of the present invention obtain the first quantum key with the help of a quantum key storage medium, and encrypt the registration application message through the first quantum key, so that the information exchanged between the cryptographic device and the quantum key management platform during the registration process has the ability to resist quantum computer cracking attacks, thereby ensuring the security of the online registration of the cryptographic device, breaking through the geographical restrictions of the cryptographic device registration, improving the convenience of registration, and reducing the labor cost of registration.

[0040] The remote registration method of the password device in the second embodiment of the present invention is as follows: Figure 2 As shown, specifically including:

[0041] Step 201, connecting the quantum key storage medium.

[0042] Step 202: Use the public key of the quantum key management platform to encrypt the first random number generated by the cryptographic device.

[0043] Step 203: Encrypt the signature information of the first random number using the first quantum key.

[0044] Step 204: Send the encrypted first random number and the signature information of the first random number to the quantum key management platform.

[0045] Specifically, during the registration application stage of the cryptographic device, the cryptographic device will generate a first random number random1. Since the cryptographic device carries a random number each time it sends a message, the generated first random number can be used to prevent replay attacks. The first random number generated by the cryptographic device is encrypted using the public key of the quantum key management platform, and then the signature information of the first random number is encrypted using the first quantum key. Since the signature information of the first random number is generated by the quantum key storage medium, the quantum key management platform's verification of the signature information of the first random number can determine the source of the registration application information and ensure the security of the information.

[0046] In addition, the registration application message also includes information after the device identification ID of the quantum key storage medium is encrypted using the public key of the quantum key management platform. Since the public key of the quantum key management platform is known to the quantum key management platform, the quantum key management platform can correctly parse the information encrypted by the public key and accurately obtain the device identification ID of the quantum key storage medium. Based on the device identification ID of the quantum key storage medium, the first quantum key distributed to the quantum key storage medium can be determined, and then the remaining encrypted content can be parsed based on the first quantum key.

[0047] Step 205: Receive a registration response message sent by the quantum key management platform.

[0048] Step 206: parse the second quantum key of the cryptographic device and the registration information of the cryptographic device in the registration response message.

[0049] In addition, in order to let the quantum key management platform know the reception of the registration information by the cryptographic device, after the registration information is normally received and stored, the cryptographic device will also return the registration result information to the quantum key management platform. When returning the registration result information, the cryptographic device can also generate a random number random3 and calculate its signature value, encrypt the signature value of the random number random3 using the second quantum key of the cryptographic device parsed from the registration information, and encrypt the device identification ID and random number random3 of the cryptographic device using the public key of the quantum key management platform, and then send the encrypted information as the registration result information to the quantum key management platform.

[0050] Compared with the prior art, the embodiments of the present invention carry a random number in the message sent each time a cryptographic device and a quantum key management platform interact, which helps to prevent replay attacks and improve the security of message interaction.

[0051] The remote registration method of the password device in the third embodiment of the present invention is as follows: Figure 3 As shown, specifically including:

[0052] Step 301, connecting the quantum key storage medium.

[0053] Step 302: Encrypt the registration application message of the cryptographic device using the first quantum key.

[0054] Step 303: Send the encrypted registration application message to the quantum key management platform.

[0055] Step 304: Receive a registration response message sent by the quantum key management platform.

[0056] Step 305, by calling the first quantum key in the quantum key storage medium, the second quantum key, the third quantum key and the cryptographic device identification ID of the cryptographic device are parsed.

[0057] Specifically, the quantum key management platform uses the first quantum key to identify the cryptographic device ID and obtains the second and third quantum keys from the quantum random number generator QRNG to encrypt the second quantum key, wherein the second quantum key is used as the quantum key of the cryptographic device, and the third quantum key is used to update the quantum key stored in the quantum key storage medium. The new first quantum key stored in the updated quantum key storage medium can be used for the registration of the next cryptographic device, facilitating the recycling of the quantum key storage medium.

[0058] In addition, the second quantum key and the third quantum key can be sent separately or together. In the case where there is no need to update the first quantum key stored in the quantum key storage medium, the registration response message does not need to carry the third quantum key.

[0059] In addition, the third quantum key in the registration response message is information doubly encrypted by the first quantum key and the public key of the quantum key storage medium, that is, the third quantum key encrypted by the public key of the quantum key storage medium is then encrypted twice by the first quantum key.

[0060] Compared with the prior art, the embodiments of the present invention use the first quantum key and the public key to encrypt different data respectively, so that the first quantum key is used to ensure the security of the encrypted information. At the same time, the cryptographic device identification ID encrypted by the public key can be used to determine the first quantum key used for decryption, thereby ensuring the normal parsing of the interactive information of the registration process by the quantum key management platform.

[0061] The following is a detailed description of the registration and issuance process for quantum key storage media:

[0062] The registration and issuance structure of cryptographic devices is as follows Figure 4 As shown, it includes quantum key distribution equipment, quantum key management platform, quantum random number generator QRNG, remote issuance registration site and cryptographic equipment.

[0063] The quantum key distribution device is a terminal device that meets the relevant system requirements of the quantum communication network. It is connected to the quantum communication network through quantum channels and classical communication channels. Under the unified configuration and scheduling of the quantum communication network management system, it completes end-to-end symmetric key distribution and provides a key output service interface, which can export quantum keys to corresponding management and application devices.

[0064] The quantum key management platform is used to realize the issuance registration, charging, cancellation, and reporting of loss of quantum key storage media, and manage the entire life cycle of the charged quantum keys.

[0065] The quantum random number generator QRNG uses the inherent randomness and unpredictability of quantum mechanics to generate true random numbers. It is integrated into the quantum key management platform in the form of an independent device or board to provide true random numbers for the quantum key management platform.

[0066] The remote issuance and registration site includes: issuance and registration service, operation terminal and quantum key storage medium.

[0067] The issuance and registration service accesses the quantum communication network by connecting to the quantum key distribution device, and then securely accesses the quantum key management platform. Under the control and dispatch of the quantum key management platform, it can perform issuance registration, recharge, cancellation, and loss reporting for the quantum key storage medium connected to the operation terminal in the remote issuance and registration site.

[0068] The above architecture can be used to realize the remote distribution of quantum key storage media. The specific process is as follows: Figure 5 Shown, including

[0069] a) The quantum key management platform and the issuance and registration service are respectively connected to the quantum secure communication network through the quantum key distribution device, and based on the quantum key distributed by the quantum key distribution (QKD) network, a QKD key-enhanced security channel is established to protect the interactive information between the two parties; the operation terminal and the issuance and registration service in the remote issuance and registration site are deployed in the same security domain, and the two establish and communicate through a secure channel.

[0070] b) Inserting the quantum key storage medium into the operation terminal, the operation terminal connects to the quantum key storage medium and creates an application, a container and a quantum key file structure in the quantum key storage medium, and initializes the quantum key storage medium.

[0071] c) After the operation terminal receives the initialization result of the quantum key storage medium, the operation terminal initiates a quantum key storage medium issuance request to the issuance registration service, and the issuance request contains information such as the device information and public key of the quantum key storage medium. The issuance registration service sends a request for applying for a device ID to the quantum key management platform via the Internet / dedicated line, and the request information contains information such as the device information and public key of the quantum key storage medium.

[0072] d) The quantum key management platform sends the application device ID response back to the issuance and registration service via the Internet / dedicated line, and synchronously applies for the same QKD key from the corresponding quantum key distribution device (quantum key management platform corresponds to quantum key distribution device A, and issuance and registration service corresponds to quantum key distribution device B) with the issuance and registration service. The quantum key distribution device returns the QKD key to the quantum key management platform and the issuance and registration service respectively as the first quantum key (QKEK) of the quantum key storage medium; the quantum key management platform synchronously stores the issuance information of the quantum key storage medium and the first quantum key QKEK.

[0073] e) The issuance registration service sends a device issuance response to the operation terminal, and the operation terminal imports the issuance information (including the device ID of the quantum key storage medium, the public key of the quantum key management platform), QKEK and other information into the quantum key storage medium;

[0074] f) The quantum key storage medium returns the issuance result to the operation terminal, the operation terminal returns the issuance result to the issuance registration service, the issuance registration service records the issuance log and synchronizes the issuance result to the quantum key management platform, the quantum key management platform updates the device status information, and completes the remote issuance of the quantum key storage medium.

[0075] The remote registration method of the cryptographic device in the fourth embodiment of the present invention is applied to the quantum key management platform. The method is as follows: Figure 6 As shown, specifically including:

[0076] Step 601: Receive an encrypted registration application message sent by a cryptographic device.

[0077] Step 602: parse the registration application message and generate a registration response message.

[0078] Specifically, after the registration application message sent by the cryptographic device is reviewed and approved, a cryptographic device identification ID is assigned to the cryptographic device, and a second quantum key is obtained from the quantum random number generator QRNG, and the second quantum key and the cryptographic device identification ID are encrypted using the first quantum key and used as a registration response message. The second quantum key in the registration response message serves as the quantum key of the key device.

[0079] In addition, the first quantum key in the quantum key storage medium can also be updated remotely. Specifically, after the registration application message is reviewed and approved, the third quantum key is obtained from the quantum random number generator QRNG, the third quantum key is encrypted using the public key of the quantum key storage medium, the encrypted third quantum key is encrypted using the first quantum key, and sent to the cryptographic device as a registration response message. The third quantum key parsed by the cryptographic device can be used to update the first quantum key, facilitating the recycling of the quantum key storage medium.

[0080] Step 603: Send the registration response message to the cryptographic device.

[0081] Compared with the prior art, the embodiments of the present invention obtain the first quantum key with the help of a quantum key storage medium, and encrypt the registration application message by the first quantum key, so that the information exchanged between the cryptographic device and the quantum key management platform during the registration process has the ability to resist quantum computer cracking attacks, thereby ensuring the security of online registration of the cryptographic device.

[0082] Finally, from the overall introduction of the remote registration system of the password device, the execution process of each device in the architecture when implementing the remote registration method of the password device is introduced, such as Figure 7 As shown, including:

[0083] a) Insert the quantum key storage medium into the USB port of the cryptographic device (management agent), connect the management agent software running in the cryptographic device to the quantum key storage medium, and export and save the public key and other information of the quantum key management platform from the quantum key storage medium.

[0084] b) The cryptographic device generates a first random number random1, encrypts the device ID and random1 of the quantum key storage medium with the public key of the quantum key management platform, encrypts the basic information of the cryptographic device, the public key of the cryptographic device, and the signature information of random1 of the quantum key storage medium with the first quantum key (QKEK) preset in the quantum key storage medium, and sends a registration application message to the quantum key management platform, the registration application information includes the device ID of the quantum key storage medium encrypted with the public key of the quantum key management platform and the first random number random1 (E pubA (device ID of the quantum key storage medium, random1)), and the basic information of the cryptographic device encrypted using the first quantum key, the public key of the cryptographic device, and the signature information of random1 by the quantum key storage medium (E QKEK (cryptographic device information, public key, SigC(random1))).

[0085] c) The quantum key management platform receives the registration application, decrypts the information, and verifies the signature of random1. After the verification is passed, the registration information is reviewed. After the registration review is passed, the device identification ID is assigned to the cryptographic device, and the second quantum key (QK1) and the third quantum key (QK2) are extracted from the quantum random number generator QRNG;

[0086] d) The quantum key management platform generates a random number random2 from the QRNG, encrypts random1 and random2 with the public key of the quantum key storage medium, uses the first quantum key (QKEK) of the quantum key storage medium to encrypt the cryptographic device identification ID, the second quantum key (QK1), the ciphertext of the third quantum key (QK2) encrypted by the public key of the quantum key storage medium, and the signature information of random2 by the quantum key management platform, and sends a registration response message to the managed cryptographic device, the registration response message including random1 and random2 (E pubC (random1, random2)), as well as the cryptographic device identification ID encrypted by the first quantum key, the second quantum key (QK1), the ciphertext of the third quantum key (QK2) encrypted by the public key of the quantum key storage medium, and the signature information (E QKEK (Password device ID, QK1, E pubC(QK2), SigA(random2))).

[0087] e) After receiving the response message, the cryptographic device calls the quantum key storage medium to decrypt random1 and random2, and uses the QKEK preset in the quantum key storage medium to decrypt the cryptographic device ID and QK1, and calls the quantum key storage medium to verify the signature of random2; after the quantum key storage medium successfully verifies the signature and successfully decrypts, the successful result is returned to the cryptographic device. After receiving the successful result, the cryptographic device imports QK1 into the cryptographic card / module in the cryptographic device and saves the registration information such as the cryptographic device ID; the cryptographic device calls the interface of the quantum key storage medium, imports QK2 into the quantum key storage medium, and updates the first quantum key (QKEK) in the quantum key storage medium. The updated QKEK is used for the registration of the next cryptographic device.

[0088] The random number in the registration response message may also be selected as the XOR value of random1 and random2, and the XOR value is encrypted. After being parsed by the cryptographic device, verification can be performed based on random1 and the XOR value.

[0089] f) The cryptographic device generates a random number random3 and calculates its signature value, encrypts the signature value of random3 with QK1, encrypts the cryptographic device identification ID and random3 with the public key of the quantum key management platform, and sends registration result information to the quantum key management platform. The registration result information of the cryptographic device includes the cryptographic device identification ID and random3 encrypted with the public key of the quantum key management platform and the signature value of random3 encrypted with the second quantum key QK1 (E pubA (Password device ID, random3, E QK1 (SigB(random3))).

[0090] g) The quantum key management platform decrypts and verifies random3, updates the cryptographic device status, and synchronously updates the QKEK information of the quantum key storage medium in the database to complete the registration of the cryptographic device.

[0091] The step division of the various methods above is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of the present invention. Adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the protection scope of the invention.

[0092] The embodiment of the present invention also relates to a remote registration system for a password device, such as Figure 8As shown, it includes: a cryptographic device 81, a quantum key management platform 82 and a quantum key storage medium 83; wherein the cryptographic device 81 is used to execute the above-mentioned remote registration method of the cryptographic device; the quantum key management platform 82 is used to execute the above-mentioned remote registration method of the cryptographic device. The specific implementation of the remote registration method of the cryptographic device is consistent with the description of the above embodiment, and in order to reduce repetition, it will not be repeated here.

[0093] The embodiment of the present invention also relates to a computer-readable storage medium storing a computer program, which implements the above-mentioned remote registration method of a password device when executed by a processor.

[0094] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for making a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0095] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present invention, and that in actual applications, various changes may be made in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A remote registration method for a cryptographic device, characterized in that: Applied to a cryptographic device, the method comprises: Connecting a quantum key storage medium; wherein the quantum key storage medium stores a first quantum key, and the first quantum key is distributed by a quantum secure communication network, and the first quantum key is synchronously stored in a quantum key management platform; Encrypting a registration application message of the cryptographic device using the first quantum key; Sending the encrypted registration application message to the quantum key management platform; Receiving a registration response message sent by the quantum key management platform; The second quantum key of the cryptographic device and the registration information of the cryptographic device are parsed from the registration response message.

2. The remote registration method of a password device according to claim 1, characterized in that: The using the first quantum key to encrypt the registration application message of the cryptographic device includes: Using the public key of the quantum key management platform, encrypting the device identification ID of the quantum key storage medium; Using the first quantum key to encrypt basic information of a cryptographic device and a public key of the cryptographic device; The step of sending the encrypted registration application message to the quantum key management platform includes: The encrypted device identification ID of the quantum key storage medium, the basic information of the cryptographic device and the public key of the cryptographic device are sent to the quantum key management platform.

3. The remote registration method for a password device according to claim 1 or 2, characterized in that: Encrypting a registration application message of the cryptographic device using the first quantum key includes: Using the public key of the quantum key management platform, encrypting the first random number generated by the cryptographic device; Encrypting the signature information of the first random number using the first quantum key; wherein the signature information of the first random number is generated by the quantum key storage medium; The step of sending the encrypted registration application message to the quantum key management platform includes: The encrypted first random number and the signature information of the first random number are sent to a quantum key management platform.

4. The remote registration method of a password device according to claim 1, characterized in that: The registration response message includes: a cryptographic device identification ID and a second quantum key encrypted by the first quantum key; The second quantum key of the cryptographic device and the registration information of the cryptographic device are parsed from the registration response message, including: The second quantum key of the cryptographic device and the cryptographic device identification ID are parsed by calling the first quantum key in the quantum key storage medium.

5. The remote registration method for a password device according to claim 1 or 4, characterized in that: The registration response message also includes: third quantum key information encrypted using the first quantum key; After receiving the registration response message sent by the quantum key management platform, the method further includes: The first quantum key stored in the quantum key storage medium is updated according to the parsed third quantum key information.

6. The remote registration method of a password device according to claim 1, characterized in that: The first quantum key in the quantum key storage medium is distributed by the issuance registration service to the quantum key management platform, and after the quantum key management platform returns a response to the issuance registration service, the issuance registration service and the quantum key management platform synchronize to complete the application of the first quantum key to the quantum key distribution device.

7. A remote registration method for a cryptographic device, characterized in that: Applied to a quantum key management platform, the method comprises: Receiving an encrypted registration application message sent by a cryptographic device; wherein the registration application message is encrypted using a first quantum key, the first quantum key is stored in a quantum key storage medium, and the first quantum key is distributed by a quantum secure communication network, and the first quantum key is synchronously stored in a quantum key management platform; Parsing the registration application message and generating a registration response message; The registration response message is sent to the cryptographic device, so that the cryptographic device parses the second quantum key of the cryptographic device and the registration information of the cryptographic device from the registration response message.

8. The remote registration method of a password device according to claim 7, characterized in that: The generating of the registration response message comprises: After the registration application message is reviewed and approved, a cryptographic device identification ID is assigned to the cryptographic device, and a second quantum key is obtained from a quantum random number generator QRNG; The second quantum key and the cryptographic device identification ID are encrypted using the first quantum key and used as the registration response message; wherein the second quantum key serves as the quantum key of the cryptographic device.

9. The remote registration method for a password device according to claim 7 or 8, characterized in that: The generating of the registration response message comprises: After the registration application message is reviewed and approved, the third quantum key is obtained from the quantum random number generator QRNG; encrypting the third quantum key using the public key of the quantum key storage medium; The encrypted third quantum key is encrypted using the first quantum key and used as the registration response message; wherein the third quantum key is used to update the first quantum key.

10. A remote registration system for a cryptographic device, characterized in that: include: Cryptographic equipment, quantum key management platform and quantum key storage medium; among which, The cryptographic device is used to execute the remote registration method for a cryptographic device according to any one of claims 1 to 6; The quantum key management platform is used to execute the remote registration method of the cryptographic device as described in any one of claims 7 to 9.

Images