Key processing method

Abstract

The invention provides a key processing method, which comprises the following steps: requesting to distribute a quantum key to a quantum security service platform so as to obtain a target quantum key fed back by the quantum security service platform. And taking the target quantum key as an authentication key of the mobile device to call an SIM card of the mobile device to store the target quantum key. According to the invention, the storage security of the authentication key at the mobile equipment side can be provided.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a key processing method. Background Art

[0002] In the field of communication technology, mobile devices need to store authentication keys locally to complete the authorization and authentication process of accessing network nodes.

[0003] In the prior art, such authentication keys are generally pseudo-random keys generated by software implementation, which may be cracked. In addition, the authentication keys are stored in the database, configuration file or registry of the mobile device client, and their security depends on the status of the system environment. With the diversification of usage scenarios, the problems of the system environment have become prominent, which has brought challenges to the security of the authentication keys. Summary of the invention

[0004] The purpose of this application is to provide a key processing method that can improve the security of authentication keys stored on mobile devices.

[0005] In order to achieve the above purpose, the embodiment of the present application is implemented as follows: In a first aspect, a key processing method is provided, comprising: Requesting the quantum security service platform to distribute a quantum key to obtain a target quantum key fed back by the quantum security service platform; The target quantum key is used as the authentication key of the mobile device to call the SIM card of the mobile device to store the target quantum key.

[0006] In the embodiment of the present application, the mobile device applies to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as a local authentication key for subsequent use, so as to call the SIM card for storage, so that in subsequent related applications, the mobile device can retrieve the target quantum key stored in the SIM card to complete the authorization authentication process. Compared with the existing key storage scheme, the target quantum key of the embodiment of the present application has a higher cracking difficulty than the traditional pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0008] Figure 1 This is a schematic diagram of the first flow chart of the key processing method according to an embodiment of the present application.

[0009] Figure 2 A schematic diagram of the architecture of the key processing method according to an embodiment of the present application.

[0010] Figure 3 This is a schematic diagram of the first configuration of the key processing method of an embodiment of the present application.

[0011] Figure 4 This is a schematic diagram of the second configuration of the key processing method of an embodiment of the present application.

[0012] Figure 5 This is a second flow chart of the key processing method according to an embodiment of the present application.

[0013] Figure 6 This is a schematic diagram of the third configuration of the key processing method of an embodiment of the present application.

[0014] Figure 7 A schematic diagram of the structure of a key processing device according to an embodiment of the present application.

[0015] Figure 8 A schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] As mentioned above, in the field of communication technology, mobile devices need to store authentication keys locally to complete the authorization authentication process of accessing network nodes. At present, such authentication keys are generally pseudo-random keys generated by software implementation, which may be cracked. In addition, the authentication keys are stored in the database, configuration file or registry of the mobile device client, and their security depends on the status of the system environment. With the diversification of usage scenarios, the problems of the system environment have become prominent, which brings challenges to the security of the authentication keys.

[0017] In view of this, the present application aims to propose a key processing scheme to improve the security of authentication keys stored on mobile devices.

[0018] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0019] An embodiment of the present application provides a key processing method. Figure 1It is a flowchart of the key processing method, which includes the following steps: S102, requesting the quantum security service platform to distribute the quantum key, so as to obtain the target quantum key fed back by the quantum security service platform.

[0020] In this embodiment, the quantum security service platform is a trusted platform for distributing quantum keys to mobile devices. The quantum key is generated by the quantum security service platform based on true random parameters and is a true random key, which is more difficult to crack than a pseudo-random key.

[0021] In one implementation, a mobile device requests a quantum security service platform to distribute a quantum key to obtain the coding information fed back by the quantum security service platform; wherein the coding information is obtained by the quantum security service platform encoding true random parameters based on multiple intensities of light; the multiple intensities of light include signal state light and weak decoy state light; the signal state light corresponds to the same basis vector (basis vector refers to a vector in the quantum field); the weak decoy state light corresponds to the first basis vector or the second basis vector selected with different probabilities. Next, the mobile device selects the first basis vector or the second basis vector with different probabilities to measure the coding information and obtain the original code. Afterwards, the mobile device selects the target quantum key from the original code according to the basis vector and light intensity selected by the quantum security service platform, as well as the first basis vector or the second basis vector selected and measured locally.

[0022] For ease of understanding, we define the mobile device as Alice and the quantum security service platform as Bob. The specific details of key distribution are as follows: 1. There is a quantum channel (such as optical fiber) and a classical channel between two people, Alice (a mobile device as the receiver) and Bob (a quantum security service platform as the sender).

[0023] 2. Alice generates a string of 01 numbers randomly and encodes them in different intensities with a certain probability. Specifically, they are the three intensities of light: signal state, weak decoy state and vacuum state.

[0024] 3. Asymmetric basis vector selection: ①For the signal state, Alice encodes all states on a basis vector, such as the Z basis vector.

[0025] ② For the weak decoy state, Alice encodes it on the X basis with a certain probability and on the Z basis with a certain probability. Generally speaking, these two probabilities are not the same.

[0026] ③For the vacuum state, Alice does not need to perform encoding.

[0027] Furthermore, Alice sends these coded states to Bob, and Bob chooses to use the X basis vector for measurement with a certain probability and the Z basis vector for measurement with a certain probability.

[0028] 4. Alice and Bob perform post-processing to obtain the final target quantum key from the original quantum key. Specifically, the following steps are included: ① Alice and Bob publish their own basis vectors for encoding and measurement. Alice also publishes the intensity of the light she chooses for encoding, and screens and post-processes the original code. Only when they choose the same basis for encoding and measurement, Alice and Bob get the screened key from the original code.

[0029] ② Alice and Bob use error correction steps to ensure that their keys are exactly the same. They estimate the maximum amount of information that the other party can obtain. They then use the confidentiality amplification method to obtain the final security key.

[0030] In this embodiment, Alice and Bob asymmetrically select the basis vectors for preparation and measurement, thereby achieving the purpose of simplifying the system and improving the coding rate. In addition, selecting the light of the decoy state of the asymmetric basis vector for encoding can improve the coding rate while ensuring security.

[0031] S104, using the target quantum key as the authentication key of the mobile device to call the SIM card of the mobile device to store the target quantum key.

[0032] Specifically, this step can create a quantum key management application, which is configured with an application protocol data unit (APDU) protocol for interacting with the SIM card. Afterwards, a command is issued to the SIM card through the quantum key management application to call the SIM card of the mobile device to store the target quantum key.

[0033] In one implementation, the SIM card stores the quantum key by creating a container. To this end, a command can be issued to the SIM card through the quantum key management application to call the SIM card to execute: 1) Create the target container locally; 2) configuring parameter information for the target container; wherein the parameter information includes: at least one of a container ID, a container name, a quantum key type, and a quantum key storage space; the quantum key type includes at least one of a user key, a device key, an application key, and a session key.

[0034] 3) Configure access permissions for the target container that match the quantum key type (optional); for example, the quantum key device key is of high importance and can only be retrieved by applications that require higher access permissions.

[0035] 4) Store the target quantum key in the target container.

[0036] It should be noted that the number of quantum keys that can be stored in a SIM card is not limited to one, and for this purpose a corresponding container can be configured for each quantum key.

[0037] In actual applications, when executing the authorization and authentication process, the mobile device can retrieve the target quantum key stored in the SIM card to complete the authorization and authentication process. Specifically, the execution subject of the authorization and authentication process using the quantum key can be the application installed on the mobile device side. Since the quantum key and the number of quantum keys used by each application are different, further storage settings can be made for each application in the configuration area of ​​the SIM card in advance, such as: the maximum number of containers supported by the SIM card, the maximum storage space of each container, the maximum number of applications supported by the mobile device, the maximum storage space of each application, and the number of containers allowed to be created under each application.

[0038] In summary, in the method of this embodiment, the mobile device applies to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as a local authentication key for subsequent use, so as to call the SIM card for storage, so that in subsequent related applications, the mobile device can retrieve the target quantum key stored in the SIM card to complete the authorization authentication process. Compared with the existing key storage scheme, the target quantum key of this embodiment has a higher cracking difficulty than the traditional pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen.

[0039] The method of this embodiment is introduced below in combination with actual application scenarios.

[0040] This application scenario uses a zero-trust security architecture based on software-defined perimeter (SDP). SDP is a policy-based security boundary that isolates services from insecure networks. SDP requires endpoints to be authenticated and authorized before network access to protected servers is obtained.

[0041] Under the above zero-trust security architecture, the SDP client of a traditional mobile device needs to interact with the control center in the SDP gateway through a public key before establishing a connection with the SDP gateway. During this process, the SDP client will obtain a private key from the control center of the SDP gateway. Afterwards, the SDP client will use this private key for authorization and authentication, and finally establish a secure connection with the SDP gateway. This mechanism design can improve the security of network communications, enabling the SDP zero-trust security architecture to better cope with the current complex and ever-changing network security threats.

[0042] In the traditional solution, the control center in the SDP gateway uses the relevant device identification to randomly generate keys through soft implementation, and uses the common end-side storage method to store the keys in the client's database, configuration file or registry, and uses soft encryption and decryption technology to ensure the security of key storage and use. Strictly speaking, the keys generated by soft implementation are pseudo-random and may be cracked. In addition, in the case of complex operating system usage environments, the end-side storage method has great risks and is prone to key leakage.

[0043] To address the above issues, this application scenario uses SIM card-based quantum key storage technology, using the hardware-level key storage capabilities of SIM cards (especially super SIM cards) to provide a secure and reliable storage space for quantum keys. At the same time, combined with the computing power of the built-in security chip of the SIM card, encryption measures are implemented for the quantum key through SIM card application technology, thereby ensuring the secure storage of the quantum key. This application scenario not only solves the security risks of traditional end-side storage methods, but also improves the security and reliability of the SDP software-defined boundary architecture.

[0044] The implementation details of this application scenario are introduced below.

[0045] 1. Overall architecture of application scenarios Figure 2 This is a schematic diagram of the overall architecture of this application scenario, including: quantum security service platform, quantum key management application, SDP client, and SDP gateway.

[0046] Quantum Security Service Platform: The quantum security service platform injects quantum keys into quantum key management applications through the quantum key distribution protocol.

[0047] Quantum key management application: The quantum key management application is a SIM card application used to store, read and maintain quantum keys, and interact with the SDP client to realize functions such as storage and use of quantum keys.

[0048] SDP client: The SDP client is used to connect the quantum key management application and the quantum security service platform, and is the data "transfer station" between the quantum key management application and the quantum security service platform.

[0049] SDP Gateway: SDP Gateway is a network border access control device that uses quantum keys to implement functions such as authorization and authentication of data packets.

[0050] 2. Storage structure of application scenarios and quantum key management applications This application scenario specially designs a storage structure for SIM applications for quantum key storage, and creates a customized quantum key management application to realize the interaction between the SIM card and the SDP client, thereby realizing related business functions.

[0051] Specifically, firstly, the global configuration area of ​​the device is designed. Figure 3 It is a schematic diagram of the device's global configuration area. The relevant parameters configured in the device's global configuration area include: the maximum number of containers supported by the device, the maximum storage space for each container, the maximum number of applications supported by the device, the maximum storage space for each application, the number of containers allowed to be created for each application, etc., as well as other commonly used authentication required device authentication keys and personal identification number (PIN) keys.

[0052] At the same time, a custom SIM card application is created and related resources are allocated to the SIM card application; as mentioned above, in order to realize the exchange between the SDP client and the SIM card and complete the storage, reading, encryption and decryption operations of the quantum key, this application scenario creates a custom quantum key management application and allocates related resources to the application. Figure 4 It is a schematic diagram of a quantum key management application. The relevant parameters configured in the quantum key management application include: application ID, application name, quantum container object array, etc.

[0053] 3. Implementation process of application scenarios In this application scenario, the SDP client obtains the quantum key generated by the quantum security service platform, sends it to the quantum key management application through the quantum key distribution mechanism, and requests the quantum key management application to encrypt and store the quantum key. The corresponding process is as follows: Figure 5 As shown, the following steps are included: S1: The SDP client connects to the quantum security service platform, which generates a quantum key and sends it to the SDP client through the quantum key distribution mechanism.

[0054] Among them, the quantum key distribution mechanism can be referred to the previous introduction and will not be repeated here.

[0055] S2: The SDP client obtains the quantum key generated by the quantum security service platform and customizes the APDU to send the quantum key storage command to the SIM card.

[0056] In this step, the SDP client defines a unique reporting command and data format according to the ISO7816-4 specification, and reports relevant identity information to the SIM through the APDU protocol. After the SDP client receives the quantum key from the quantum security service platform, it sends commands to the SIM card according to the APDU protocol and the custom SIM card application interface and custom command format.

[0057] Specifically, after receiving the quantum key, the SDP client calls the quantum key management application to store the quantum key in the container storage of the SIM card.

[0058] First, the quantum key management application creates a container storage and allocates Figure 6 The related resources shown are as follows: container ID, container name, quantum key type, quantum key storage space, etc. Secondly, the quantum key management application calls the SIM card storage capability to store quantum keys of different quantum key types in different quantum containers of the SIM card.

[0059] Among them, the storage space structure of the quantum key can be designed according to different quantum key types, as shown in Table 1:

[0060] Table 1 It should be noted that for different quantum key types, matching application access rights can be further configured; for example, the quantum key device key is more important and can only be retrieved by applications with higher access rights.

[0061] S3: After receiving the command sent by the SDP client, the SIM card analyzes and executes the command.

[0062] Specifically, after receiving the instruction sent by the SDP client, the SIM card analyzes and obtains the card application (quantum key management application) to be called, the encryption method for cryptographic operations on the quantum key, the index where the key is located, etc. The quantum key management application first calls the cryptographic operation capability of the SIM card to encrypt the seed, and then the quantum key management application creates a file to store the quantum key data, and assigns the user's read permission to the storage file. After the SIM card executes successfully, it feeds back to the SDP client information such as the status code of the quantum key, the file name of the file to which it belongs, and the index of the file to which it belongs, so that the SDP client can determine the storage result corresponding to the quantum key.

[0063] The above is a relevant introduction to the quantum key used by the SDP client for authorization and authentication stored in the SIM card. In addition to the quantum key used by the SDP client for authorization and authentication, the SIM card of this embodiment can also store the quantum key used by other application clients for authorization and authentication, or the quantum key used by other application clients for data encryption. Regardless of the purpose of the quantum key, it can play a role in improving security.

[0064] Corresponds to Figure 1 The method shown, another embodiment of the present application provides a key processing device. Figure 7 : is a schematic diagram of the structure of the key processing device 700, comprising: The key application module 710 requests the quantum security service platform to distribute the quantum key, so as to obtain the target quantum key fed back by the quantum security service platform.

[0065] In this embodiment, the quantum security service platform is a trusted platform for distributing quantum keys to mobile devices. The quantum key is generated by the quantum security service platform based on true random parameters and is a true random key, which is more difficult to crack than the traditional pseudo-random key.

[0066] The key storage module 720 uses the target quantum key as the authentication key of the mobile device to call the SIM card of the mobile device to store the target quantum key.

[0067] In the device of this embodiment, the mobile device applies to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as a local authentication key for subsequent use, so as to call the SIM card for storage. In subsequent related applications, the mobile device can retrieve the target quantum key stored in the SIM card to complete the authorization authentication process. Compared with the existing key storage scheme, the target quantum key of the device of this embodiment has a higher cracking difficulty than the traditional pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen.

[0068] Optionally, the key storage module 720 calls the SIM card of the mobile device to store the target quantum key, including: issuing a command to the SIM card based on a quantum key management application to call the SIM card of the mobile device to store the target quantum key; wherein the quantum key management application is configured with an application protocol data unit APDU protocol for interacting with the SIM card.

[0069] Optionally, the key storage module 720 issues a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to store the target quantum key, including: issuing a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to locally create a target container, and storing the target quantum key in the target container.

[0070] Optionally, after the key storage module 720 issues a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to locally create a target container, it further executes: calling the SIM card of the mobile device based on the quantum key management application to configure parameter information for the target container, wherein the parameter information includes at least one of a container ID, a container name, a quantum key type, and a quantum key storage space.

[0071] Optionally, the quantum key type includes at least one of a user key, a device key, an application key and a session key.

[0072] Optionally, after the key storage module 720 issues a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to store the target quantum key in the target container, it further executes: based on the quantum key management application, calling the SIM card of the mobile device to configure access rights matching the quantum key type for the target container.

[0073] Optionally, the key processing device of this embodiment further includes: The authentication execution module, after the key storage module 720 calls the SIM card of the mobile device to store the target quantum key, executes: when the mobile device executes the authorization authentication process, the target quantum key stored in the SIM card is retrieved to complete the authorization authentication process.

[0074] Optionally, the mobile device is provided with a software-defined boundary SDP client, and the authorization and authentication process is required by the SDP client to be executed by the SDP gateway after receiving a connection request initiated by the SDP client.

[0075] Optionally, the key application module 710 requests the quantum security service platform to distribute a quantum key to obtain a target quantum key fed back by the quantum security service platform, including: requesting the quantum security service platform to distribute a quantum key to obtain coding information fed back by the quantum security service platform; wherein the coding information is obtained by encoding true random parameters based on light of multiple intensities; the multiple intensities of light include light in a signal state and light in a weak decoy state; the light in the signal state corresponds to the same basis vector; the light in the weak decoy state corresponds to a first basis vector or a second basis vector selected with different probabilities; measuring the coding information under the first basis vector or the second basis vector with different probabilities to obtain an original code; and screening the target quantum key from the original code according to the basis vector corresponding to the coding information and the intensity of light, and the first basis vector or the second basis vector selected locally for measurement.

[0076] Optionally, after calling the SIM card of the mobile device to store the target quantum key, the key storage module 720 further executes: receiving a status code of the target quantum key, a file name of the belonging file, and an index of the belonging file fed back by the SIM storage to determine a storage result corresponding to the target quantum key.

[0077] It should be noted that the key processing device of this embodiment can be used as Figure 1 The execution subject of the method shown can thus realize Figure 1 The steps and functions in the method shown are not repeated here.

[0078] Figure 8 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 8 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.

[0079] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0080] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.

[0081] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming the above-mentioned image transmission device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations: Requesting the quantum security service platform to distribute a quantum key to obtain a target quantum key fed back by the quantum security service platform, wherein the target quantum key is generated based on a true random parameter.

[0082] The target quantum key is used as the authentication key of the mobile device to call the SIM card of the mobile device to store the target quantum key.

[0083] In the electronic device of this embodiment, the mobile device applies to the quantum security service platform for a target quantum key generated based on true random parameters, and uses the target quantum key as a local authentication key for subsequent use, so as to call the SIM card for storage, so that in subsequent related applications, the mobile device can retrieve the target quantum key stored in the SIM card to complete the authorization authentication process. Compared with the existing key storage scheme, the target quantum key of the electronic device of this embodiment has a higher cracking difficulty than the traditional pseudo-random key; in addition, the target quantum key is stored in the SIM card, and its security does not depend on the system environment of the mobile device, so it is more difficult to be stolen.

[0084] The above application Figure 1The method disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in one or more embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in combination with one or more embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0085] Of course, in addition to software implementation methods, the electronic device of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0086] The present application also provides a computer program product, which includes a computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the following operations: Determine the identity information of the target user in the target image.

[0087] Based on the identity information of the target user, a privacy requirement opinion for disseminating the target image is obtained from the target user.

[0088] A privacy protection process matching the privacy requirement opinion is performed on the area of ​​the target user in the target image.

[0089] The target image after the privacy protection process is performed is propagated.

[0090] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of the present application shall be included in the protection scope of one or more embodiments of the present application.

[0091] The systems, devices, and modules described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0092] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0094] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A key processing method, applied to a mobile device, characterized in that: include: Requesting the quantum security service platform to distribute a quantum key to obtain a target quantum key fed back by the quantum security service platform; The target quantum key is used as the authentication key of the mobile device to call the SIM card of the mobile device to store the target quantum key.

2. The method according to claim 1, characterized in that: Calling the SIM card of the mobile device to store the target quantum key includes: Based on the quantum key management application, a command is issued to the SIM card to call the SIM card of the mobile device to store the target quantum key; wherein the quantum key management application is configured with an application protocol data unit APDU protocol for interacting with the SIM card.

3. The method according to claim 2, characterized in that The method includes issuing a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to store the target quantum key, including: Based on the quantum key management application, a command is issued to the SIM card to call the SIM card of the mobile device to locally create a target container, and store the target quantum key in the target container.

4. The method according to claim 2, characterized in that: After issuing a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to locally create a target container, the method further includes: The SIM card of the mobile device is called based on the quantum key management application to configure parameter information for the target container, where the parameter information includes at least one of a container ID, a container name, a quantum key type, and a quantum key storage space.

5. The method according to claim 4, characterized in that The quantum key type includes at least one of a user key, a device key, an application key, and a session key.

6. The method according to claim 5, characterized in that After issuing a command to the SIM card based on the quantum key management application to call the SIM card of the mobile device to locally create a target container, the method further includes: Based on the quantum key management application, the SIM card of the mobile device is called to configure access rights matching the quantum key type for the target container.

7. The method according to claim 1, characterized in that After calling the SIM card of the mobile device to store the target quantum key, the method further includes: When the mobile device executes the authorization and authentication process, the target quantum key stored in the SIM card is retrieved to complete the authorization and authentication process.

8. The method according to claim 7, characterized in that The mobile device is provided with a software defined boundary SDP client, and the authorization and authentication process is that the SDP gateway requires the SDP client to execute after receiving a connection request initiated by the SDP client.

9. The method according to claim 1, characterized in that: Requesting the quantum security service platform to distribute a quantum key to obtain a target quantum key fed back by the quantum security service platform includes: Requesting the quantum security service platform to distribute a quantum key to obtain the coding information fed back by the quantum security service platform; wherein the coding information is obtained by encoding a true random parameter based on light of multiple intensities; the light of multiple intensities includes light in a signal state and light in a weak decoy state; the light in the signal state corresponds to the same basis vector; the light in the weak decoy state corresponds to a first basis vector or a second basis vector selected with different probabilities; Selecting to measure the coded information under the first basis vector or the second basis vector with different probabilities respectively to obtain an original code; A target quantum key is selected from the original code according to the basis vector corresponding to the encoded information and the intensity of light, as well as the first basis vector or the second basis vector selected and measured locally.

10. The method according to claim 1, characterized in that After calling the SIM card of the mobile device to store the target quantum key, the method further includes: Receive the status code of the target quantum key, the file name of the belonging file and the index of the belonging file fed back by the SIM card to determine the storage result corresponding to the target quantum key.

Images