Secure communication method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the field of network communication security, and discloses a secure communication method and system, electronic equipment and a storage medium. In the invention, based on a quantum key distribution technology, an authentication request is initiated to a site through quantum key data acquired from a quantum key service system, or bidirectional authentication with the site and session key negotiation are performed in response to the authentication request initiated by the site through the quantum key data acquired from the quantum key service system; and obtaining a session key used when the access point and the site carry out encryption communication through the quantum key data. A quantum key distribution technology is adopted for key exchange between an access point and a site, and session key negotiation is completed in an access authentication stage. Bidirectional authentication, key negotiation and data encryption protection based on quantum key distribution between the access point and the site are realized. And the overall safety performance is greatly improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network communication security, and in particular to a secure communication method, system, electronic device and storage medium. Background Art

[0002] Wireless Local Area Networks (WLAN) are networks that use radio waves to connect devices in a local area. Wi-Fi is one of the wireless LAN technology standards that is widely used in homes, businesses, and public places. AP and STA refer to two types of devices in a wireless network: AP (Access Point): An access point is a network device that allows wireless devices to connect to a wired network or other networks. In AP mode, as an access node of a wireless network, other devices can connect to the AP to access network resources. STA (Station): A station refers to a wireless device (such as a laptop, smartphone, tablet, etc.) that connects to a wireless network as a client. It can be any terminal device in a wireless network that connects to an AP via WiFi to access the network.

[0003] Existing security protocols mainly focus on access authentication and communication encryption. Wi-Fi security protocols include WEP (Wired Equivalent Privacy), WPA (Wi-Fi Protected Access), WPA2, IEEE802.11i (WPA3), etc.

[0004] The inventors found that there are at least the following problems in the related technology: insufficient strength when based on password authentication, untimely password update, authentication and key exchange protocols based on public key algorithms, etc. This makes the encrypted communication process face security risks and brute force cracking risks against quantum computing threats, resulting in its security level not meeting the standards, and is only suitable for personal or enterprise-level applications, but not for the use requirements of wireless LAN users with higher security requirements. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a secure communication method, system, electronic device and storage medium, so that encrypted communication authentication and session key generation are performed through quantum random number source and quantum key distribution technology, so as to realize two-way authentication, key negotiation and data encryption protection between STA and AP based on quantum key distribution, thereby greatly improving the overall security performance.

[0006] To solve the above technical problems, an embodiment of the present invention provides a secure communication method, including: based on quantum key distribution technology, initiating an authentication request to a site through quantum key data obtained from a quantum key service system, or responding to an authentication request initiated by the site through quantum key data obtained from a quantum key service system, performing two-way authentication with the site and negotiating a session key; obtaining a session key used by an access point for encrypted communication with the site through quantum key data.

[0007] An embodiment of the present invention also provides a secure communication system, comprising: a quantum key service system, one or more access points, and one or more sites; the quantum key service system is used to distribute quantum key data to the access points and sites; the access point is used to initiate an authentication request to the site based on the quantum key distribution technology by using the quantum key data obtained from the quantum key service system, or respond to the authentication request initiated by the site using the quantum key data obtained from the quantum key service system, and perform two-way authentication and session key negotiation with the site; the site is used to initiate an authentication request to the access point based on the quantum key distribution technology by using the quantum key data obtained from the quantum key service system, or respond to the authentication request initiated by the access point using the quantum key data obtained from the quantum key service system, and perform two-way authentication with the site; the access point or the site will obtain the session key used by the access point and the site for encrypted communication through the quantum key data.

[0008] An embodiment of the present invention also provides an electronic device, comprising: at least one processor; and a memory, a communication unit, and a cryptographic processing unit that are communicatively connected to the at least one processor; wherein the communication unit is used to send or receive data, the cryptographic processing unit is used for cryptographic operations and key management, and the memory stores instructions that can be executed by at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned secure communication method.

[0009] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned secure communication method when executed by a processor.

[0010] In the embodiment of the present invention, based on the quantum key distribution technology, an authentication request is initiated to the site through the quantum key data obtained from the quantum key service system, or the authentication request initiated by the site through the quantum key data obtained from the quantum key service system is responded to, and two-way authentication and session key negotiation are performed with the site; the session key used for encrypted communication between the access point and the site is obtained through the quantum key data. The domestic cryptographic technology, quantum random number source, and quantum key distribution technology are mainly adopted to improve the localization of the algorithm and the random quality of the quantum key. The quantum key distribution technology is used for the key exchange between STA and AP, and the session key key negotiation is completed in the access authentication stage. Two-way authentication, key negotiation and data encryption protection based on quantum key distribution are realized between STA and AP. The overall security performance is greatly improved.

[0011] In addition, the main security system in the quantum key service system is connected to multiple access points and connected to the quantum key distribution network, and the slave security system in the quantum key service system is connected to multiple sites and connected to the quantum key distribution network; based on the enhanced authentication method of the out-of-band quantum key service system, the STA accesses the AP, or the AP authenticates the STA, because of the trust in the quantum key service system, the identity of the AP and the STA has stronger credibility.

[0012] In addition, the quantum key service system will ensure the data consistency of quantum key data assigned to one or more groups of access points and one or more groups of sites through configuration information. When acquiring quantum keys, multiple groups will be connected to the QKDN network respectively, and the structure of accessing the quantum network such as master / slave configuration and distributed multi-node configuration can be realized, so as to ensure the consistency of the distributed session keys when providing out-of-band authentication support and negotiation and distribution of session keys for different APs and STAs.

[0013] In addition, the session key used for encrypted communication between the access point and the station is obtained through the quantum key data, including: when the quantum key is included in the quantum key data, the quantum key is directly selected as the session key; when the quantum key data does not contain the quantum key, the random entropy source enhanced session key is formed through the quantum key data according to the two-way authentication and key exchange protocol; or, when the quantum key data does not contain the quantum key, the random entropy source enhanced session key is directly obtained from the quantum key service system through the quantum key data. The distributed random numbers or keys are used to participate in the access process of the AP and STA with relatively dispersed distribution, and the negotiated distribution of the session key is realized. While ensuring high-quality random numbers, a new key distribution method with theoretical security is provided for the distribution of key resources that need to be synchronized in a wide area.

[0014] In addition, after obtaining the session key through quantum key data, the data transmitted over the wireless link is encrypted transparently at the network layer or through the encryption provided by the interface through the session key; it is monitored through the preset self-maintenance strategy, and the session key is periodically updated when the preset update conditions are met. The method of one access and one session key negotiation is adopted, and the authentication and session key negotiation of STA and AP are ensured to have a certain timeliness. Strategies such as scheduled update and update according to application needs can be enabled.

[0015] In addition, two-way authentication uses symmetric cryptographic algorithms, and message integrity verification in two-way authentication or encrypted communication uses keyed hash operations or symmetric cryptographic algorithms to construct message authentication codes, and encrypted communications use symmetric cryptographic algorithms or sequence cryptographic algorithms. Through symmetric cryptographic algorithms, HMAC (Hash-Based Message Authentication Code), or optional post-quantum cryptographic algorithms for authentication, key negotiation and distribution, encryption, and message integrity protection, combined with quantum key distribution technology, the overall ability of related security protocols to resist brute force cracking and quantum computing attack threats is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0017] Figure 1 is a flow chart of a secure communication method provided according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of the connection relationship between a quantum key service system and a device provided according to an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of the composition of an access point encryption module provided according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of the composition of a site encryption module provided according to an embodiment of the present invention;

[0021] Figure 5 is a flow chart of an authentication and key agreement interaction method provided according to an embodiment of the present invention;

[0022] Figure 6 is a schematic structural diagram of a secure communication system according to another embodiment of the present invention;

[0023] Figure 7It is a schematic structural diagram of an electronic device according to another embodiment of the present invention. DETAILED DESCRIPTION

[0024] To make the purpose, technical scheme and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present invention, many technical details are proposed in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented. The division of the following embodiments is for the convenience of description, and should not constitute any limitation on the specific implementation of the present invention. The various embodiments can be combined and referenced with each other without contradiction.

[0025] An embodiment of the present invention relates to a secure communication method, which can be applied to an access point device of a wireless communication network, such as a computer, a wireless router, and other network devices that allow wireless devices to connect to a wired network or other networks. In this embodiment, based on quantum key distribution technology, an authentication request is initiated to a site through quantum key data obtained from a quantum key service system, or an authentication request initiated by a site through quantum key data obtained from a quantum key service system is responded to, and two-way authentication and session key negotiation are performed with the site; the session key used when the access point and the site perform encrypted communication is obtained through quantum key data. The domestic cryptographic technology, quantum random number source, and quantum key distribution technology are mainly used to improve the localization of the algorithm and the random quality of the quantum key, and the quantum key distribution technology is used for the key exchange between STA and AP, and the key negotiation of the session key is completed in the access authentication stage. Two-way authentication, key negotiation and data encryption protection based on quantum key distribution are realized between STA and AP. The overall security performance is greatly improved. The implementation details of the secure communication method of this embodiment are described in detail below. The following content is only the implementation details provided for the convenience of understanding, and is not necessary for the implementation of this solution.

[0026] like Figure 1As shown, in step 101, the access point initiates an authentication request to the station based on the quantum key distribution technology by using the quantum key data obtained from the quantum key service system, or responds to the authentication request initiated by the station through the quantum key data obtained from the quantum key service system, and performs two-way authentication and session key negotiation with the station. Due to the application of quantum key distribution technology in wireless local area network (Wireless Local Area Network, referred to as WLAN) wireless communication systems, the potential security threat of quantum computing to public key algorithms is reduced, so it has the ability to enhance the secure communication capabilities of AP and STA in WLAN. Based on the enhanced authentication method of the out-of-band quantum key service system, the access of STA to AP, or the authentication of STA by AP, has a stronger credibility for the identity of AP and STA due to the trust in the quantum key service system.

[0027] There are various types of quantum key service systems, and any quantum key service system can realize the distribution of quantum key data. In one example, the main security system in the quantum key service system is connected to multiple access points and connected to the quantum key distribution network, and the slave security system in the quantum key service system is connected to multiple sites and connected to the quantum key distribution network. In order to facilitate the understanding of the content of this application, a quantum key service system will be taken as one of the execution carriers of this method, and the secure communication method will be specifically described, such as Figure 2As shown, in this example, the business system mainly performs business processing such as user service management, and each specific server device (such as mobile user management unit, business processing unit, mobile storage unit) performs secure internal data communication through the Transmission Control Protocol / Internet Protocol (TCP / IP for short). The business system communicates with the quantum key server (or a system composed of multiple servers connected) in the security service (main) part (i.e., the main security system) through the intranet. The security service (main) part can rely on the quantum key server and quantum key distribution network (Quantum Key Distribution Network) connected through TCP / IP. The quantum key server and quantum key distribution network access device (QKDN) can be used to perform end-to-end real-time quantum key negotiation and distribution for the AP side, and can also provide quantum random numbers for any AP on the AP side (such as access point 1, access point 2, and access point 3). The security service (slave) part (i.e., the slave security system) can rely on the quantum key server and quantum key distribution network access device connected via TCP / IP to perform end-to-end real-time quantum key negotiation and distribution for the STA side, and can also provide quantum random numbers for any STA on the STA side (such as station 11, station 21, station 22, and station 31). Under the connection of the operator's fixed network / wireless network, the access point and its corresponding affiliated stations (such as access point 1 and its affiliated station 11, access point 2 and its affiliated stations 21 and station 22, access point 3 and its affiliated station 31) can achieve secure authentication and subsequent encrypted communication. STA and AP have main capabilities and extension capabilities in terms of roles. The main capability is that AP is often manifested as an access device or access gateway such as wireless router, WiFi, etc. It can be extended to support limited fixed networks or mobile networks to achieve connection with other business systems or Internet networks. STAs are often used as terminals, such as computers, laptops, smart terminals, tablet computers, webcams, etc. They can access APs through the WiFi signals provided by APs, thereby obtaining business systems or related services on the Internet. When necessary, STAs can access APs and also serve as hotspots to expand their own network access, thereby providing mobile network or wireless fidelity (Wi-Fi) extended access services for STAs that have no access signals or fail to access APs (for example, the signal is not covered, or the AP access capacity is close to the upper limit).In general, this connection structure can be based on quantum key distribution technology and connected to the QKDN network through a quantum key service system. It can provide STA and AP with quantum keys distributed through online negotiation as session keys, realize encrypted communication between STA and AP based on session keys, and support regular or on-demand updates of quantum keys. Encrypted communication can encrypt and decrypt transmitted data, protect integrity, and resist replay.

[0028] In one example, when a STA accesses an AP, the STA will use the STA encryption module to perform access authentication and encryption and decryption processing on the AP. The STA encryption module accepts the online management of the quantum key service system. After receiving the quantum key statically or dynamically, it will encrypt and store it on the local cryptographic module or use it in real time in the secure memory. Among them, the AP encryption component module is as follows Figure 3 As shown, the AP encryption module includes a cryptographic calculation layer and an interface layer. The cryptographic calculation layer consists of encryption and decryption algorithms, key negotiation algorithms, key storage and use, authentication and security management. The interface layer is responsible for providing interface support for the host's AP device. Including but not limited to the system adaptation interface, which is interface-adapted with the system's basic hardware and software environment; the cryptographic service interface provides interfaces such as encryption and decryption processing and message authentication for applications; the key management interface mainly implements the interface with the quantum key management or service system (QKMS for short). Generally, when used for the first time, the interface is responsible for registering in QKMS and obtaining the initialized key; when applied, the interface is responsible for negotiating with the communication partner (such as another STA or AP) through QKMS to obtain the quantum key. Multi-task management is mainly because when obtaining quantum keys, the quantum key service system will be connected to the QKDN network by multiple groups. In order to respond to the quantum service system, multi-task management is required for business processing. When different APs and STAs perform out-of-band authentication support and negotiate and distribute session keys, the consistency of session keys is ensured.

[0029] The STA encryption module also includes a cryptographic calculation layer and an interface layer, such as Figure 4 As shown in the figure, the cryptographic computing layer consists of encryption and decryption algorithms, key negotiation algorithms, key storage and use, authentication and security management. The interface layer is responsible for providing interface support for the host's STA devices. Including but not limited to system adaptation interface, cryptographic service interface, key management interface.

[0030] In one example, the quantum key service system will ensure the data consistency of quantum key data assigned to one or more groups of access points and the data consistency of quantum key data assigned to one or more groups of sites through preset configuration information. For example: when the quantum key service system is acquiring quantum keys, multiple groups can be connected to QKDN separately, and the structure of accessing the quantum network such as master / slave configuration and distributed multi-node configuration can be realized, so as to ensure the consistency of the distributed session keys when providing out-of-band authentication support and negotiation and distribution of session keys for different APs and STAs. The consistency requirement of key data assigned to multiple groups of access points or sites usually appears more in broadcast communication services between sites and access points. The consistency requirement of key data assigned to a group of access points or sites usually appears more in point-to-point communication services between sites and access points.

[0031] The keys used by AP and STA can be divided into five categories according to their purpose: authentication key, key negotiation encryption key, online distributed quantum key, preset or distributed quantum random number, and storage protection key. (1) Authentication key: mainly used for identity authentication during mutual authentication between AP and STA. (2) Key negotiation encryption key: mainly used for encryption key, HMAC key, etc. that may be used in the negotiation process of session key between AP and STA. (3) Quantum key: real-time negotiation and distribution will be achieved by connecting the quantum key distribution (QKD) system or QKD network with the corresponding quantum key service system. The distributed quantum key will be temporarily stored in the encryption module of AP and STA. (4) Quantum random number: quantum random number can be generated from QKD system, QKD network or QRNG. The distributed quantum random number will provide random number, random entropy source enhancement, etc. in the process of authentication or encryption communication protocol. (5) Storage protection key: used for storage encryption of local cryptographic resources of AP and STA encryption module. Quantum key data can be one of the following or any combination thereof: quantum key, quantum random number, authentication key, key negotiation encryption key, storage protection key.

[0032] The richer the quantum key data, the more options there are for encrypted communication, but the corresponding encryption can be achieved with just one option. In one example, there are several situations in which the session key used for encrypted communication between the access point and the station is obtained through quantum key data: In the first case, when the quantum key data contains the quantum key, the quantum key is directly selected as the session key; this method is the most convenient in that the quantum key service system completes the key generation and corresponding distribution. In the second case, when the quantum key data does not contain the quantum key, the random entropy source enhanced session key will be formed through the quantum key data according to the two-way authentication and key exchange protocol, and the distributed random number or key will be used to participate in the access process of the dispersed AP and STA using quantum random numbers or quantum key distribution technology to achieve the negotiation and distribution of the session key. While ensuring high-quality random numbers, it provides a theoretically secure new key distribution method for the distribution of key resources that need to be synchronized in the wide area; in the third case, when the quantum key data does not contain the quantum key, the random entropy source enhanced session key is directly obtained from the quantum key service system through the quantum key data. The final random entropy source enhanced session key is formed by XORing the session key generated by the two-way authentication and key exchange protocol with the quantum key distributed in real time. The session key will be used to complete the encrypted communication of the wireless WLAN through its in-band negotiation and out-of-band random enhancement, and to perform certain error correction coding on the wirelessly transmitted data and other communication information. The application of quantum random numbers and quantum key distribution technology for out-of-band key negotiation in the WLAN wireless communication system adds the random entropy source of quantum physics technology to the authentication and key exchange protocol between STA and AP, and reduces the potential security threat of quantum computing to the public key algorithm. Therefore, it has the ability to enhance the secure communication capability of AP and STA in WLAN. It also has logical adaptability to the extended communication of STA as a hotspot for collective connection.

[0033] In step 102, the access point obtains the session key used for encrypted communication between the access point and the station through the quantum key data. That is, after the STA and the AP pass the two-way authentication, the session key (several) generated based on the data in the quantum key distribution negotiation process can be used for network layer encryption communication or application layer encryption communication of the data transmitted on the wireless link.

[0034] In one example, after obtaining the session key through quantum key data, the data transmitted over the wireless link is encrypted transparently at the network layer or through the encryption provided by the interface through the session key; it is monitored through a preset self-maintenance strategy, and the session key is periodically updated when the preset update conditions are met. Specifically: the communicating parties can use the established secure communication context and session key (the session key can be a group of keys for different purposes) to carry out subsequent secure communications. Secure communications can use network layer encryption or application layer encryption, and ensure the confidentiality, integrity, and anti-replay of data during transmission. At the same time, ensure that the session key is updated on demand or regularly.

[0035] In one example, a symmetric encryption algorithm is used for two-way authentication, and message integrity verification in two-way authentication or encrypted communication is implemented by constructing a message authentication code using a keyed hash operation or a symmetric encryption algorithm. Encrypted communication uses a symmetric encryption algorithm or a sequence encryption algorithm. For example: a symmetric encryption algorithm is used to establish two-way authentication between AP and STA, and to conduct a session key negotiation interaction protocol such as Figure 5 As shown, the session key in this example is the session key directly provided by the quantum key service system, and is also the quantum key in the authentication process. This example is only used as an example to illustrate the two-way authentication process, rather than to limit the two-way authentication process.

[0036] The following will be Figure 5 The authentication process shown in FIG. 1 is described as follows: the station side (STA) collects and encrypts station data, obtains IKA-encrypted RB, assembled ID, and MAC (where MAC is the abbreviation of the message integrity check code, and the numbers in the following names such as MAC2 and MAC3 are to distinguish different message integrity check codes. They are named according to the order of their appearance and have no special meaning) and sends them to the AP. Specifically: the STA collects the random number RB, encrypts the RB with the authentication key IKA, and then assembles the STA's unique identifier IB, assembles the IDs and message sequence numbers of the authentication key, encryption key, HMAC key, etc. used, and calculates the MAC for the connected authentication data with the HMAC_B key (HMAC is the abbreviation of the key-related hash operation message authentication code). The IKA-encrypted RB, assembled ID, and MAC are sent to the AP.

[0037] After receiving the data, the access point side collects, encrypts and authenticates the access point data. Specifically: AP collects random number RA, concatenates RA, AP's unique identifier IA, IKA-encrypted RB, assembled ID, MAC, and uses the HMAC_A key to calculate MAC2 for the authentication data of the connection. Then, RA, AP's unique identifier IA, IKA-encrypted RB, assembled ID, MAC, and MAC2 are sent to the quantum key service system.

[0038] After receiving the data, the quantum key service system performs data authentication and obtains the session key (quantum key). Specifically: the quantum key service system verifies MAC and MAC2 according to the HMAC keys (HMAC_B and HMAC_A) corresponding to IB and IA respectively. If the verification is passed, it will continue, otherwise it will exit. If it continues, it will decrypt RB and the message sequence number according to IB and the authentication key ID to confirm the uniqueness of the sequence number. If the message sequence number is repeated (not unique), it will report an error and exit; otherwise, it will then obtain the session key K_AB (several), encrypt RB, K_AB, and IA with IAK, and use HMAC_A to calculate MAC3.

[0039] The quantum key service system returns a token Token_TA to the AP, which includes IAK-encrypted (RB, RA, K_AB, IB) and MAC3.

[0040] AP performs data authentication, consistency check, access point data collection and encryption using session keys. Specifically: AP authenticates MAC3, continues if passed, otherwise exits. If it continues, AP uses IAK to decrypt and obtain RB, RA, K_AB, IB, and checks the consistency of RA and IB with those sent before. If they are consistent, it continues, otherwise exits. If it continues, AP collects random number RA2, concatenates it with RB, and then encrypts it with K_AB to form Token_AB and returns it to STA. Token_AB contains (RB, K_AB, IA) encrypted by IAK and (RA2, RB) encrypted by K_AB, and MAC4. MAC4 is the HMAC calculated by IAK on the fields of Token_AB except MAC.

[0041] STA performs data authentication, consistency check, site data collection and encryption using session key. Specifically, STA checks MAC4, and continues if it passes, otherwise exits. If it continues, it uses IAK to decrypt RB, K_AB, and IA from Token_AB, and uses K_AB to decrypt RA2 and RB from Token AB, and checks the correctness of IA and RB. If it passes, it continues, otherwise exits. If it continues, it uses K_AB to encrypt RB and RA2, and calculates MAC5 to form Token_BA, which is sent to AP.

[0042] The AP performs data authentication and consistency check, and decrypts the session key to confirm that the two-way authentication is complete. The session key is used for subsequent session encryption. Specifically: the AP will continue after verifying MAC5, otherwise it will exit. If it continues, it will use K_AB to decrypt Token_BA except the MAC field, and verify the consistency of RA2 and RB with those sent previously. If the consistency check passes, the two-way authentication is successful. K_AB is used as the subsequent session key between the AP and STA for subsequent encryption. So far Figure 5 The example shown completes the description.

[0043] The secure communication method of the present invention recommends the use of domestic cryptographic algorithms and obtains international algorithm standards. Symmetric cryptographic algorithms, such as the SM4 block cipher algorithm, are recommended for the two-way authentication process. The key length is not less than 128 bits. The HMAC mode of the symmetric algorithm is recommended for message integrity verification. The initial vector IV is not less than 128 bits. Encryption recommends the use of a symmetric cryptographic algorithm or a sequence cryptographic algorithm, such as the ZUC Zu Chongzhi sequence algorithm, with a key length and IV of not less than 128 bits. It is recommended that the initial IV, random number resources, etc. in the system be obtained and updated from the key management interface of the quantum key distribution. It is not excluded that the signature algorithm of the post-quantum cryptographic algorithm recommended by the standard can be used for identity authentication if time and space overhead permit. Authentication, key negotiation distribution, encryption and message integrity protection are performed through symmetric cryptographic algorithms, HMAC, or optional post-quantum cryptographic algorithms, and combined with quantum key distribution technology, the overall ability of the relevant security protocols to resist brute force cracking and quantum computing attack threats is improved.

[0044] In one example, a STA access and authentication method is adopted in which a session key negotiation is performed once for each access, and the authentication and session key negotiation between the STA and the AP are ensured to have a certain timeliness. Strategies such as scheduled update and update according to application needs can be enabled; that is, the successful authentication relationship and session key between the access point and the station are time-limited, and they are considered invalid after the time limit.

[0045] In this implementation, based on quantum key distribution technology, an authentication request is initiated to the site through quantum key data obtained from the quantum key service system, or an authentication request initiated by the site through quantum key data obtained from the quantum key service system is responded to, and two-way authentication and session key negotiation are performed with the site; the session key used for encrypted communication between the access point and the site is obtained through quantum key data. It mainly adopts domestic cryptographic technology, quantum random number source, and quantum key distribution technology, so that the algorithm is localized and the random quality of the quantum key is improved. In addition, quantum key distribution technology is used for key exchange between STA and AP, and session key negotiation is completed in the access authentication stage. Two-way authentication, key negotiation and data encryption protection based on quantum key distribution are realized between STA and AP. The overall security performance is greatly improved.

[0046] The steps of the above method are divided only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this application; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0047] Another embodiment of the present invention relates to a secure communication system, such as Figure 6 As shown, it includes: a quantum key service system, one or more access points, and one or more sites; the quantum key service system is used to distribute quantum key data to the access point and the site; the access point is used to initiate an authentication request to the site based on the quantum key distribution technology by using the quantum key data obtained from the quantum key service system, or respond to the authentication request initiated by the site through the quantum key data obtained from the quantum key service system, and perform two-way authentication and session key negotiation with the site; the site is used to initiate an authentication request to the access point based on the quantum key distribution technology by using the quantum key data obtained from the quantum key service system, or respond to the authentication request initiated by the access point through the quantum key data obtained from the quantum key service system, and perform two-way authentication with the site; the access point or the site will obtain the session key used by the access point and the site for encrypted communication through the quantum key data.

[0048] In one example, the master security system in the quantum key service system is connected to multiple access points and connected to a quantum key distribution network, and the slave security system in the quantum key service system is connected to multiple sites and connected to the quantum key distribution network; the quantum key service system will ensure the data consistency of the quantum key data assigned to one or more groups of the access points and the data consistency of the quantum key data assigned to one or more groups of the sites through configuration information.

[0049] In one example, the quantum key data includes one of the following or any combination thereof: a quantum key, a quantum random number, an authentication key, a key agreement encryption key, and a storage protection key.

[0050] In one example, obtaining the session key used by the access point to perform encrypted communication with the site through the quantum key data includes: when the quantum key data contains a quantum key, directly selecting the quantum key as the session key; when the quantum key data does not contain a quantum key, forming the session key enhanced by a random entropy source through the quantum key data according to the two-way authentication and key exchange protocol; or, when the quantum key data does not contain a quantum key, directly obtaining the session key enhanced by a random entropy source from the quantum key service system through the quantum key data.

[0051] In one example, the system further includes: a self-monitoring module, which is used to use network layer transparent encryption or encryption provided by an interface to encrypt data transmitted over a wireless link through the session key after obtaining the session key through the quantum key data; monitor through a preset self-maintenance strategy, and periodically update the session key when a preset update condition is met.

[0052] In one example, the two-way authentication adopts a symmetric encryption algorithm, the message integrity verification in the two-way authentication or encrypted communication adopts a keyed hash operation or a symmetric encryption algorithm to construct a message authentication code, and the encrypted communication adopts a symmetric encryption algorithm or a sequence encryption algorithm.

[0053] In one example, the successful authentication relationship between the access point and the station and the session key have a time limit and are considered invalid after exceeding the time limit.

[0054] It is not difficult to find that this embodiment is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in conjunction with the above method embodiment. The relevant technical details mentioned in the above method embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above method embodiment.

[0055] It is worth mentioning that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, this embodiment does not introduce units that are not closely related to solving the technical problem proposed by the present invention, but this does not mean that there are no other units in this embodiment.

[0056] Another embodiment of the present invention relates to an electronic device, such as Figure 7As shown, it includes at least one processor 701; and a memory 702, a communication unit 703, and a cryptographic processing unit 704 that are communicatively connected to the at least one processor 701; wherein the communication unit 703 is used to send or receive data, the cryptographic processing unit 704 is used for cryptographic operations and key management, and the memory 702 stores instructions that can be executed by the at least one processor 701, and the instructions are executed by the at least one processor 701 so that the at least one processor 701 can execute the above-mentioned secure communication method with the cooperation of the communication unit 703 and the cryptographic processing unit 704.

[0057] The memory 702 and the processor 701 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 701 and the memory 702 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 701 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 701.

[0058] The processor 701 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 702 can be used to store data used by the processor 701 when performing operations.

[0059] Another embodiment of the present invention relates to a computer or intelligent terminal readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0060] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, TF card, hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory) and other media that can store program codes.

[0061] Those skilled in the art will appreciate that the above-mentioned embodiments are specific examples for implementing the present invention, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present invention.

Claims

1. A secure communication method, characterized in that: Applicable to access points, including: Based on the quantum key distribution technology, initiating an authentication request to the site through the quantum key data obtained from the quantum key service system, or responding to the authentication request initiated by the site through the quantum key data obtained from the quantum key service system, performing two-way authentication and session key negotiation with the site; The session key used when the access point and the station perform encrypted communication is obtained through the quantum key data.

2. The secure communication method according to claim 1, characterized in that: The master security system in the quantum key service system is connected to the plurality of access points via a quantum key distribution network, and the slave security system in the quantum key service system is connected to the plurality of sites via a quantum key distribution network; The quantum key service system will ensure the data consistency of the quantum key data allocated to one or more groups of access points and one or more groups of sites through preset configuration information.

3. The secure communication method according to claim 1, characterized in that: The quantum key data includes one of the following or any combination thereof: Quantum keys, quantum random numbers, authentication keys, key agreement encryption keys, storage protection keys.

4. The secure communication method according to claim 3, characterized in that: The step of obtaining, by using the quantum key data, a session key used when the access point and the station perform encrypted communication comprises: When the quantum key data includes a quantum key, directly selecting the quantum key as the session key; When the quantum key data does not contain a quantum key, forming the session key enhanced by a random entropy source through the quantum key data according to the two-way authentication and key exchange protocol; or When the quantum key data does not contain a quantum key, the session key enhanced by a random entropy source is directly obtained from the quantum key service system through the quantum key data.

5. The secure communication method according to claim 1, characterized in that: The method further comprises: After obtaining the session key through the quantum key data, data transmitted over the wireless link is encrypted transparently at the network layer or through encryption provided by the interface through the session key; The session key is monitored by a preset self-maintenance strategy and is periodically updated when a preset update condition is met.

6. The secure communication method according to claim 1, characterized in that: The two-way authentication adopts a symmetric encryption algorithm, the message integrity verification in the two-way authentication or encrypted communication adopts a keyed hash operation or a symmetric encryption algorithm to construct a message authentication code, and the encrypted communication adopts a symmetric encryption algorithm or a sequence encryption algorithm.

7. The secure communication method according to claim 1, characterized in that: The successful authentication relationship between the access point and the station and the session key have a time limit and are considered invalid after the time limit.

8. A secure communication system, characterized in that: include: A quantum key service system, one or more access points, and one or more stations; The quantum key service system is used to distribute quantum key data to the access point and the site; The access point is used to initiate an authentication request to the site through the quantum key data obtained from the quantum key service system based on the quantum key distribution technology, or respond to the authentication request initiated by the site through the quantum key data obtained from the quantum key service system, and perform two-way authentication and session key negotiation with the site; The site is used to initiate an authentication request to the access point by using the quantum key data obtained from the quantum key service system based on the quantum key distribution technology, or respond to an authentication request initiated by the access point by using the quantum key data obtained from the quantum key service system, and perform two-way authentication with the site; The access point or the station will obtain the session key used when the access point and the station perform encrypted communication through the quantum key data.

9. An electronic device, characterized in that: include: at least one processor; as well as, A memory, a communication unit, and a cryptographic processing unit that are communicatively connected to the at least one processor; wherein, The communication unit is used to send or receive data, the cryptographic processing unit is used for cryptographic operations and key management, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the secure communication method as described in any one of claims 1 to 7 with the cooperation of the communication unit and the cryptographic processing unit.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the secure communication method according to any one of claims 1 to 7 is implemented.

Images