Enhanced application method of quantum key in nuclear power industrial network encryption transmission

Abstract

The invention particularly relates to an enhanced application method of a quantum key in nuclear power industrial network encryption transmission, which is characterized in that session key negotiation is enhanced through quantum key XOR based on a comprehensive security gateway in a network. According to the method, the quantum cryptography technology and the IPSEC cryptography protocol are deeply fused, and a layer of quantum key is introduced to perform XOR enhancement on the session key, so that the security of nuclear power industrial network encryption transmission is remarkably improved, the purpose of resisting quantum computing attack is achieved, and the network security transmission of key data is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of secure transmission of communication data, and in particular to an enhanced application method of quantum keys in encrypted transmission of nuclear power industry networks. Background Art

[0002] With the rapid development of Internet technology, the importance of information security is increasing day by day. Privacy, integrity and authenticity are important aspects of information security. In many scenarios such as financial data transmission and military communication, both parties hope that the transmitted data cannot be eavesdropped, destroyed or forged by a third party. According to the design concept of modern cryptographic systems, encryption algorithms and MAC algorithms themselves can be made public. The security of cryptographic systems is based on encryption and authentication keys, which must remain private. Therefore, how to securely establish and manage a pair of keys between the two parties in communication becomes the key to the entire confidential communication process.

[0003] The method of establishing secure keys in modern cryptography is based on asymmetric cryptographic systems such as RSA and ECC. The reason why non-complex cryptographic systems are difficult to break is that they are closely related to certain "difficult" mathematical problems. For example, the RSA cryptographic system is based on the problem of large number decomposition, and the ECC cryptographic system is based on the discrete logarithm problem on elliptic curves. By setting security parameters, cryptographic designers make the cost and price of solving these problems far exceed the benefits of cracking the corresponding cryptographic system. However, this perception is changing with the rapid development of quantum computer technology. As early as 1994, a professor in the Department of Mathematics at the Massachusetts Institute of Technology proposed an algorithm running on a quantum computer, which can effectively solve large number decomposition and discrete logarithm problems in polynomial time. This means that once a large quantum computer is manufactured, the current public key cryptographic system will collapse.

[0004] In recent years, quantum computers have developed rapidly. Small quantum computer systems have moved from scientific research institutes to the industrial sector. Quantum computers can not only crack passwords, but also have broad application prospects in many scenarios such as biopharmaceuticals, optimization problems and data retrieval. Therefore, companies represented by giants such as Google, IBM and Microsoft have invested heavily in the research and development of quantum computers. With the continuous increase in industry investment, the industry expects that large-scale quantum computers that can crack the current public key cryptography system are expected to be successfully developed in about 10 years.

[0005] The IPSEC cryptographic protocol is a relatively comprehensive cryptographic protocol that supports the use of multiple cryptographic technologies to provide comprehensive security protection for data in communication interactions, including data confidentiality, integrity verification, data source identity authentication, and anti-replay attack, etc. IPSEC works at the network layer. IPSEC is generally used for communication between two subnets, which is called station-to-station communication.

[0006] The traditional IPSEC cryptographic protocol is mainly divided into two links. IKE (Internet Key Exchange Protocol) is the first link, which completes the identity authentication of the two communicating parties and determines the IPSEC security policy and key used in the communication. The second link is to use the data packet encapsulation protocol and the IPSEC security policy and key agreed in IKE to achieve secure transmission of communication data.

[0007] The key management IKE protocol is used to authenticate the identities of both communicating parties, create a security association (SA), negotiate encryption algorithms, and generate shared session keys. Among them, ISAKMP (Internet Security Association and Key Management Protocol) is the core protocol of IKE, which defines the process and message format of establishing, negotiating, modifying and deleting SA, and defines the payload format of key exchange data and identity authentication data.

[0008] ISAKMP is divided into two stages: the first stage is the main mode, in which the communicating parties establish an ISAKMPSA, implement identity authentication and key exchange between the two parties, and obtain a working key, which is used to protect the negotiation process in the second stage; the second stage is the quick mode, which uses the established ISAKMPSA to provide protection, implement the negotiation of the IPSEC SA between the communicating parties, and determine the IPSEC security policy and session keys of the communicating parties. There are two session keys, both of which are symmetric keys.

[0009] The session key negotiation relies on the DH (Diffie-Hellman key exchange) algorithm. There are two ways to generate public keys in the DH algorithm: the earliest version of the DH algorithm based on the discrete logarithm problem and the enhanced version of the algorithm ECDH that combines the elliptic curve problem. The security of the DH key exchange algorithm is based on the discrete logarithm problem over a finite field; based on this security, the DH algorithm is used to distribute keys, so that the sender and receiver of the message can safely exchange a secret key and then use this key to encrypt and decrypt the data. ECDH is a key exchange algorithm based on the elliptic curve encryption algorithm. The key is shorter but the key security is stronger. Its principle is exactly the same as the DH algorithm.

[0010] The IPSEC cryptographic protocol is currently used in nuclear power industrial networks. The DH algorithm relied on during session key negotiation is at risk of being cracked by future quantum computing technology. Summary of the invention

[0011] The purpose of the present invention is to provide an enhanced application method of quantum keys in nuclear power industry network encryption transmission, deeply integrate quantum cryptography technology with the IPSEC cryptographic protocol, introduce a layer of quantum keys to perform XOR enhancement on session keys, thereby significantly improving the security of nuclear power industry network encryption transmission, achieving the purpose of resisting quantum computing attacks, and ensuring the secure network transmission of key data.

[0012] In order to achieve the above object, the present invention provides the following technical solutions:

[0013] The invention discloses an enhanced application method of quantum key in encrypted transmission of nuclear power industry network, which is based on the integrated security gateway in the network and enhances the session key negotiation through quantum key XOR.

[0014] As one of the feasible methods, session key negotiation is enhanced by quantum key XOR, including the following steps:

[0015] Step 1: Initialization and configuration;

[0016] Step 2: Quantum key XOR enhanced session key negotiation;

[0017] Step 3: Session key update and secure transmission.

[0018] As one possible implementation method, step 1, initialization and configuration, includes the following steps:

[0019] When the integrated security gateway is initialized, the kek table and the public and private key pair information used for encryption are preset;

[0020] According to the network configuration strategy, the integrated security gateways establish basic encrypted transmission tunnels through the IPSEC cryptographic protocol.

[0021] As one of the possible implementation methods, step 2, quantum key XOR enhanced session key negotiation, includes the following steps:

[0022] When the integrated security gateway executes IKE from the device and the master device, quantum key calculation is added to the ISAKMP second phase IPSEC SA session key negotiation process.

[0023] As one of the achievable methods, when the integrated security gateway executes IKE from the slave device and the master device, quantum key calculation is added to the ISAKMP second phase IPSESEC SA session key negotiation process, including the following steps:

[0024] The slave device sends the first message to the master device; the master device receives the first message, parses and verifies the first message, and then performs quantum key operation;

[0025] The master device sends a second message to the slave device; the slave device receives the second message, parses and verifies the second message, and then performs quantum key operation;

[0026] The slave device sends the third message to the master device; the master device receives the third message, parses and verifies the third message, and then obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol, and finally performs quantum key operation; after the slave device obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol for the third message, it performs quantum key operation to generate new session keys encr_r_quen and encr_i_quen;

[0027] When performing security services between the master and slave devices and exchanging encrypted data, new session keys encr_r_quen and encr_i_quen are used to encrypt and decrypt data.

[0028] As one possible implementation, the master device performs quantum key operation on the first message after parsing and verifying the payload, including the following steps:

[0029] The master device calculates an index based on the device number in the slave device certificate;

[0030] The master device obtains the ciphertext at the index from the kek table and decrypts it using its own encryption private key to obtain the kek corresponding to the slave device;

[0031] The master device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni sent by the slave device;

[0032] The master device obtains the ciphertext at index index from the quenk table, and decrypts it using its own encryption private key to obtain the key quenk; the master device uses the key quenk and the random number Ni sent by the slave device to perform calculations to obtain the quantum key quenk_sess;

[0033] The master device uses the initial vector iv_e and the symmetric key encryption key key_e to perform symmetric encryption operation on the quantum key quenk_sess to obtain the quantum key encryption key Nr.

[0034] As one possible implementation, the slave device performs quantum key operation on the second message after parsing and verifying the payload, including the following steps:

[0035] The slave device obtains the kek ciphertext from the local file and decrypts it using its own encrypted private key to obtain the kek corresponding to the master device;

[0036] The slave device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni generated by the master device;

[0037] The slave device uses the initial vector iv_e and the symmetric key encryption key key_e to perform a symmetric cryptographic operation on the received quantum key encryption key Nr to obtain the quantum key quenk_sess.

[0038] As one possible implementation, the master device performs quantum key operation on the third message after parsing and verifying the payload, including the following steps:

[0039] The master device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

[0040] As one of the possible implementation methods, the slave device performs quantum key operation on the third message, including the following steps:

[0041] The slave device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

[0042] As one of the possible implementation methods, step 3, session key update and secure transmission, includes the following steps:

[0043] During the session key update process, the quantum key enhanced session key negotiation in step 2 is repeated to ensure that each session key update can obtain heterogeneous enhancement of the quantum key.

[0044] Beneficial technical effects of the present invention:

[0045] The enhanced application method of quantum key in nuclear power industry network encrypted transmission of the present invention is optimized on the basis of keeping the original IPSEC cryptographic protocol framework unchanged, ensuring compatibility with the existing network architecture and minimizing changes to achieve seamless integration; encrypting and transmitting the quantum key through a key encryption key, effectively preventing the quantum key from being intercepted or tampered with during the distribution process, ensuring the security of the quantum key, and realizing quantum key secure distribution; introducing the quantum key as an enhanced component of the IPSEC session key, significantly improving the security strength of the IPSEC session key, effectively resisting the future quantum computing threat to the traditional encryption algorithm based on the discrete logarithm problem and the large number factorization problem, and enhancing the security against quantum computing; applying the quantum key enhancement mechanism each time the IPSEC session key is updated, ensuring the continuous security and stability of network encrypted transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The present invention is a flow chart of an embodiment of the enhanced application method of quantum key in nuclear power industry network encryption transmission. DETAILED DESCRIPTION

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0048] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0049] The technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0050] Quantum secure communication is a cutting-edge communication security technology that has emerged in recent years. It uses quantum key distribution technology as its core, encrypts and protects communication data, and can authenticate the data communication source. It has the characteristics of high real-time performance, high security, and high reliability. Quantum secure communication technology has been applied in the fields of military industry and metropolitan area network communication, and has pilot projects in some industrial control network fields, with excellent results.

[0051] Random numbers have important applications in different aspects of social life, especially in the fields of information security and cryptographic applications. Currently, common random number generators mainly rely on computer software simulation to generate pseudo-random numbers, or extract random numbers from certain classical physical noises. However, classical physical processes can be simulated if all variables are mastered, so it is necessary to study and adopt more effective means to ensure key security.

[0052] The randomness generated by some quantum physical processes is completely random, such as the collapse process of quantum states. QKD technology and quantum random number generators are technologies that generate random numbers based on quantum physical processes. The random numbers obtained are more random, unpredictable, and non-replicable. When used as a key source for cryptographic products, they have a larger key space and are more resistant to brute force cracking.

[0053] The cryptographic technology that uses quantum key distribution or quantum keys generated by quantum random number generators, combined with classical cryptographic algorithms and protocols, to perform encryption and identity authentication is called quantum cryptography.

[0054] The IPSEC cryptographic protocol is currently used in nuclear power industrial networks. The DH algorithm relied on during session key negotiation is at risk of being cracked by future quantum computing technology.

[0055] The present invention provides an embodiment of a method for enhancing the application of quantum keys in encrypted transmission of nuclear power industry networks. The quantum cryptography technology is deeply integrated with the IPSEC cryptographic protocol, and a layer of quantum key is introduced to perform XOR enhancement on the session key, thereby significantly improving the security of encrypted transmission of nuclear power industry networks, achieving the purpose of resisting quantum computing attacks, and ensuring the secure network transmission of key data.

[0056] The enhanced application method of quantum keys in nuclear power industry network encryption transmission described in this embodiment is based on the integrated security gateway in the network and enhances session key negotiation through quantum key XOR.

[0057] In this embodiment, as one of the achievable methods, the session key negotiation is enhanced by quantum key XOR, including the following steps:

[0058] Step 1: Initialization and configuration;

[0059] Step 2: Quantum key XOR enhanced session key negotiation;

[0060] Step 3: Session key update and secure transmission.

[0061] In this embodiment, as one of the achievable methods, step 1, initialization and configuration, includes the following steps:

[0062] When the integrated security gateway is initialized, the kek table and the public and private key pair information used for encryption are preset;

[0063] According to the network configuration strategy, the integrated security gateways establish basic encrypted transmission tunnels through the IPSEC cryptographic protocol.

[0064] In this embodiment, as one of the achievable methods, step 2, quantum key XOR enhanced session key negotiation, includes the following steps:

[0065] When the integrated security gateway executes IKE from the device and the master device, quantum key calculation is added to the ISAKMP second phase IPSEC SA session key negotiation process.

[0066] In this embodiment, as one of the achievable methods, when the integrated security gateway slave device and the master device execute IKE, quantum key calculation is added to the ISAKMP second phase IPSESEC SA session key negotiation process, including the following steps:

[0067] The slave device sends the first message to the master device; the master device receives the first message, parses and verifies the payload of the first message, and then performs quantum key operation;

[0068] The master device sends a second message to the slave device; the slave device receives the second message, parses and verifies the payload of the second message, and then performs quantum key operation;

[0069] The slave device sends the third message to the master device; the master device receives the third message, parses and verifies the payload of the third message, then obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol, and finally performs quantum key operation; after the slave device obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol for the third message, it performs quantum key operation to generate new session keys encr_r_quen and encr_i_quen;

[0070] When performing security services between the master and slave devices and exchanging encrypted data, new session keys encr_r_quen and encr_i_quen are used to encrypt and decrypt data.

[0071] In this embodiment, as one of the achievable methods, the master device performs quantum key operation on the first message after parsing and verifying the payload, including the following steps:

[0072] The master device calculates an index based on the device number in the slave device certificate;

[0073] The master device obtains the ciphertext at index index from the kek table, and decrypts it using its own encryption private key to obtain the kek corresponding to the slave device;

[0074] The master device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni sent by the slave device;

[0075] The master device obtains the ciphertext at index index from the quenk table, and decrypts it using its own encryption private key to obtain the key quenk; the master device uses the key quenk and the random number Ni sent by the slave device to perform calculations to obtain the quantum key quenk_sess;

[0076] The master device uses the initial vector iv_e and the symmetric key encryption key key_e to perform symmetric encryption operation on the quantum key quenk_sess to obtain the quantum key encryption key Nr.

[0077] In this embodiment, as one of the achievable methods, the slave device performs quantum key operation on the second message after parsing and verifying the payload, including the following steps:

[0078] The slave device obtains the kek ciphertext from the local file and decrypts it using its own encrypted private key to obtain the kek corresponding to the master device;

[0079] The slave device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni generated by the master device;

[0080] The slave device uses the initial vector iv_e and the symmetric key encryption key key_e to perform a symmetric cryptographic operation on the received quantum key encryption key Nr to obtain the quantum key quenk_sess.

[0081] In this embodiment, as one of the achievable methods, the master device performs quantum key operation on the third message after parsing and verifying the payload, including the following steps:

[0082] The master device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

[0083] In this embodiment, as one of the achievable methods, the slave device performs quantum key operation on the third message, including the following steps:

[0084] The slave device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

[0085] In this embodiment, as one of the feasible methods, the encryption private keys of the master device and the slave device are obtained when the integrated security gateway is initialized; the kek table is obtained when the integrated security gateway is initialized; the quenk table is obtained when the key is distributed; the first message is the key generation information, including HDR*, HASH, SA, Ni and Ni[,ID ci,ID cr]; the second message is the key generation information, including HDR*, HASH, SA, Ni and Ni[,ID ci,ID cr]; the third message is the confirmation information, including HDR* and HASH.

[0086] In this embodiment, as one of the achievable methods, step 3, session key update and secure transmission, includes the following steps:

[0087] During the session key update process, the quantum key-enhanced session key negotiation in step 2 is repeated to ensure that each session key update can obtain heterogeneous enhancement of the quantum key and continuously improve the security strength of the encrypted transmission tunnel.

[0088] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. An enhanced application method of quantum key in nuclear power industry network encryption transmission, characterized in that: Enhanced session key negotiation via quantum key XOR based on an integrated security gateway in the network.

2. The enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 1 is characterized in that: The session key negotiation is enhanced by quantum key XOR, including the following steps: Step 1: Initialization and configuration; Step 2: Quantum key XOR enhanced session key negotiation; Step 3: Session key update and secure transmission.

3. The enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 2 is characterized in that: Step 1, initialization and configuration, includes the following steps: When the integrated security gateway is initialized, the kek table and the public and private key pair information used for encryption are preset; According to the network configuration strategy, the integrated security gateways establish basic encrypted transmission tunnels through the IPSEC cryptographic protocol.

4. The enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 2 is characterized in that: Step 2, quantum key XOR enhanced session key negotiation, includes the following steps: When the integrated security gateway executes IKE from the device and the master device, quantum key calculation is added to the ISAKMP second phase IPSEC SA session key negotiation process.

5. The enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 4 is characterized in that: When the integrated security gateway executes IKE from the device and the master device, quantum key calculation is added to the ISAKMP second phase IPSESEC SA session key negotiation process, including the following steps: The slave device sends the first message to the master device; the master device receives the first message, parses and verifies the first message, and then performs quantum key operation; The master device sends a second message to the slave device; the slave device receives the second message, parses and verifies the second message, and then performs quantum key operation; The slave device sends the third message to the master device; the master device receives the third message, parses and verifies the third message, and then obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol, and finally performs quantum key operation; after the slave device obtains the session keys encr_i and encr_r according to the IPSEC cryptographic protocol for the third message, it performs quantum key operation to generate new session keys encr_r_quen and encr_i_quen; When performing security services between the master and slave devices and exchanging encrypted data, new session keys encr_r_quen and encr_i_quen are used to encrypt and decrypt data.

6. According to the enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 5, the master device performs quantum key operation on the first message after parsing and verifying the payload, comprising the following steps: The master device calculates an index based on the device number in the slave device certificate; The master device obtains the ciphertext at the index from the kek table and decrypts it using its own encryption private key to obtain the kek corresponding to the slave device; The master device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni sent by the slave device; The master device obtains the ciphertext at index index from the quenk table, and decrypts it using its own encryption private key to obtain the key quenk; the master device uses the key quenk and the random number Ni sent by the slave device to perform calculations to obtain the quantum key quenk_sess; The master device uses the initial vector iv_e and the symmetric key encryption key key_e to perform symmetric encryption operation on the quantum key quenk_sess to obtain the quantum key encryption key Nr.

7. According to the enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 5, the slave device performs quantum key operation on the second message after parsing and verifying the payload, comprising the following steps: The slave device obtains the kek ciphertext from the local file and decrypts it using its own encrypted private key to obtain the kek corresponding to the master device; The slave device uses kek to generate an initial vector iv_e and a symmetric key encryption key key_e, where the initial vector iv_e is generated by kek and mask mask, and the symmetric key encryption key key_e is generated by kek and a random number Ni generated by the master device; The slave device uses the initial vector iv_e and the symmetric key encryption key key_e to perform a symmetric cryptographic operation on the received quantum key encryption key Nr to obtain the quantum key quenk_sess.

8. According to the enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 5, the master device performs quantum key operation on the third message after parsing and verifying the payload, comprising the following steps: The master device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

9. According to the enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 5, the slave device performs quantum key operation on the third message, comprising the following steps: The slave device uses the quantum key quenk_sess and the session key encr_i to obtain a new session key encr_i_quen, and uses the quantum key quenk_sess and the session key encr_r to obtain a new session key encr_r_quen.

10. According to the enhanced application method of quantum key in nuclear power industry network encryption transmission according to claim 1, step 3, session key update and secure transmission, comprises the following steps: During the session key update process, the quantum key enhanced session key negotiation in step 2 is repeated to ensure that each session key update can obtain heterogeneous enhancement of the quantum key.

Images