Network-free encryption communication method and related device

Abstract

The invention discloses a network-free encryption communication method and a related device, relates to the technical field of quantum encryption communication, and can determine a first number of quantum session key subsets from a quantum session key set according to a first number of communication clusters, and quantum session keys in different quantum session key subsets are different. According to a mode that one quantum session key subset corresponds to one communication cluster, each quantum session key subset is loaded into the communication equipment in each communication cluster, and when the communication equipment needs to send communication data, the communication data is encrypted by using the quantum session keys, so that the communication data can be transmitted. The quantum session keys stored in the communication devices in different communication clusters are different, so that the interaction of the communication devices in the same communication cluster can be safer.

Description

Technical Field

[0001] The present invention belongs to the technical field of quantum encryption communication, and in particular to a method and related device for network-free encryption communication. Background Art

[0002] With the development of user science and technology, users may use non-network communication devices to interact in some activities. For example, when users are hiking outdoors, the satellite signal may not be stable in some mountainous areas, so users may need communication devices such as walkie-talkies that do not require mobile networks to communicate.

[0003] In this process, the communication device directly transmits the data, and when another communication device is on the same channel as the communication device transmitting the information, it can receive the information for information exchange. However, since it is not certain whether there are other communication devices on the channel, the risk of data leakage in this data transmission situation is relatively high.

[0004] Therefore, it is of great significance to strengthen the communication security between communication devices in the absence of satellite networks. Summary of the invention

[0005] The purpose of the present invention is to provide a method and related device for network-free encrypted communication, by using different quantum session keys in communication devices between different communication clusters to encrypt communication data. In this way, communication devices between different communication clusters cannot interact, thereby ensuring the security of communication devices in the same group of communication clusters during information interaction.

[0006] In a first aspect, an embodiment of the present application provides a method for networkless encrypted communication, applied to a key distribution terminal, wherein the key distribution terminal includes a quantum session key set, and the method includes: determining the first number of quantum session key subsets from the quantum session key set according to a first number of communication clusters; wherein the quantum session keys in different quantum session key subsets are different;

[0007] In a manner that one quantum session key subset corresponds to one communication cluster, each quantum session key subset is loaded into a communication device in each communication cluster, wherein the communication device is used to encrypt the communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method; wherein the predefined transmission method includes any of the following:

[0008] Radio transmission method, decentralized communication method, digital walkie-talkie communication method.

[0009] Optionally, the quantum session key set in the key distribution terminal is stored in ciphertext form; and the determining the first number of quantum session key subsets from the quantum session key set includes: dividing the first ciphertext according to the memory occupied by the first ciphertext corresponding to the quantum session key set to obtain the first number of ciphertext segments, wherein one ciphertext segment corresponds to one quantum session key subset; correspondingly, respectively loading each quantum session key subset into the communication device in each communication cluster includes: respectively loading each ciphertext segment into the communication device in each communication cluster.

[0010] Optionally, the first ciphertext corresponding to the above quantum session key set is obtained in the following manner:

[0011] Generate a symmetric key and the above quantum session key set using a quantum random number generation unit;

[0012] The quantum session key set is encrypted using the symmetric key to obtain the first ciphertext.

[0013] Optionally, the method further includes: in response to detecting the establishment of a connection with a management user terminal, determining whether the identity information sent by the management user terminal has the authority to distribute quantum session keys; if the identity information sent by the management user terminal has the authority to distribute quantum session keys, obtaining a public key in a first public-private key pair generated by the management user terminal; sending the public key in the first public-private key pair to the quantum random number generation unit, so that the quantum random number generation unit generates a symmetric key and the quantum session key set, wherein the public key in the first public-private key pair is used to encrypt the symmetric key to obtain a second ciphertext.

[0014] Optionally, the method further comprises: transmitting the second ciphertext back to the management user terminal;

[0015] The management user terminal is used to decrypt the second ciphertext using the private key in the first public-private key pair to obtain the symmetric key.

[0016] Optionally, the communication cluster includes a first communication device, the first communication device corresponds to the first quantum session key subset, and the first quantum session key subset is loaded into the first communication device in the following manner:

[0017] Obtaining a public key from the second public and private keys pre-stored in the first communication device;

[0018] Forwarding the public key in the second public-private key to the management user terminal, wherein the administrator user terminal is used to encrypt the symmetric key using the public key in the second public-private key to obtain a third ciphertext, and returning the third ciphertext to the key distribution terminal;

[0019] In response to receiving the third ciphertext, the ciphertext fragment corresponding to the first quantum session key subset and the third ciphertext are sent to the first communication device, wherein the first communication device is used to decrypt the third ciphertext based on the private key in the second public-private key to obtain the symmetric key, and to decrypt the ciphertext fragment corresponding to the first quantum session key subset using the symmetric key to obtain the first quantum session key.

[0020] Optionally, one communication device corresponds to one secure digital storage card, and the secure digital storage card is used to store the quantum session key subset loaded by the key distribution terminal.

[0021] In a second aspect, another embodiment of the present application provides a device for networkless encrypted communication, which is applied to a key distribution terminal, wherein the key distribution terminal includes a quantum session key set, and the device includes:

[0022] A determining unit, configured to determine the first number of quantum session key subsets from the quantum session key set according to the first number of communication clusters; wherein the quantum session keys in different quantum session key subsets are different;

[0023] A distribution unit is used to load each quantum session key subset into the communication devices in each communication cluster in a manner that one quantum session key subset corresponds to one communication cluster, wherein the communication devices are used to encrypt the communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method;

[0024] The above-mentioned predefined transmission mode includes any of the following:

[0025] Radio transmission method, decentralized communication method, digital walkie-talkie communication method.

[0026] In a third aspect, another embodiment of the present application provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the method of networkless encrypted communication when running.

[0027] In a fourth aspect, another embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the above-mentioned method of networkless encrypted communication.

[0028] Compared with the prior art, the present invention provides a method and related devices for networkless encrypted communication, which can determine a first number of quantum session key subsets from a quantum session key set according to a first number of communication clusters, and the quantum session keys in different quantum session key subsets are different, and each quantum session key subset can be loaded into a communication device in each communication cluster in a manner of one quantum session key subset corresponding to one communication cluster. When the communication device needs to send communication data, it uses the quantum session key to encrypt the communication data. Since the quantum session keys stored in the communication devices in different communication clusters are different, the interaction between the communication devices in the same communication cluster can be made more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A flowchart of a method for network-free encrypted communication provided by an embodiment of the present invention;

[0030] Figure 2 A schematic diagram of interaction in a quantum session key injection process provided by an embodiment of the present invention;

[0031] Figure 3 A schematic diagram of sending a ciphertext segment to a communication device provided by an embodiment of the present invention;

[0032] Figure 4 A connection diagram of a device for network-free encrypted communication provided by an embodiment of the present invention;

[0033] Figure 5 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0035] As can be seen from the above-mentioned background art, in network-free cluster communication, there may be a risk of data leakage.

[0036] For ease of understanding, take a walkie-talkie as an example of a communication device. A walkie-talkie usually has multiple preset channels. In the relevant technology, multiple users who need to communicate can be informed in advance of which specific channel to use for this communication. In this way, when multiple walkie-talkies are on the same channel, users can use the walkie-talkies to communicate.

[0037] However, in some scenarios, only specific users may need to receive communication data, while other users do not need to receive communication data. For example, in a field training activity, the trainees may be grouped, and it is hoped that users within the group can communicate with each other, while users in different groups do not want to communicate with each other. In this case, the solutions in the related art are difficult to implement. The reason is that when users in different groups are close to each other and users in different groups adjust their walkie-talkies to the same channel, they can also receive the sent data.

[0038] For example, when Group A and Group B are conducting a field training competition, it is stipulated that when members of Group A use walkie-talkies, they use Channel A for communication, and when members of Group B use walkie-talkies, they use Channel B for communication. If a member of Group A uses Channel B when using a walkie-talkie, the communication data between members of Group B may also be received at this time.

[0039] That is, the communication method in the related technology cannot guarantee the security of communication between clusters.

[0040] In the disclosed embodiment, communication devices between different communication clusters use different quantum session keys to encrypt communication data. In this way, communication devices between different communication clusters cannot interact, thereby ensuring the security of information interaction between communication devices in the same group of communication clusters.

[0041] See also Figure 1 , Figure 1 A flowchart of a method for networkless encrypted communication provided by an embodiment of the present invention is provided. The method for networkless encrypted communication can be applied to a key distribution terminal, and the key distribution terminal can include a quantum session key set. The key distribution terminal can be understood as a device with processing capabilities such as a server or a terminal device.

[0042] like Figure 1 As shown, the method for non-network encrypted communication may include the following steps:

[0043] Step 101: determining a first number of quantum session key subsets from a quantum session key set according to a first number of communication clusters.

[0044] Here, the quantum session keys in different quantum session key subsets are different.

[0045] Step 102: load each quantum session key subset into the communication devices in each communication cluster in a manner that one quantum session key subset corresponds to one communication cluster.

[0046] Here, the communication device is used to encrypt the communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method;

[0047] Here, the predefined transmission methods include any of the following:

[0048] Radio transmission method, decentralized communication method, digital walkie-talkie communication method, etc.

[0049] As an example, a quantum session key can be understood as a session key generated based on quantum random numbers and a quantum key distribution protocol. The ciphertext obtained after data encryption using the quantum session key enables the ciphertext to have a certain ability to resist cracking by quantum computers, thereby helping to make the ciphertext obtained after data encryption using the quantum session key more secure.

[0050] As an example, a certain number of quantum session keys can be pre-generated to form a quantum key session set and pre-stored in a key distribution terminal. Then, according to the number of communication clusters, the quantum session key set is divided to obtain quantum session key subsets with the same number as the number of communication clusters.

[0051] The number of session keys in each quantum session key subset can be limited according to actual conditions. For example, a session key subset can include only one quantum session key or multiple quantum session keys. The specific setting of the number of session keys in each session key subset can be limited according to actual conditions.

[0052] As an example, the quantum session keys in different quantum session key subsets are different, and according to the way that one quantum session key subset corresponds to one communication cluster, the quantum session keys in the communication devices in different communication clusters are different. When the communication devices in the communication cluster need to send communication data, they can use the quantum session key to encrypt the communication data to obtain ciphertext information. In this way, since the quantum session keys in the communication devices in different communication clusters are different, the communication devices in different communication clusters cannot exchange information.

[0053] It should be understood that a communication cluster may include multiple communication devices. However, the method disclosed in the present invention allows communication devices in the same communication cluster to exchange information, while communication devices in different communication clusters cannot exchange information.

[0054] For example, communication cluster A includes communication devices A1, A2, ..., and An, and communication cluster B includes communication devices B1, B2, ..., and Bn. Among them, communication devices A1, A2, ..., and An all use quantum session key subset A, while communication devices B1, B2, ..., and Bn all use quantum session key subset B, and quantum session key subset A is different from quantum session key subset B. In this way, after the quantum session key in quantum session key subset A is used to encrypt the data to obtain the ciphertext information A, the quantum session key in quantum session key subset B cannot be used to decrypt the ciphertext information A. Correspondingly, the information encrypted by the quantum session key in quantum session key subset B cannot be decrypted by the quantum session key in quantum session key subset A. In this way, communication devices between different communication clusters cannot interact, thereby ensuring the security of the communication devices in the same communication cluster during the information interaction process.

[0055] As an example, a communication cluster may include multiple communication devices, and each communication device in the communication cluster is loaded with the same quantum session key subset.

[0056] It can be seen that in the present disclosure, a first number of quantum session key subsets can be determined from a quantum session key set according to the first number of communication clusters, and the quantum session keys in different quantum session key subsets are different, and each quantum session key subset can be loaded into a communication device in each communication cluster in a manner that one quantum session key subset corresponds to one communication cluster. When the communication device needs to send communication data, the communication data is encrypted using the quantum session key. Since the quantum session keys stored in the communication devices in different communication clusters are different, the interaction between the communication devices in the same communication cluster can be made more secure.

[0057] It should be understood that the first number of communication clusters is limited according to actual conditions. For example, in a military exercise, three groups are divided, and the first number of communication clusters can be 3, which can avoid information interaction between personnel in different groups.

[0058] In some embodiments, the quantum session key set in the key distribution terminal is stored in ciphertext form; and the "determining a first number of quantum session key subsets from the quantum session key set" in step 101 may specifically include:

[0059] Dividing the first ciphertext according to the memory occupied by the first ciphertext corresponding to the quantum session key set to obtain a first number of ciphertext segments, wherein one ciphertext segment corresponds to one quantum session key subset;

[0060] Accordingly, the step 102 of “respectively loading each quantum session key subset into the communication devices in each communication cluster” includes:

[0061] Each ciphertext fragment is loaded into the communication device in each communication cluster respectively.

[0062] As an example, the quantum session key set is stored in the form of ciphertext, so as to increase security. At the same time, the first ciphertext can be directly divided according to the memory occupied by the first ciphertext, so as to efficiently divide the various ciphertext fragments.

[0063] As an example, the method disclosed in the present invention enables the transmission of quantum session key subsets in ciphertext form when transmitting between a key distribution terminal and a communication device. In this way, leakage of the quantum session key subset can be avoided, thereby further improving the security of the overall communication process.

[0064] In some embodiments, the first ciphertext corresponding to the quantum session key set may be obtained in the following manner:

[0065] Generate a symmetric key and a quantum session key set using a quantum random number generation unit;

[0066] The quantum session key set is encrypted using a symmetric key to obtain a first ciphertext.

[0067] As an example, the quantum random number generation unit generates a symmetric key and a quantum session key set, so that the characters in the quantum session key set are completely random, so that different quantum session key subsets in the quantum session key set are different.

[0068] As an example, using a symmetric key to encrypt a quantum session key set can speed up the generation efficiency of the first ciphertext.

[0069] In some embodiments, the above method further comprises:

[0070] In response to detecting the establishment of a connection with the management user terminal, determining whether the identity information sent by the management user terminal has quantum session key distribution authority;

[0071] Under the circumstance that the identity information sent by the management user terminal has the quantum session key distribution authority, obtaining the public key in the first public-private key pair generated by the management user terminal;

[0072] The public key in the first public-private key pair is sent to a quantum random number generation unit, so that the quantum random number generation unit generates a symmetric key and a quantum session key set.

[0073] Here, the public key in the first public-private key pair is used to encrypt the symmetric key to obtain the second ciphertext.

[0074] As an example, the user management terminal can be understood as a terminal device used by an administrator who distributes quantum session keys.

[0075] As an example, the administrator terminal may provide a secure digital security certificate (identity information) to enable the key distribution terminal to perform online authentication, thereby determining whether the user currently operating the administrator terminal is a predefined manager.

[0076] Specifically, the administrator terminal can be understood as UKEY. At this time, establishing a connection with the management user terminal can be understood as inserting UKEY into the key distribution terminal, and the key distribution terminal can recognize the UKEY storage digital certificate for identity authentication of online services to ensure the authenticity of the user's identity.

[0077] As an example, the management user terminal can pre-store a first public-private key pair, and can send the public key in the first public-private key pair to the key distribution terminal, so that the key distribution terminal can send the public key in the first public-private key pair to the quantum random number generation unit, so that the quantum random number generation unit generates a symmetric key and a quantum session key set.

[0078] As an example, the key distribution terminal can also use the public key in the first public-private key pair to encrypt the symmetric key to obtain the second ciphertext. In this way, the symmetric key used to encrypt the quantum session key set is also protected, and only the management user terminal has the private key in the first public-private key pair, thereby obtaining the symmetric key.

[0079] That is, in this way, the management user terminal indirectly controls the quantum session key set, and any communication device that needs to obtain the quantum session key needs to send information to the administrator user terminal to obtain the symmetric key.

[0080] It can be seen that this method not only enables the management user terminal to have indirect control authority over the quantum session key set, but also makes the entire quantum session key issuance process more secure.

[0081] In some embodiments, the above method further comprises:

[0082] The second ciphertext is transmitted back to the management user terminal.

[0083] Here, the management user terminal can be used to decrypt the second ciphertext using the private key in the first public-private key pair to obtain the symmetric key.

[0084] That is, in this way, the symmetric key for decrypting the quantum session key set is stored in the management user terminal, so that the first ciphertext and the symmetric key corresponding to the quantum session key set are respectively stored in different terminal devices, thereby avoiding the leakage of the quantum session key to a certain extent, thereby ensuring the security of the quantum session key when it is sent to the communication device.

[0085] In some embodiments, the communication cluster includes a first communication device, the first communication device corresponds to a first quantum session key subset, and the first quantum session key subset can be loaded into the first communication device in the following manner:

[0086] Obtaining a public key from a second public and private key pre-stored in the first communication device;

[0087] Forwarding the public key in the second public-private key to the management user terminal;

[0088] In response to receiving the third ciphertext, the ciphertext fragment corresponding to the first quantum session key subset and the third ciphertext are sent to the first communication device.

[0089] The administrator user terminal is used to encrypt the symmetric key using the public key in the second public-private key to obtain the third ciphertext, and return the third ciphertext to the key distribution terminal.

[0090] The first communication device is used to decrypt the third ciphertext based on the private key in the second public-private key to obtain a symmetric key, and to decrypt the ciphertext segment corresponding to the first quantum session key subset using the symmetric key to obtain the first quantum session key.

[0091] As an example, in this way, the management user terminal encrypts the symmetric key through the public key pre-stored in the first communication device, thereby obtaining the third ciphertext, and the key distribution terminal can send the third ciphertext and ciphertext fragments to the first communication device. In this way, the data sent by the key distribution terminal to the first communication device are all encrypted data, thereby improving the security of the session key issuance process.

[0092] In some embodiments, one communication device may correspond to one secure digital storage card, and the secure digital storage card may be used to store a quantum session key subset loaded by a key distribution terminal.

[0093] As an example, since the secure digital memory card can be inserted into a communication device, and the key distribution terminal may not be portable, the quantum session key subset is stored in the secure digital memory card, so that the key distribution terminal only needs to distribute the quantum session key to the secure memory card. In actual use, the secure digital memory card only needs to be inserted into the corresponding communication device. This method can make it easier for the communication device to obtain the quantum session key and update the quantum session key (for example, by updating the secure digital memory card).

[0094] As an example, the secure digital storage card may include, but is not limited to: a memory card, a SIM card, etc.

[0095] It is also important to emphasize that a quantum computer is a physical device that follows the laws of quantum mechanics to perform high-speed mathematical and logical operations, store and process quantum information. When a device processes and calculates quantum information and runs quantum algorithms, it is a quantum computer. Quantum computers have become a key technology under research because they have the ability to process mathematical problems more efficiently than ordinary computers. For example, they can speed up the time it takes to crack an RSA key from hundreds of years to a few hours.

[0096] That is, with the development of quantum technology, the protection measures in the existing communication process may not be ideal. That is, the protection measures in the traditional communication process are difficult to resist the attack of quantum computers. In the present disclosure, the data interaction between communication devices uses quantum session keys, which can resist quantum computer attacks to a certain extent and enhance the security of the communication process.

[0097] In order to better understand the concept of the present disclosure, you can combine Figure 2 For example, Figure 2 As can be seen from the interactive diagram, you can first open the PC (key distribution terminal), insert the administrator UKEY (management user terminal) for identification, open the charging software on the PC to identify the UKEY and initialize it, and then enter the login interface after the initialization is completed. Enter the login PIN code of the UKEY, then the PC enters the PING code to the UKEY, and the UKEY verifies and returns to the PC for successful verification.

[0098] PC requests UKEY to generate the first public-private key pair. UKEY generates the first public-private key pair successfully and returns the public key in the first public-private key pair to PC. After receiving the public key in the first public-private key pair, PC reports the public key of the first public-private key pair to the random number generator. The quantum random number generator generates 16 bytes as the protection key (symmetric key). The symmetric key is used to encrypt the quantum random number (quantum session key set) to obtain the first ciphertext. The protection key is encrypted using the public key generated by UKEY and then returned to PC. PC saves the first ciphertext, while UKEY saves the second ciphertext.

[0099] After the PC gets the first ciphertext, it inserts the TF card into the PC, and the PC starts to detect the device of the TF card. The PC recognizes the TF device, and then the PC starts to send instructions to the TF card to generate the second public-private key pair. The TF card generates the second public-private key pair and sends the public key plaintext in the second public-private key pair to the PC.

[0100] After receiving the public key of TF, PC reports the public key of TF to UKEY. After receiving the public key of TF, UKEY can decrypt the public key ciphertext encrypted by itself to obtain the symmetric key plaintext, and then use the public key of TF card to encrypt the symmetric key plaintext to obtain the third ciphertext, and return the third ciphertext to PC. PC writes the third ciphertext into the secure TF card, and writes the random number ciphertext (ciphertext fragment) into the TF card. When the quantum random number plaintext is needed, the TF private key needs to be used to decrypt the symmetric key plaintext, and then the symmetric key plaintext is used to decrypt the quantum random number ciphertext to obtain the quantum session key.

[0101] It should be understood that the TF card can be inserted into a communication device, so that the communication device can use the quantum session key to encrypt the communication data.

[0102] For a better understanding, we can continue to combine Figure 3 The present invention discloses a schematic diagram of sending a ciphertext segment to a communication device. In this example scenario, the communication device is a walkie-talkie for illustration. Figure 3 As shown,

[0103] For example, if a command center uses walkie-talkies to issue tasks to three teams, three different channels can be set to distinguish the three teams. Channel 0 represents the first team, channel 1 represents the second team, and channel 2 represents the third team. The command center can switch to channel 0 to communicate with the first team to issue tasks. In order to prevent the second and third teams from eavesdropping, encryption can be used.

[0104] The specific filling process of the quantum session keys for the three teams is as follows:

[0105] Charge 300KB of keys on the PC side, and charge all 300KB of keys to the command center. And manage the 300KB of keys, divide the 300KB of keys into three 100KB keys for management, each 100KB represents a squad, and is exactly distributed to three squads. When using channel 0, use the first 100KB of keys, when using channel 1, use the keys from 100KB to 200KB, and when using channel 2, use the keys from 200KB to 300KB.

[0106] When charging keys to the first team on the PC side, the first 100KB of keys are charged; when charging keys to the second team, the keys from the 100KB to the 200KB are charged; when charging keys to the third team, the keys from the 200KB to the 300KB are charged.

[0107] In this way, by directly dividing according to the memory, efficient division of the quantum session key set can be achieved, which helps to more efficiently realize the key injection for the secure TF card.

[0108] See also Figure 4 , Figure 4 A schematic diagram of the structure of a device for networkless encrypted communication provided by an embodiment of the present invention, wherein the device for networkless encrypted communication 400 is applied to a key distribution terminal, wherein the key distribution terminal includes a quantum session key set, and the device 400 includes:

[0109] A determining unit 401 is configured to determine the first number of quantum session key subsets from the quantum session key set according to the first number of communication clusters; wherein the quantum session keys in different quantum session key subsets are different;

[0110] The distribution unit 402 is used to load each quantum session key subset into the communication devices in each communication cluster in a manner that one quantum session key subset corresponds to one communication cluster, wherein the communication device is used to encrypt the communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method;

[0111] The above-mentioned predefined transmission mode includes any of the following:

[0112] Radio transmission method, decentralized communication method, digital walkie-talkie communication method.

[0113] In some embodiments, the quantum session key set in the key distribution terminal is stored in ciphertext form; and the determining unit 401 is further configured to divide the first ciphertext according to the memory occupied by the first ciphertext corresponding to the quantum session key set to obtain the first number of ciphertext segments, wherein one ciphertext segment corresponds to one quantum session key subset;

[0114] Correspondingly, the allocating unit 402 is further specifically configured to load each ciphertext segment into a communication device in each communication cluster.

[0115] In some embodiments, the apparatus 400 may be specifically used to obtain the first ciphertext corresponding to the above quantum session key set in the following manner:

[0116] Generate a symmetric key and the above quantum session key set using a quantum random number generation unit;

[0117] The quantum session key set is encrypted using the symmetric key to obtain the first ciphertext.

[0118] In some embodiments, the device 400 may also be specifically used to: in response to detecting the establishment of a connection with a management user terminal, determine whether the identity information sent by the management user terminal has the quantum session key distribution authority;

[0119] In the case where the identity information sent by the management user terminal has the quantum session key distribution authority, obtaining the public key in the first public-private key pair generated by the management user terminal;

[0120] The public key in the first public-private key pair is sent to the quantum random number generation unit, so that the quantum random number generation unit generates a symmetric key and the quantum session key set, wherein the public key in the first public-private key pair is used to encrypt the symmetric key to obtain a second ciphertext.

[0121] In some embodiments, the apparatus 400 may be further configured to: transmit the second ciphertext back to the management user terminal;

[0122] The management user terminal is used to decrypt the second ciphertext using the private key in the first public-private key pair to obtain the symmetric key.

[0123] In some embodiments, the communication cluster includes a first communication device, the first communication device corresponds to the first quantum session key subset, and the apparatus 400 may be specifically configured to: load the first quantum session key subset into the first communication device in the following manner:

[0124] Obtaining a public key from the second public and private keys pre-stored in the first communication device;

[0125] forwarding the public key in the second public-private key to the management user terminal, wherein the administrator user terminal is used to encrypt the symmetric key using the public key in the second public-private key to obtain a third ciphertext, and returning the third ciphertext to the key distribution terminal;

[0126] In response to receiving the third ciphertext, the ciphertext fragment corresponding to the first quantum session key subset and the third ciphertext are sent to the first communication device, wherein the first communication device is used to decrypt the third ciphertext based on the private key in the second public-private key to obtain the symmetric key, and to decrypt the ciphertext fragment corresponding to the first quantum session key subset using the symmetric key to obtain the first quantum session key.

[0127] In some embodiments, one communication device corresponds to one secure digital storage card, and the secure digital storage card is used to store the quantum session key subset loaded by the key distribution terminal.

[0128] Figure 5 A schematic diagram of the structure of a computer device provided in one embodiment of the present application is shown, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the functions of a computer system for implementing the method for generating an amplitude preparation circuit in any of the above-mentioned embodiments are realized.

[0129] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the computer executes the functions of the computer system of the method for networkless encrypted communication in any of the above embodiments.

[0130] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to perform the functions of a computer system of the method for networkless encrypted communication in any of the above embodiments.

[0131] It should be understood that the specific examples in this application are only intended to help those skilled in the art to better understand the embodiments of the present application, rather than to limit the scope of the present invention.

[0132] It can be understood that in the various implementations of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the implementation methods of the present application.

[0133] It can be understood that the various embodiments described in this application can be implemented individually or in combination, and the embodiments of this application are not limited to this.

[0134] Unless otherwise stated, all technical and scientific terms used in the embodiments of the present application have the same meaning as those generally understood by those skilled in the art of the technical field of the present application. The terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the scope of the present application. The term "and / or" used in the present application includes any and all combinations of one or more related listed items. The singular forms of "a kind of", "above" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0135] It can be understood that the processor of the embodiment of the present application can be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method implementation can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (DigitalSignal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiment of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0136] It is understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (programmable ROM, PROM), an erasable programmable read-only memory (erasable PROM, EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0137] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0138] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method implementation methods and will not be repeated here.

[0139] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0140] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0141] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0142] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0143] The above are only specific embodiments of the present application, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for non-network encrypted communication, characterized in that: Applied to a key distribution terminal, wherein the key distribution terminal includes a quantum session key set, and the method includes: Determining the first number of quantum session key subsets from the quantum session key set according to the first number of communication clusters; wherein the quantum session keys in different quantum session key subsets are different; In a manner where one quantum session key subset corresponds to one communication cluster, each quantum session key subset is loaded into a communication device in each communication cluster, wherein the communication device is used to encrypt communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method; The predefined transmission mode includes any of the following: Radio transmission method, decentralized communication method, digital walkie-talkie communication method.

2. The method according to claim 1, characterized in that The quantum session key set in the key distribution terminal is stored in a ciphertext form; and the determining the first number of quantum session key subsets from the quantum session key set comprises: Dividing the first ciphertext according to the memory occupied by the first ciphertext corresponding to the quantum session key set to obtain the first number of ciphertext segments, wherein one ciphertext segment corresponds to one quantum session key subset; Accordingly, the step of loading each quantum session key subset into the communication devices in each communication cluster includes: Each ciphertext fragment is loaded into the communication device in each communication cluster respectively.

3. The method according to claim 2, characterized in that The first ciphertext corresponding to the quantum session key set is obtained by: Generate a symmetric key and the quantum session key set using a quantum random number generation unit; The quantum session key set is encrypted using the symmetric key to obtain the first ciphertext.

4. The method according to claim 3, characterized in that The method further comprises: In response to detecting the establishment of a connection with a management user terminal, determining whether the identity information sent by the management user terminal has quantum session key distribution authority; In a case where the identity information sent by the management user terminal has the quantum session key distribution authority, obtaining a public key in a first public-private key pair generated by the management user terminal; The public key in the first public-private key pair is sent to the quantum random number generation unit, so that the quantum random number generation unit generates a symmetric key and the quantum session key set, wherein the public key in the first public-private key pair is used to encrypt the symmetric key to obtain a second ciphertext.

5. The method according to claim 4, characterized in that The method further comprises: Transmitting the second ciphertext back to the management user terminal; The management user terminal is used to decrypt the second ciphertext using the private key in the first public-private key pair to obtain the symmetric key.

6. The method according to claim 5, characterized in that The communication cluster includes a first communication device, the first communication device corresponds to a first quantum session key subset, and the first quantum session key subset is loaded into the first communication device in the following manner: Obtaining a public key from a second public and private key pre-stored in the first communication device; forwarding the public key in the second public-private key to the management user terminal, wherein the administrator user terminal is used to encrypt the symmetric key using the public key in the second public-private key to obtain a third ciphertext, and returning the third ciphertext to the key distribution terminal; In response to receiving the third ciphertext, the ciphertext fragment corresponding to the first quantum session key subset and the third ciphertext are sent to the first communication device, wherein the first communication device is used to decrypt the third ciphertext based on the private key in the second public-private key to obtain the symmetric key, and to decrypt the ciphertext fragment corresponding to the first quantum session key subset using the symmetric key to obtain the first quantum session key.

7. The method according to claim 1, characterized in that One communication device corresponds to one secure digital storage card, and the secure digital storage card is used to store the quantum session key subset loaded by the key distribution terminal.

8. A device for non-network encrypted communication, characterized in that: Applied to a key distribution terminal, wherein the key distribution terminal includes a quantum session key set, and the device includes: A determining unit, configured to determine the first number of quantum session key subsets from the quantum session key set according to the first number of communication clusters; wherein the quantum session keys in different quantum session key subsets are different; A distribution unit is used to load each quantum session key subset into the communication devices in each communication cluster in a manner that one quantum session key subset corresponds to one communication cluster, wherein the communication devices are used to encrypt the communication data based on the quantum session key to obtain ciphertext information, and transmit the ciphertext information using a predefined transmission method; The predefined transmission mode includes any of the following: Radio transmission method, decentralized communication method, digital walkie-talkie communication method.

9. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

Images