File segmentation encryption processing method based on quantum key distribution

Abstract

The invention provides a file segmentation encryption processing method based on quantum key distribution, the method is applied to a sending end device of a file segmentation processing system, and the method comprises the following steps: obtaining charging keys of a plurality of receiving end devices and identifiers of the charging keys, and obtaining a plurality of groups of random key information; segmenting the original data to obtain multiple pieces of to-be-encrypted data; and for any to-be-encrypted data, encrypting the to-be-encrypted data according to the target random key to obtain encrypted data. And according to the target charging key, encrypting the identifier of the target random key and the position identifier to obtain identifier encrypted data. And adding the identifier encrypted data and the identifier of the target charging key to the encrypted data to obtain target data, and sending the target data to the receiving end device. According to the method and the device, the original data is encrypted after being segmented, and the identifier of the random key for encryption is encrypted by using the charging key of the receiving end equipment, so that the data security is improved.

Description

Technical Field

[0001] The present application relates to the field of data encryption technology, and in particular to a file segment encryption processing method based on quantum key distribution. Background Art

[0002] In the context of the Internet, encryption of transmitted files can be used to ensure that personal information will not be intercepted by a third party during the transmission process. Therefore, how to encrypt transmitted files has become a technical problem that needs to be solved urgently.

[0003] In the prior art, a file to be transmitted is usually encrypted as a whole using a fixed key, and whether the decryption authority exists is determined by the file attributes.

[0004] However, the encryption strength of the entire transmitted file is low, and the fixed key is used to transmit through the classic network, which has low security. The method of judging whether there is decryption permission based on file attributes is relatively complicated, resulting in low efficiency. Summary of the invention

[0005] The purpose of this application is to provide a file segment encryption processing method based on quantum key distribution to address the deficiencies in the above-mentioned prior art, so as to solve the problems of low encryption strength, low security and low efficiency in the prior art.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0007] In a first aspect, the present application provides a file segment encryption processing method based on quantum key distribution, which is applied to a sending end device of a file segment processing system; the method comprises:

[0008] Acquire multiple charging keys and identifiers of each charging key from a receiving device through a quantum relay network, and acquire multiple groups of random key information through the quantum relay network, each group of random key information including a random key and an identifier of the random key;

[0009] Segmenting the original data to obtain a plurality of data to be encrypted, and assigning a target injection key and a target random key to each data to be encrypted;

[0010] For any data to be encrypted among the multiple data to be encrypted, encrypt the data to be encrypted according to a target random key corresponding to the data to be encrypted, to obtain encrypted data corresponding to the data to be encrypted;

[0011] According to the target charging key corresponding to the data to be encrypted, the identifier and the position identifier of the target random key are encrypted to obtain identifier encrypted data, wherein the position identifier is used to identify the position of the data to be encrypted in the original data;

[0012] The identification encryption data and the identification of the target charging key are added to the encrypted data to obtain the target data corresponding to the data to be encrypted, and the target data is sent to the receiving end device.

[0013] Optionally, the step of adding the identifier encrypted data and the identifier of the target charging key to the encrypted data to obtain target data corresponding to the data to be encrypted includes:

[0014] Adding preset separation data at the end of the encrypted data;

[0015] The identification encrypted data is added to the end of the separated data to obtain the target data.

[0016] Optionally, before obtaining multiple charging keys and identifiers of each charging key from the receiving end device through the quantum relay network, the method further includes:

[0017] Determine the injection key injected by the quantum key injection module into the quantum security chip of the sending end device;

[0018] Get user login information;

[0019] The quantum security chip in the sending end device performs encryption calculation on the user login information based on the injection key to obtain authentication information;

[0020] The authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-filled key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

[0021] Optionally, obtaining multiple charging keys and identifications of each charging key from a receiving device through a quantum relay network includes:

[0022] The quantum cryptography management service system obtains the identifier of the quantum key distribution module of the receiving end from the cryptography management service platform of the quantum relay network, and receives multiple injection keys and the identifiers of each injection key sent by the receiving end device.

[0025] Optionally, the obtaining multiple groups of random key information through the quantum relay network includes:

[0026] The identifier of the quantum key distribution module at the sending end and the identifier of the quantum key distribution module at the receiving end are sent to the quantum key distribution network controller of the quantum relay network, so that the quantum key distribution network controller determines the multiple groups of random key information according to the identifier of the quantum key distribution module at the sending end, the identifier of the quantum key distribution module at the receiving end and the key manager topology link in the quantum relay network.

[0027] In a second aspect, the present application provides a file segment encryption processing method based on quantum key distribution, which is applied to a receiving device of a file segment encryption system, and the method includes:

[0028] Sending multiple charging keys and identifiers of each charging key to a transmitting end device through a quantum relay network, and obtaining multiple groups of random key information through the quantum relay network;

[0029] Receive multiple target data from a sending end device, each target data includes: encrypted data, identification encrypted data and an identification of a target charging key, the identification encrypted data includes: an encryption result of an identification of a target random key corresponding to the encrypted data, and an encryption result of a position identification, the position identification is used to identify a position of the to-be-encrypted data corresponding to the encrypted data in the original data;

[0030] Acquire each of the target charging keys according to the identifier of each of the target charging keys;

[0031] Decrypting the encrypted data according to each of the target charging keys and each of the identification encrypted data to obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted;

[0032] The original data is obtained by splicing the data to be encrypted and the position identifier corresponding to each encrypted data.

[0033] Optionally, decrypting the encrypted data according to each of the target charging keys and each of the identification encrypted data to obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted includes:

[0034] Decrypting the identification encrypted data according to the target charging key to obtain the identification of the target random key and the location identification;

[0035] Acquire the target random key according to the identifier of the target random key;

[0036] The encrypted data is decrypted according to the target random key to obtain the data to be encrypted.

[0037] Optionally, before sending a plurality of injection keys and identifiers of each injection key to the transmitting end device through the quantum relay network, the method further comprises:

[0038] Determine the injection key injected by the quantum key injection module into the quantum security chip of the receiving end device;

[0039] Get user login information;

[0040] The quantum security chip in the receiving device performs encryption calculation on the user login information based on the injection key to obtain authentication information;

[0041] The authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-filled key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

[0042] Optionally, the step of splicing the encrypted data and the position identifiers corresponding to the encrypted data to obtain the original data includes:

[0043] Determining the splicing order of each of the data to be encrypted according to the position data of each of the data to be encrypted;

[0044] The data to be encrypted are combined in the splicing order to obtain the original data.

[0045] In a third aspect, the present application provides a file segmentation processing system, the system comprising a sending end device, a receiving end device and a quantum relay network;

[0046] The sending end device is used to execute the steps of the file segment encryption processing method based on quantum key distribution as described in the first aspect, and the receiving end device is used to execute the steps of the file segment decryption processing method based on quantum key distribution as described in the second aspect.

[0047] In a fourth aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the method of the first aspect or the steps of the method of the second aspect as described above.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method of the first aspect or the steps of the method of the second aspect are executed.

[0049] The beneficial effects of the present application are as follows: the transmitting device obtains multiple charging keys of the receiving device, and then obtains multiple groups of random key information through the quantum relay network. Since multiple groups of random key information are generated in the quantum relay network, the classical network transmission key is not used, so the security is higher. Then the original data is segmented into multiple data to be encrypted. The data to be encrypted are encrypted based on the target random keys in the multiple random key information, and the identifiers of each target random key are encrypted using each target charging key. Since the present embodiment performs segmentation processing on the entire original data, each data to be encrypted is encrypted using different random keys respectively, so the encryption strength is high and the security is strong, and the loss of the key causes the entire data to be leaked. The identifier of the encrypted target random key and the identifier of the target charging key are added to the encrypted data to obtain the target data, and the target data is sent to the receiving device. In this process, since the identifier of the random key is encrypted using the charging key of the receiving device, the receiving device decrypts the identifier of the encrypted random key according to its own charging key after receiving the target data, thereby obtaining the identifier of the random key corresponding to the encrypted data, and decrypts the encrypted data according to the identifier of the random key, so as to achieve secure transmission of data. It can be seen that if the encrypted data is not received by the receiving party, the random key identifier cannot be obtained, and thus the random key cannot be determined, and the encrypted data cannot be decrypted. Therefore, this embodiment simplifies the steps and improves transmission efficiency while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 It is a structural schematic diagram of a file segmentation processing system provided in an embodiment of the present application;

[0052] Figure 2 It is a flowchart of a file segment encryption processing method based on quantum key distribution provided in an embodiment of the present application;

[0053] Figure 3 It is a flowchart of an identity authentication method provided in an embodiment of the present application;

[0054] Figure 4 This is a schematic diagram of the structure of a key manager relay link in a quantum relay network provided by an embodiment of the present application;

[0055] Figure 5It is a flowchart of a file segment decryption processing method based on quantum key distribution provided in an embodiment of the present application;

[0056] Figure 6 It is a schematic diagram of a process for determining data to be encrypted and a location identifier of the data to be encrypted provided by an embodiment of the present application;

[0057] Figure 7 It is a flowchart of another identity authentication method provided in an embodiment of the present application;

[0058] Figure 8 It is a flowchart of a file segmentation processing method based on quantum key distribution provided in an embodiment of the present application;

[0059] Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0061] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0062] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0063] In the prior art, the entire file to be transmitted is usually encrypted using a fixed key, and the decryption permission is determined by the file attributes. However, the encryption strength of the entire file to be transmitted is low, and the fixed key is used to transmit through the classic network, which has low security. The method of determining whether the decryption permission is available by file attributes is relatively complicated, resulting in low efficiency.

[0064] Based on this, the present application proposes a file segment encryption processing method based on quantum key distribution. This method segments the original data sent by the sending device and encrypts it with different keys to improve data security. In addition, the key used for each segment of data is a random key generated by the quantum relay network, which can further improve security compared to transmitting a fixed key through a classical network. After receiving the encrypted data, the receiving device decrypts the data according to its own injection key, thereby ensuring that only the receiving device can decrypt the encrypted data. The method is simple and the process is more simplified.

[0065] Before introducing the file segment encryption processing method based on quantum key distribution and the file segment decryption processing method based on quantum key distribution, the structure of the file segment processing system applied by the above methods is first explained.

[0066] Figure 1 Schematic diagram of the structure of a file segmentation processing system provided in an embodiment of the present application. Figure 1 As shown, the file segmentation processing system includes a sending device, a quantum relay network and a receiving device.

[0067] The sending end device includes a sending end terminal, a quantum security chip at the sending end, a quantum key injection module at the sending end, a quantum cryptography management service system at the sending end, a key manager at the sending end, and a quantum key distribution module at the sending end. The sending end terminal is connected to the quantum cryptography management service system at the sending end through a network, the quantum security chip in the sending end device is connected to the quantum key injection module at the sending end, the quantum key injection module is connected to the quantum key management service system at the sending end, the quantum cryptography management service system at the sending end is connected to the key manager at the sending end, and the key manager at the sending end is connected to the quantum key distribution module at the sending end.

[0068] The receiving end device includes a receiving end terminal, a quantum security chip at the receiving end, a quantum key injection module at the receiving end, a quantum cryptography management service system at the receiving end, a key manager at the receiving end, and a quantum key distribution module at the receiving end. The receiving end terminal is connected to the quantum cryptography management service system at the receiving end through a network, the quantum security chip in the receiving end device is connected to the quantum key injection module at the receiving end, the quantum key injection module is connected to the quantum key management service system at the receiving end, the quantum cryptography management service system at the receiving end is connected to the key manager at the receiving end, and the key manager at the receiving end is connected to the quantum key distribution module at the receiving end.

[0069] The quantum relay network includes a cryptographic management service platform, a quantum key distribution network controller, multiple key managers, and multiple quantum key distribution modules. The cryptographic management service platform is respectively connected to the quantum cryptographic management service system at the sending end and the quantum cryptographic management service system at the receiving end, the quantum key distribution network controller is respectively connected to the key manager at the sending end, the key manager at the receiving end, and each key manager in the quantum relay network, each key manager in the quantum relay network is respectively connected to a quantum key distribution module, each key manager in the quantum relay network is topologically connected, and two of the key managers are respectively connected to the key manager at the sending end and the key manager at the receiving end. Each quantum key distribution module in the quantum relay network is topologically connected, and two of the quantum key distribution modules are respectively connected to the quantum key distribution module at the sending end and the quantum key distribution module at the receiving end.

[0070] Among them, the quantum key distribution module is used to realize the quantum key distribution of the connected quantum key distribution modules. The quantum key distribution network controller is used to enable the quantum key distribution module to negotiate and generate random keys according to the key manager topology in the quantum relay network, so as to ensure the safe, stable, efficient and robust operation of the quantum key distribution module network. The key manager is used to receive and manage the random keys generated by the quantum key distribution module, and relay the random keys to provide them to the key demand device. The password management service platform is used to perform routing control and resource scheduling on the quantum password management service system. The quantum password management service system is used to realize data interaction with the device terminal and the quantum security chip. The quantum key injection module is used to inject the quantum key from the quantum key distribution module into the quantum security chip. The quantum security chip is used to store the injected key.

[0071] Based on the file segmentation processing system, refer to Figure 2 This paper introduces the file segment encryption processing method based on quantum key distribution. Figure 2 It is a flowchart of a file segment encryption processing method based on quantum key distribution provided in an embodiment of the present application.

[0072] S201. Acquire multiple charging keys and identifiers of each charging key from a receiving device through a quantum relay network, and acquire multiple groups of random key information through the quantum relay network, each group of random key information including a random key and an identifier of the random key.

[0073] Specifically, the quantum cryptography management service system at the sending end and the cryptography management service platform in the quantum relay network send a key filling request message to the receiving end device, so that the cryptography management service platform forwards the multiple filling keys received from the receiving end device to the sending end device through the quantum cryptography management service system at the sending end. Among them, the filling key is the key generated by the quantum key filling module filling the quantum key into the quantum security chip. Each device has multiple filling keys. When the number of keys in the quantum security chip is less than the preset value, the quantum key is generated by the quantum key distribution module and sent to the quantum cryptography management service system. The quantum cryptography management service system sends the quantum key to the quantum key filling module. The quantum key filling module fills the received quantum key into the quantum security chip to complete the replenishment of the filling key.

[0074] It is worth noting that after the receiving device sends the charging key to the sending device, it sets the sent charging key as used to prevent other devices from using duplicate charging keys and affecting information security.

[0075] Specifically, the random key information is randomly generated in real time by the quantum relay network. As an optional implementation, the sending end device can store multiple sets of random key information sent by the quantum relay network for encrypting multiple data respectively.

[0076] It is worth mentioning that the quantum relay network can generate multiple random keys and send the random keys to the quantum cryptography management service system at the sending end and the quantum cryptography management service system at the receiving end respectively, so that the sending device and the receiving device can receive the same random keys for encryption and decryption.

[0077] S202, segmenting the original data to obtain a plurality of data to be encrypted, and allocating a target injection key and a target random key to each data to be encrypted.

[0078] As an optional implementation, the sending end device may divide the original data according to the length of the original data and the preset number of segments, so that the number of data to be encrypted is the same as the preset number of segments.

[0079] As another optional implementation, the sending end device may divide the original data according to a preset segment length so that the length of the data to be encrypted is the same as the preset segment length.

[0080] Optionally, after the sending device segments the original data, it randomly assigns a target injection key and a target random key to each data to be encrypted, wherein the target injection key is one of multiple injection keys obtained from the receiving device, and the target random key is one of multiple groups of random key information obtained from the quantum relay network.

[0081] S203 . For any data to be encrypted among the multiple data to be encrypted, encrypt the data to be encrypted according to a target random key corresponding to the data to be encrypted, and obtain encrypted data corresponding to the data to be encrypted.

[0082] Specifically, the sending end device encrypts each data to be encrypted using a corresponding target random key to obtain a plurality of encrypted data.

[0083] S204. Encrypt the identifier of the target random key and the position identifier according to the target charging key corresponding to the data to be encrypted to obtain identifier encrypted data, wherein the position identifier is used to identify the position of the data to be encrypted in the original data.

[0084] Specifically, the sending end device uses the target injection key corresponding to each data to be encrypted to encrypt the identifier of the target random key and the position identifier respectively to obtain multiple identifier encrypted data. Among them, the identifier encrypted data can be a string composed of the encrypted identifier of the target random key and the encrypted position identifier.

[0085] Optionally, the position identifier is the relative position of each to-be-encrypted data in the original data.

[0086] S205: Add the identifier of the encrypted data and the target charging key to the encrypted data, obtain the target data corresponding to the data to be encrypted, and send the target data to the receiving end device.

[0087] Specifically, after obtaining multiple target data, the quantum cryptography management service system at the sending end sends the target data to the receiving end device through the key manager link. The key manager link is determined by the quantum key distribution network controller according to the identifier of the quantum key distribution module at the sending end and the identifier of the quantum key distribution module at the receiving end.

[0088] As an optional implementation, the sending end device adds the identifier of the encrypted data and the target sufficient key to the encrypted data to obtain the target data corresponding to the data to be encrypted, concatenates the data to be encrypted into complete target data, and sends the complete target data to the receiving end device.

[0089] As another optional implementation, the sending device adds the identifier of the encrypted data and the target sufficient key to the encrypted data, obtains the target data corresponding to the data to be encrypted, and then directly sends the target data corresponding to each data to be encrypted to the receiving device.

[0090] In this embodiment, the transmitting device obtains multiple injection keys of the receiving device, and then obtains multiple groups of random key information through the quantum relay network. Since multiple groups of random key information are generated in the quantum relay network, the classical network transmission key is not used, so the security is higher. Then the original data is segmented into multiple data to be encrypted. The data to be encrypted are encrypted based on the target random keys in the multiple random key information, and the identifiers of each target random key are encrypted using each target injection key. Since this embodiment performs segmentation processing on the entire original data, each data to be encrypted is encrypted using different random keys, so the encryption strength is high and the security is strong, and the loss of the key causes the entire data to be leaked. The identifier of the encrypted target random key and the identifier of the target injection key are added to the encrypted data to obtain the target data, and the target data is sent to the receiving device. In this process, since the identifier of the random key is encrypted using the injection key of the receiving device, the receiving device decrypts the identifier of the encrypted random key according to its own injection key after receiving the target data, thereby obtaining the identifier of the random key corresponding to the encrypted data, and decrypts the encrypted data according to the identifier of the random key to achieve secure data transmission. It can be seen that if the encrypted data is not received by the receiving party, the random key identifier cannot be obtained, and thus the random key cannot be determined, and the encrypted data cannot be decrypted. Therefore, this embodiment simplifies the steps while ensuring data security.

[0091] As an optional implementation, in the above step S205, the identifier of the encrypted data and the target charging key are added to the encrypted data to obtain the target data corresponding to the data to be encrypted, and the process specifically includes the following steps:

[0092] Optionally, preset separator data is added to the end of the encrypted data.

[0093] Optionally, the preset separation data may be an encryption identifier for separating the encrypted data and identifying the encrypted data. Specifically, when the receiving device decrypts the target data, the sending device may determine the encrypted data and identify the encrypted data according to the preset separation data.

[0094] Optionally, the identification encrypted data is added to the end of the separated data to obtain the target data.

[0095] As an optional implementation, the sending end device may add preset separation data before the header of the encrypted data, and add the identification encryption data to the header of the separation data to obtain the target data.

[0096] In this embodiment, the target data is obtained by adding preset separation data to the end of the encrypted data and adding the identification encrypted data to the end of the separation data, so that the encrypted data and the identification encrypted data can be distinguished according to the separation data when decrypting the data.

[0097] As an optional implementation, Figure 3 As shown, before the above step S201, that is, before obtaining multiple injection keys and the identifiers of each injection key from the receiving end device through the quantum relay network, the following method steps may also be included. Among them, Figure 3 It is a flowchart of an identity authentication method provided in an embodiment of the present application.

[0098] S301. Determine the injection key injected by the quantum key injection module into the quantum security chip of the sending end device.

[0099] Specifically, the quantum key injection module at the sending end injects the quantum key sent by the quantum key distribution module into the quantum security chip in the sending end device and the quantum cryptography management service system at the sending end at the same time, so that the injection key in the quantum security chip and the injection key in the quantum cryptography management service system are the same, so as to complete identity authentication.

[0100] S302: Obtain user login information.

[0101] It is worth noting that before obtaining the user login information, the sending terminal obtains the user information entered by the user when registering or activating the account, and sends the user information to the quantum cryptography management service system for storage. At the same time, the quantum cryptography management service system binds the user information and the quantum security chip.

[0102] Exemplarily, the user login information may be a user account name and a user login password, etc.

[0103] As an optional implementation, after obtaining the user login information, it is stored in the quantum security chip.

[0104] S303. The quantum security chip in the sending device encrypts the user login information based on the injected key to obtain authentication information.

[0105] Specifically, the quantum security chip in the sending device first encrypts the user login information based on the injection key, and then converts the encrypted information using the standard hash algorithm of the cryptographic hash function to obtain an encrypted hash value, which is used as the authentication information.

[0106] S304, sending the authentication information to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-charged charging key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

[0107] Specifically, the quantum cryptography management service system at the sending end first encrypts the pre-stored user information using the injection key, and then converts the encrypted information using the standard hash algorithm of the cryptographic hash function to obtain the identity comparison information. The received authentication information is then compared with the identity comparison information. If the comparison results are consistent, the identity authentication result is determined to be a successful authentication. If the comparison results are inconsistent, the identity authentication result is determined to be an authentication failure. It is worth mentioning that if the identity authentication result is an authentication failure, an authentication failure warning is output, and the steps in the above steps S201-S205 are stopped.

[0108] In this embodiment, the charging key and user login information are received, the user login information is encrypted and calculated based on the charging key to obtain authentication information, and the authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the user information and the pre-charged charging key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result. In this embodiment, the user is authenticated to ensure that the sending and receiving objects of the data are correct, thereby ensuring data security.

[0109] Furthermore, the specific process of obtaining multiple charging keys and the identification of each charging key from the receiving end device through the quantum relay network in the above step S201 is as follows.

[0110] Optionally, the quantum cryptography management service system obtains the identifier of the quantum key distribution module at the receiving end from the cryptography management service platform of the quantum relay network, and receives multiple injection keys and the identifiers of each injection key sent by the receiving end device.

[0111] Among them, the password management service platform in the quantum relay network pre-stores the identification of the quantum key distribution module in each device. Specifically, the sending end device sends the node identification request information of the receiving end to the password management service platform through the quantum password management service system of the sending end, and the password management service platform retrieves the identification of the quantum key distribution module of the receiving end from the database according to the node identification request information of the receiving end, and sends the identification of the quantum key distribution module of the receiving end to the sending end device.

[0112] In this embodiment, the quantum cryptography management service system obtains the identifier of the quantum key distribution module of the receiving end, multiple injection keys and the identifier of each injection key from the cryptography management service platform of the quantum relay network, so as to uniformly process the identifier of the quantum key distribution module, the injection key and the identifier of each injection key.

[0113] Further, based on the above step of obtaining the identifier of the quantum key distribution module at the receiving end, the specific steps of obtaining multiple sets of random key information through the quantum relay network in the above step S201 are as follows:

[0114] Optionally, the identifier of the quantum key distribution module at the sending end and the identifier of the quantum key distribution module at the receiving end are sent to a quantum key distribution network controller of the quantum relay network, so that the quantum key distribution network controller determines multiple groups of random key information according to the identifier of the quantum key distribution module at the sending end, the identifier of the quantum key distribution module at the receiving end and the key manager topology link in the quantum relay network.

[0115] Specifically, the sending end device sends the identifier of the quantum key distribution module of the sending end and the identifier of the quantum key distribution module of the receiving end to the quantum key distribution network controller of the quantum relay network. The quantum key distribution network controller first determines the key manager relay link according to the identifier of the quantum key distribution module of the sending end and the identifier of the quantum key distribution module of the receiving end, and then determines multiple groups of random key information according to the key manager relay link negotiation.

[0116] The key manager relay link is a link connected from the sending end to the receiving end determined based on the key manager topology link.

[0117] For example, Figure 4 Schematic diagram of the structure of a key manager relay link in a quantum relay network provided by an embodiment of the present application. Figure 4As shown, the quantum relay network includes 5 key managers and corresponding 5 quantum key distribution modules, wherein key manager 1 is connected to key manager 2, key manager 3, key manager 4 and key manager 5 respectively, key manager 2 is connected to key manager 5, key manager 4 is connected to key manager 5, key manager 3 is connected to the key manager of the sending end, and key manager 5 is connected to the key manager of the receiving end. Then the key manager relay link can be the key manager of the sending end-key manager 3-key manager 1-key manager 4-key manager 5-key manager of the receiving end. The random key information is determined based on the key manager relay link and the quantum key distribution module corresponding to the key manager in the link. In this embodiment, the sending end device sends the identifier of the quantum key distribution module of the sending end and the identifier of the quantum key distribution module of the receiving end to the quantum key distribution network controller of the quantum relay network, so that the quantum key distribution network controller determines multiple random key information, thereby obtaining multiple random keys to encrypt the encrypted data. Since the random key is determined according to the key manager topology link, it is highly secure and cannot be copied.

[0118] After introducing how the sending device performs the file segment encryption processing method based on quantum key distribution, refer to Figure 5 This paper introduces how the receiving device performs the file segment decryption processing method based on quantum key distribution. Figure 5 1 is a flowchart of a method for processing file segment decryption based on quantum key distribution provided in an embodiment of the present application. Optionally, the method for processing file segment decryption based on quantum key distribution can be applied to a receiving device.

[0119] S501. Send multiple charging keys and identifiers of each charging key to a sending end through a quantum relay network, and obtain multiple groups of random key information through the quantum relay network.

[0120] Specifically, the receiving device receives the key charging request information sent by the sending device through the password management service platform, and sends multiple charging keys and charging key identifiers to the password management service platform, so that the password management service platform sends multiple charging keys and the identifiers of each charging key to the sending device.

[0121] Optionally, after the sending end device obtains the identifier of the quantum key distribution module of the receiving end from the password management service platform, the quantum key distribution network controller determines multiple sets of random key information according to the identifier of the quantum key distribution module of the sending end, the identifier of the quantum key distribution module of the receiving end, and the key manager topology link in the quantum relay network. Then the quantum key distribution network controller sends the multiple sets of random key information to the key manager of the sending end and the key manager of the receiving end respectively. After receiving the multiple sets of random key information, the key manager of the receiving end sends the random key information to the receiving end device through the quantum cryptography management service system.

[0122] S502. Receive multiple target data from a sending end device, each target data includes: encrypted data, an identifier of encrypted data, and an identifier of a target charging key, the identifier of the encrypted data includes: an encryption result of an identifier of a target random key corresponding to the encrypted data, and an encryption result of a position identifier, the position identifier is used to identify a position of the data to be encrypted corresponding to the encrypted data in the original data.

[0123] Optionally, the receiving device receives multiple target data from the key manager of the receiving end.

[0124] S503: Obtain each target charging key according to the identifier of each target charging key.

[0125] Optionally, the receiving terminal retrieves each target charging key from the key pre-stored in the quantum security chip according to the identifier of each target charging key to obtain each target charging key.

[0126] S504: Decrypt the encrypted data according to the target charging keys and the encrypted data of each identifier, and obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted.

[0127] Specifically, the receiving terminal decrypts the identification encrypted data according to the target charging key to obtain the identification and position identification of the target random key, and decrypts the encrypted data according to the identification of the target random key to obtain the data to be encrypted corresponding to the encrypted data.

[0128] S505 , splicing the encrypted data and the location identifiers corresponding to the encrypted data to obtain the original data.

[0129] Optionally, the receiving terminal concatenates the data to be encrypted according to the data to be encrypted and the position identifier corresponding to each encrypted data to obtain the original data.

[0130] Optionally, after obtaining the original data, the receiving device deletes multiple injection keys marked with used identifiers.

[0131] In this embodiment, multiple charging keys and charging key identifiers are sent to the transmitter through the quantum relay network, and multiple groups of random key information are obtained through the quantum relay network. Since multiple groups of random key information are generated in the quantum relay network, the key is not transmitted through the classical network, so the security is higher. Multiple target data are received, and each target charging key is obtained according to the identifier of each target charging key. If the target data is received by a non-receiving device, the target charging key cannot be obtained according to the representation of the target charging key, thereby improving data security. The encrypted data is decrypted according to the target charging key and each identifier encrypted data to obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted, and then the encrypted data is spliced ​​according to the location identifier to obtain the original data. In this embodiment, data security can be improved by encrypting the original data after segmentation, and then decrypting and splicing based on the encrypted data of each segment.

[0132] Further, refer to Figure 6 , the specific steps of decrypting the encrypted data according to each target charging key and each identifier encrypted data in the above step S504, and obtaining the encrypted data corresponding to the encrypted data and the location identifier of the encrypted data are introduced. Among them, Figure 6 It is a flowchart of determining data to be encrypted and a location identifier of the data to be encrypted provided in an embodiment of the present application.

[0133] S601. Decrypt the identification encrypted data according to the target charging key to obtain the identification and position identification of the target random key.

[0134] As an optional implementation, the encrypted target random key identifier and the encrypted position identifier may have different formats, so that the target charging key can be used to decrypt the two respectively. The format difference may be: the encrypted target random key identifiers are all numbers, and the encrypted position identifiers are all letters. The format difference may also be that the encrypted target random key identifier has a preset separator at the end.

[0135] S602: Obtain a target random key according to an identifier of the target random key.

[0136] Optionally, since the quantum cryptography management service system pre-stores multiple sets of random key information, the receiving terminal can determine the target random key through the identifier of the target random key and the pre-stored multiple sets of random key information.

[0137] S603. Decrypt the encrypted data according to the target random key to obtain the data to be encrypted.

[0138] Specifically, there may be preset separation data after the encrypted data, and the data before the preset separation data is decrypted according to the target random key to obtain the data to be encrypted.

[0139] In this embodiment, the identification encrypted data is parsed according to the target injection key to obtain the identification and position identification of the target random key, and the encrypted data is decrypted according to the target random key corresponding to the identification of the target random key to obtain the data to be encrypted. In this process, encrypting the identification of the target random key with the injection key of the receiving end can ensure that only the receiving end device can decrypt and obtain the identification of the target random key, thereby obtaining the original data, which can improve data security and simplify the encryption and decryption process.

[0140] As an optional implementation, Figure 7 As shown, before the above step S501, that is, before sending multiple injection keys and the identifiers of each injection key to the sending end device through the quantum relay network, the following method steps may also be included. Among them, Figure 7 It is a flowchart of another identity authentication method provided in an embodiment of the present application.

[0141] S701. Determine the injection key injected by the quantum key injection module into the quantum security chip of the receiving device.

[0142] Specifically, the quantum key injection module at the receiving end injects the quantum key sent by the quantum key distribution module into the quantum security chip in the receiving end device and the quantum cryptography management service system at the receiving end at the same time, so that the injection key in the quantum security chip and the injection key in the quantum cryptography management service system are the same, so as to complete identity authentication.

[0143] S702: Obtain user login information.

[0144] It is worth noting that before obtaining the user login information, the receiving terminal obtains the user information entered by the user when registering or activating the account, and stores the user information in the receiving quantum cryptography management service system. At the same time, the quantum cryptography management service system binds the user information and the quantum security chip.

[0145] Exemplarily, the user login information may be a user account name and a user login password, etc.

[0146] As an optional implementation, after obtaining the user login information, it is stored in the quantum security chip.

[0147] S703. The quantum security chip in the receiving device encrypts the user login information based on the injected key to obtain authentication information.

[0148] Specifically, the quantum security chip in the receiving device first encrypts the user login information based on the injection key, and then converts the encrypted information using the standard hash algorithm of the cryptographic hash function to obtain an encrypted hash value, which is used as the authentication information.

[0149] S704, sending the authentication information to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-charged charging key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

[0150] Specifically, the quantum cryptography management service system at the receiving end first encrypts the pre-stored user information using the injection key, and then converts the encrypted information using the standard hash algorithm of the cryptographic hash function to obtain the identity comparison information. The received authentication information is then compared with the identity comparison information. If the comparison results are consistent, the identity authentication result is determined to be a successful authentication. If the comparison results are inconsistent, the identity authentication result is determined to be an authentication failure. It is worth mentioning that if the identity authentication result is an authentication failure, an authentication failure warning is output, and the steps in the above steps S501-S505 are stopped.

[0151] In this embodiment, the charging key and user login information are received, the user login information is encrypted and calculated based on the charging key to obtain authentication information, and the authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the user information and the pre-charged charging key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result. In this embodiment, the user is authenticated to ensure that the sending and receiving objects of the data are correct, thereby ensuring data security.

[0152] As an optional implementation, the specific process of obtaining the original data by splicing the encrypted data and the position identifier corresponding to each encrypted data in step S505 includes:

[0153] Optionally, determining the splicing order of each data to be encrypted according to the position data of each data to be encrypted;

[0154] Optionally, each data to be encrypted is combined in a concatenation order to obtain original data.

[0155] The concatenation order of the data to be encrypted may be the arrangement order of the data to be encrypted in the original data.

[0156] In this embodiment, the splicing order of each data to be encrypted is determined according to the position data of each data to be encrypted, and the data to be encrypted are merged according to the splicing order to obtain the original data, thereby obtaining the complete data sent by the sending end device to complete the data transmission.

[0157] As an optional implementation, Figure 8 1 is a flowchart of a file segmentation processing method based on quantum key distribution provided by an embodiment of the present application. Figure 8 As shown, the file segmentation processing method is generally described below.

[0158] The sending device and the receiving device complete identity authentication in advance to ensure the integrity and confidentiality of the user's identity. After successful authentication, the sending device obtains the identifier of the receiving end's quantum key distribution module from the password management service platform in the quantum relay network through the sending end's quantum cryptography management service system, and sends a key charging request message to the receiving end device through the password management service platform. The receiving end device sends multiple charging keys and multiple charging key identifiers to the sending end device through the password management service platform according to the charging key request message, and marks the multiple charging keys sent as used. The sending end device obtains multiple random key information through the quantum key distribution network controller in the quantum relay network according to the identifier of the sending end's quantum key distribution module and the identifier of the receiving end's quantum key distribution module, and the receiving end device obtains the same multiple random key information through the receiving end's quantum cryptography management service system and the receiving end's key manager.

[0159] The sending end device segments the original data to obtain multiple data to be encrypted, and allocates a target labeling key and a target random key to each data to be encrypted. For any data to be encrypted among the multiple data to be encrypted, the sending end device encrypts the data to be encrypted according to the target random key corresponding to the data to be encrypted, and obtains the encrypted data corresponding to the data to be encrypted. According to the target charging key corresponding to the data to be encrypted, the identifier and position identifier of the target random key are encrypted to obtain the identifier encrypted data, the identifier encrypted data and the identifier of the target charging key are added to the encrypted data, the target data corresponding to the data to be encrypted is obtained, and the target data is sent to the receiving end device.

[0160] The receiving end device receives multiple target data from the sending end, obtains each target charging key according to the identifier of each target charging key, decrypts the identified encrypted data according to each target charging key, obtains the identifiers and position identifiers of multiple random keys, determines multiple target random keys according to the identifiers of the multiple random keys, decrypts the encrypted data using the target random keys, obtains the data to be encrypted corresponding to the encrypted data, and splices the original data according to the data to be encrypted and the position identifier corresponding to the encrypted data.

[0161] The embodiment of the present application also provides a file segmentation processing system, the system comprising a sending end device, a receiving end device and a quantum relay network;

[0162] The sending end device is used to execute the steps of the file segment encryption processing method based on quantum key distribution, and the receiving end device is used to execute the steps of the file segment decryption processing method based on quantum key distribution.

[0163] The present application also provides an electronic device, such as Fig. 9 As shown, it is a structural schematic diagram of an electronic device provided by an embodiment of the present application, including: a processor 901, a memory 902 and a bus. The memory 902 stores machine-readable instructions executable by the processor 901. When the computer device is running, the processor 901 communicates with the memory 902 through the bus. The machine-readable instructions are executed by the processor 901 to perform the steps of the file segment encryption processing method based on quantum key distribution, and the receiving end device is used to perform the steps of the file segment decryption processing method based on quantum key distribution.

[0164] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a file segment encryption processing method based on quantum key distribution are executed, and a receiving device is used to execute the steps of a file segment decryption processing method based on quantum key distribution.

[0165] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0166] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0167] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A file segment encryption processing method based on quantum key distribution, characterized in that: A sending end device applied to a file segmentation processing system; the method comprises: Acquire multiple charging keys and identifiers of each charging key from a receiving device through a quantum relay network, and acquire multiple groups of random key information through the quantum relay network, each group of random key information including a random key and an identifier of the random key; Segmenting the original data to obtain a plurality of data to be encrypted, and assigning a target injection key and a target random key to each data to be encrypted; For any data to be encrypted among the multiple data to be encrypted, encrypt the data to be encrypted according to a target random key corresponding to the data to be encrypted, to obtain encrypted data corresponding to the data to be encrypted; Encrypting the identifier and the position identifier of the target random key according to the target charging key corresponding to the data to be encrypted to obtain identifier encrypted data, wherein the position identifier is used to identify the position of the data to be encrypted in the original data; The identification encryption data and the identification of the target charging key are added to the encrypted data to obtain the target data corresponding to the data to be encrypted, and the target data is sent to the receiving end device.

2. The file segment encryption processing method based on quantum key distribution according to claim 1 is characterized in that: The step of adding the identification encryption data and the identification of the target charging key to the encrypted data to obtain the target data corresponding to the data to be encrypted includes: Adding preset separation data at the end of the encrypted data; The identification encrypted data is added to the end of the separated data to obtain the target data.

3. The file segment encryption processing method based on quantum key distribution according to claim 1 is characterized in that: Before obtaining multiple charging keys and identifiers of each charging key from the receiving end device through the quantum relay network, the method further includes: Determine the injection key injected by the quantum key injection module into the quantum security chip of the sending end device; Get user login information; The quantum security chip in the sending end device performs encryption calculation on the user login information based on the injection key to obtain authentication information; The authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-filled key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

4. The file segment encryption processing method based on quantum key distribution according to claim 1 is characterized in that: The step of obtaining multiple charging keys and identifications of each charging key from a receiving device through a quantum relay network includes: The quantum cryptography management service system obtains the identifier of the quantum key distribution module of the receiving end from the cryptography management service platform of the quantum relay network, and receives multiple injection keys and the identifiers of each injection key sent by the receiving end device.

5. The file segment encryption processing method based on quantum key distribution according to claim 4 is characterized in that: The obtaining of multiple sets of random key information through the quantum relay network includes: The identifier of the quantum key distribution module at the sending end and the identifier of the quantum key distribution module at the receiving end are sent to the quantum key distribution network controller of the quantum relay network, so that the quantum key distribution network controller determines the multiple groups of random key information according to the identifier of the quantum key distribution module at the sending end, the identifier of the quantum key distribution module at the receiving end and the key manager topology link in the quantum relay network.

6. A file segment encryption processing method based on quantum key distribution, characterized in that: A receiving device applied to a file segment encryption system, the method comprising: Sending multiple charging keys and identifiers of each charging key to a transmitting end device through a quantum relay network, and obtaining multiple groups of random key information through the quantum relay network; Receive multiple target data from a sending end device, each target data includes: encrypted data, identification encrypted data and an identification of a target charging key, the identification encrypted data includes: an encryption result of an identification of a target random key corresponding to the encrypted data, and an encryption result of a position identification, the position identification is used to identify a position of the to-be-encrypted data corresponding to the encrypted data in the original data; Acquire each of the target charging keys according to the identifier of each of the target charging keys; Decrypting the encrypted data according to each of the target charging keys and each of the identification encrypted data to obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted; The original data is obtained by splicing the data to be encrypted and the position identifier corresponding to each encrypted data.

7. The file segment decryption processing method based on quantum key distribution according to claim 6 is characterized in that: The decrypting the encrypted data according to each of the target charging keys and each of the identification encrypted data to obtain the data to be encrypted corresponding to the encrypted data and the location identifier of the data to be encrypted includes: Decrypting the identification encrypted data according to the target charging key to obtain the identification of the target random key and the location identification; Acquire the target random key according to the identifier of the target random key; The encrypted data is decrypted according to the target random key to obtain the data to be encrypted.

8. The file segment decryption processing method based on quantum key distribution according to claim 6 is characterized in that: Before sending a plurality of injection keys and identifiers of each injection key to the transmitting end device through the quantum relay network, the method further comprises: Determine the injection key injected by the quantum key injection module into the quantum security chip of the receiving end device; Get user login information; The quantum security chip in the receiving device performs encryption calculation on the user login information based on the injection key to obtain authentication information; The authentication information is sent to the quantum cryptography management service system, so that the quantum cryptography management service system determines the identity comparison information based on the pre-stored user information and the pre-filled key, matches the authentication information based on the identity comparison information, and thus determines the identity authentication result.

9. The file segment decryption processing method based on quantum key distribution according to claim 6 is characterized in that: The step of splicing the encrypted data and the position identifiers corresponding to the encrypted data to obtain the original data comprises: Determining the splicing order of each of the data to be encrypted according to the position data of each of the data to be encrypted; The data to be encrypted are combined in the splicing order to obtain the original data.

10. A file segmentation processing system, characterized in that: The system includes a transmitting device, a receiving device and a quantum relay network; The sending end device is used to execute the steps of the file segment encryption processing method based on quantum key distribution as described in any one of claims 1-5, and the receiving end device is used to execute the steps of the file segment decryption processing method based on quantum key distribution as described in any one of claims 6-9.

11. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-readable instructions to execute the steps of the file segment encryption processing method based on quantum key distribution as described in any one of claims 1 to 5, or executes the steps of the file segment decryption processing method based on quantum key distribution as described in any one of claims 6 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the file segment encryption processing method based on quantum key distribution as described in any one of claims 1 to 5, or executes the steps of the file segment decryption processing method based on quantum key distribution as described in any one of claims 6 to 9.

Images