Secure communication method based on quantum key

Abstract

The invention provides a secure communication method based on a quantum key, and relates to the technical field of password application. The method comprises the following steps: acquiring a serial number of a target charging key from a security chip in a communication module, and generating client handshake information; sending the client handshake information to a gateway device, so that the gateway device obtains the target charging key from the quantum password management service platform according to the serial number of the target charging key, generates a server handshake message, and receives the server handshake message and a server certificate sent by the gateway device; calling a security chip to authenticate the server certificate, generating a first working key, and sending a client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum password management service platform, and generating a second working key; and finally, according to the first working key and the second working key, establishing a VPN tunnel between the communication module and the gateway equipment for transmitting a service data message.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic application technology, and in particular to a quantum key-based secure communication method. Background Art

[0002] The Internet of Things is a large, intelligent network formed by combining various information sensing devices, such as radio frequency identification devices, various sensor nodes, and various wireless communication devices with the Internet, integrating key technologies such as RFID, sensors, wireless networks, artificial intelligence, and cloud computing. The biggest difference between the Internet of Things and the Internet and mobile Internet is the addition of a large number of nodes in the perception layer and edge layer, which breaks through the original IT architecture. The system boundary is further expanded, which is the organic integration of the cloud and perception nodes / edge nodes. Therefore, the security issues and challenges it faces are also quite different from those of cloud resources and traditional hardware products, mainly manifested in the following aspects: fragmentation of device resources, a wide variety of communication protocols, more openness, and harsh deployment environment. In particular, the identity authentication security and data security mechanisms that run through the three levels of cloud, pipe, and end are the core issues of the current Internet of Things security, and are also practical issues that need to be studied and solved urgently.

[0003] IoT terminal devices generally connect to the network through Bluetooth, WiFi, ZigBee and 4G, and then interact with the IoT business platform. However, the current data transmission methods basically do not use secure encryption technology or use software encryption methods with very low security levels, which are insufficient to meet their own security needs. In addition, in the negotiation process of working keys, the generation of keys often involves the plaintext transmission of key exchange information such as key parameters and key generation operations, and the use of asymmetric public keys to encrypt the keys and transmit them to the other end in ciphertext. The other end uses a private key to decrypt the keys to obtain the keys. With the realization of large-scale quantum computers, it will have a certain impact on key negotiation, encryption, signature and other applications in classical cryptography. This key synchronization method will give attackers the opportunity to crack the keys. Summary of the invention

[0004] The purpose of the present invention is to provide a quantum key-based secure communication method to address the deficiencies in the above-mentioned prior art, so that on the basis of existing IoT terminal devices and IoT business platforms, a communication module with an integrated security chip, a quantum cryptography management service platform and a gateway device are added to form a complete secure communication channel for data transmission, namely a VPN tunnel, which can ensure the reliability, security and integrity of business data message transmission.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a quantum key-based secure communication method, which is applied to a control unit in a communication module in an Internet of Things terminal, and the method includes:

[0007] Obtaining the serial number of the target injection key from the security chip in the communication module and generating client handshake information;

[0008] Sending the client handshake information to a gateway device, so that the gateway device obtains the target charging key from a quantum cryptography management service platform according to the serial number of the target charging key, and generates a server handshake message;

[0009] Receive the server handshake message and server certificate sent by the gateway device;

[0010] Calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key;

[0011] Sending the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key;

[0012] A VPN tunnel is established between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the Internet of Things terminal and the Internet of Things service platform.

[0013] In an optional implementation, the obtaining of the serial number of the target injection key from the security chip in the communication module and generating the client handshake information includes:

[0014] Determine an unused charging key from the multiple charging keys of the security chip as the target charging key, and obtain the serial number of the target charging key;

[0015] The client handshake information is generated according to the serial number of the target injection key and the device identification of the communication module.

[0016] In an optional implementation manner, before obtaining the serial number of the target injection key from the security chip in the communication module and generating the client handshake information, the method further includes:

[0017] Sending a key charging request to the quantum cryptography management service platform so that the quantum cryptography management service platform generates a charging key file; the charging key file includes: multiple charging keys;

[0018] Obtaining the injection key file returned by the quantum cryptography management service platform;

[0019] The charging key file is stored in the security chip.

[0020] In an optional implementation manner, calling the security chip to authenticate the server certificate and generating a first working key in the security chip according to the target injection key includes:

[0021] Calling the authentication interface of the security chip to authenticate the server certificate;

[0022] Calling the algorithm interface of the security chip, calculating the first master key according to the target injection key, the first client random number, the first server random number, and the constant character string, and calculating the first working key according to the first master key;

[0023] The first working key is stored in the security chip.

[0024] In an optional embodiment, the method further comprises:

[0025] Acquire a first service data message generated by a service module in the Internet of Things terminal;

[0026] Calling the security chip, encrypting the first service data message according to the first working key, and encapsulating it into a first service data ciphertext;

[0027] Based on the VPN tunnel, the first business data ciphertext is sent to the gateway device, so that the gateway device calls the quantum cryptography management service platform, decapsulates and decrypts the first business data ciphertext according to the second working key, obtains the first business data message, and forwards it to the Internet of Things business platform.

[0028] In an optional embodiment, the method further comprises:

[0029] If it is detected that the VPN tunnel is disconnected, or the connection duration of the VPN tunnel exceeds a preset duration, the target injection key in the security chip is destroyed.

[0030] In a second aspect, an embodiment of the present application further provides a quantum key-based secure communication method, which is applied to a gateway device; the method includes:

[0031] Receiving client handshake information sent by a control unit in a communication module in an IoT terminal, wherein the client handshake information is the client handshake information generated by the control unit after obtaining the serial number of the target injection key from the security chip in the communication module;

[0032] Obtain the target charging key from the quantum cryptography management service platform according to the serial number of the target charging key, and generate a server-side handshake message;

[0033] Sending the server handshake message and the server certificate to the control unit, so that the control unit calls the security chip to authenticate the server certificate, and generates a first working key in the security chip according to the target injection key;

[0034] Receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key;

[0035] A VPN tunnel is established between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the Internet of Things terminal and the Internet of Things service platform.

[0036] In an optional implementation, the receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key includes:

[0037] Calling the authentication interface of the quantum cryptography management service platform to authenticate the client certificate;

[0038] Calling the algorithm interface of the quantum cryptography management service platform, the target charging key, the second client random number, the second server random number, and the constant string, calculating the second master key, and calculating the second working key according to the second master key;

[0039] The second working key is stored in the gateway device.

[0040] In an optional embodiment, the method further comprises:

[0041] Obtain a second service data message generated by a service module in the Internet of Things service platform;

[0042] Calling the quantum cryptography management service platform, encrypting the second service data message according to the second working key, and encapsulating it into a second service data ciphertext;

[0043] Based on the VPN tunnel, the second business data ciphertext is sent to the communication module, so that the communication module calls the security chip, decapsulates and decrypts the second business data ciphertext according to the first working key, and obtains the second business data message.

[0044] In an optional embodiment, the method further comprises:

[0045] If it is detected that the VPN tunnel is disconnected, or the connection duration of the VPN tunnel exceeds a preset duration, the target injection key in the quantum cryptography management service platform is destroyed.

[0046] The beneficial effects of this application are:

[0047] The embodiment of the present application provides a quantum key-based secure communication method, which is applied to a control unit in a communication module in an Internet of Things terminal. The method includes: obtaining a serial number of a target injection key from a security chip in the communication module and generating client handshake information; sending the client handshake information to a gateway device, so that the gateway device obtains the target injection key from a quantum cryptography management service platform according to the serial number of the target injection key, and generates a server handshake message, and receives the server handshake message and server certificate sent by the gateway device; calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key, sending the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key; finally, establishing a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, for transmitting business data messages between the Internet of Things terminal and the Internet of Things business platform. The method of the present application adds a communication module with an integrated security chip, a quantum cryptography management service platform and a gateway device to the existing IoT terminal equipment and IoT business platform, forming a complete secure communication channel for data transmission, namely a VPN tunnel, which can ensure the reliability, security and integrity of business data message transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A schematic diagram of a quantum key-based secure communication system provided in an embodiment of the present application;

[0050] Figure 2 One of the flow charts of a quantum key-based secure communication method provided in an embodiment of the present application;

[0051] Figure 3A second flowchart of a quantum key-based secure communication method provided in an embodiment of the present application;

[0052] Figure 4 A third flow chart of a secure communication method based on quantum keys provided in an embodiment of the present application;

[0053] Figure 5 A fourth flowchart of a quantum key-based secure communication method provided in an embodiment of the present application;

[0054] Figure 6 A fifth flow chart of a secure communication method based on quantum keys provided in an embodiment of the present application;

[0055] Figure 7 A sixth flow chart of a quantum key-based secure communication method provided in an embodiment of the present application;

[0056] Figure 8 A flowchart of a quantum key-based secure communication method provided in an embodiment of the present application is shown in FIG7;

[0057] Fig. 9 FIG8 is a flowchart of a quantum key-based secure communication method provided in an embodiment of the present application;

[0058] Fig.10 A schematic diagram of functional modules of a quantum key-based secure communication device provided in an embodiment of the present application;

[0059] Fig.11 A schematic diagram of the functional modules of another quantum key-based secure communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0061] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0062] In the description of the present application, it should be noted that if the terms "upper", "lower", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the application is usually placed when used. It is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.

[0063] In addition, the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0064] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0065] In order to better understand the solutions provided by the following embodiments of the present application, the technical terms involved in the following embodiments of the present application are first explained here.

[0066] The CSP (Cryptographic Service Provider) platform is the quantum cryptographic management service platform in the embodiment of the present application. It is a platform that provides cryptographic and key services for mobile Internet, Internet of Things and other services based on the quantum key network, and includes subsystems such as cryptographic service platform software, exchange cipher machines, and charging terminal software.

[0067] SSL (Secure Sockets Layer) is a protocol used to encrypt Internet traffic and verify the identity of the server.

[0068] The PRF (Pseudorandom Function) algorithm is an important algorithm used to generate key materials in the SSL / TLS protocol. During the SSL / TLS handshake process, the PRF is used to derive the master key from the pre-master key, and then derive the working key from the master key. The working key is used to encrypt and decrypt actual data transmission.

[0069] Figure 1A schematic diagram of a quantum key-based secure communication system provided in an embodiment of the present application, such as Figure 1 As shown, the secure communication system based on quantum keys includes: Internet of Things terminals, gateway devices, quantum cryptography management service platform and Internet of Things business platform, among which, the Internet of Things business platform and the gateway device establish a private network connection, and the gateway device and the quantum cryptography management service platform establish a private network connection, and the Internet of Things terminal establishes a communication channel through the integrated communication module and the gateway device.

[0070] Specifically, the IoT terminal hardware is integrated with a communication module, and the communication module interacts with the IoT terminal main control chip through AT commands, so that the IoT terminal main control chip calls the SSL VPN tunnel encryption capability provided by the communication module through AT commands, thereby realizing the secure encryption of the IoT terminal business data and sending it to the IoT business platform.

[0071] The communication module is a hardware product of a 4G Cat.1 communication module. The communication module includes a radio frequency transceiver, a power amplifier, a filter, a baseband processor, a control unit, a security chip, etc. The communication module is directly integrated on the circuit board of the Internet of Things terminal. The hardware of the communication module provided in the embodiment of the present application is integrated with a security chip, and the software system integrates the SSL VPN client software program, so as to provide SSL VPN tunnel encryption services and data transmission control functions. Among them, the security chip is a national secret chip. The security chip can adopt a 32-bit CPU architecture, support 7816, SPI, UART, I2C interfaces, support SM1, SM2, SM3, SM4, SM7, SHA, DES, AES, RSA and ECC and other algorithms, and establish a multi-level chip security protection system from the algorithm level, circuit level, system level to the software layer, which meets the commercial secret level 2 security standard and can meet the industrial and automotive grade reliability requirements. Therefore, the security chip has hardware encryption and decryption, signature verification, PRF and other algorithm capabilities and secure storage space to ensure hardware-level security compliance, and internally preset multiple injection keys generated by the quantum cryptography service platform.

[0072] Specifically, the communication module interacts with the main control chip of the IoT terminal through AT commands, and the control unit of the communication module interacts with the security chip through APDU commands; the control unit of the communication module communicates with the main control chip of the IoT terminal through communication interfaces such as I2C, SPI, and UART. At the same time, the embedded program of the main control chip of the IoT device needs to call the embedded (Software Development Kit, SDK) interface program that matches the communication module to complete the call of the specific functions of the communication module. Among them, the embedded SDK is a part of the main control program in the main control chip of the IoT device, and can be customized and compiled according to the development environment used by the main control chip of the IoT terminal. The communication module embedded SDK also integrates the SSL VPN client software program, and the cryptographic algorithm functions such as digital signatures and encryption / decryption required in the SSL security protocol are all processed by the operation interface provided by the security chip.

[0073] The gateway device is an SSL VPN gateway device, which is integrated with the SSL VPN server software program and connected to the Internet of Things business platform and the quantum cryptography management service platform. The gateway device calls the interface provided by the quantum cryptography management service platform to perform encryption and decryption operations, thereby encrypting and decrypting business data messages, and forwarding the decrypted business data to the Internet of Things business platform.

[0074] The quantum cryptography management service platform provides quantum key storage and encryption and decryption computing capabilities, connects to the SSL VPN gateway, and provides an interface for obtaining injection keys, providing key injection functions for communication modules in IoT terminals.

[0075] In order to ensure the reliability, security and integrity of data transmission between an IoT terminal and an IoT service platform, the present application provides a quantum key-based secure communication method, which is applied to a control unit in a communication module in an IoT terminal, by obtaining a serial number of a target injection key from a security chip in the communication module and generating client handshake information; sending the client handshake information to a gateway device, so that the gateway device obtains the target injection key from a quantum cryptography management service platform according to the serial number of the target injection key, and generates a server handshake message, and receives the server handshake message and server certificate sent by the gateway device; calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key, sending the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key; finally, according to the first working key and the second working key, establishing a VPN tunnel between the communication module and the gateway device for transmitting business data messages between the IoT terminal and the IoT service platform. Based on the existing IoT terminal devices and IoT business platforms, communication modules with integrated security chips, quantum cryptography management service platforms and gateway devices are added to form a complete secure communication channel for data transmission, which can ensure the reliability, security and integrity of business data message transmission.

[0076] The quantum key-based secure communication method provided by the present application is illustrated below with multiple examples in conjunction with the accompanying drawings. The quantum key-based secure communication method is applied to a control unit in a communication module in an Internet of Things terminal. Figure 2 One of the flow charts of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 2 As shown, the method includes:

[0077] S101, obtaining the serial number of the target injection key from the security chip in the communication module, and generating client handshake information.

[0078] In this embodiment, the security chip stores multiple injection keys, obtains the serial number of the target injection key from them, and fills the serial number of the target injection key in the extended field of the client handshake information, i.e., the Client Hello message based on the SSL protocol, to generate the client handshake information.

[0079] Among them, the client handshake information is the initial interactive content of the communication module initiating a secure communication connection with the gateway device. The client handshake information will contain important information such as the communication protocol version supported by the communication module itself, the client random number generated by itself, and the serial number of the target injection key, informing the gateway device of some of its own communication preparations and associated key identifiers, in preparation for subsequent negotiations to establish a secure connection.

[0080] S102, sending the client handshake information to the gateway device, so that the gateway device obtains the target injection key from the quantum cryptography management service platform according to the serial number of the target injection key, and generates a server handshake message.

[0081] Specifically, after receiving the handshake information from the client, the gateway device will extract the serial number of the target injection key, and then initiate a request to the quantum cryptography management service platform to obtain the corresponding target injection key based on the serial number of the target injection key. As a platform for centralized management and storage of security resources such as keys, the quantum cryptography management service platform can find and provide the corresponding target injection key to the gateway device based on the serial number based on a strict authority management and search mechanism.

[0082] After obtaining the target injection key, the gateway device will generate a server handshake message. The server handshake message also contains some communication configuration information related to the gateway device itself, such as the supported protocol version and the client random number generated by itself, which is used to respond to the client handshake information of the communication module and continue to promote the process of establishing a secure connection between the two parties.

[0083] S103: Receive a server handshake message and a server certificate sent by the gateway device.

[0084] S104: calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key.

[0085] Specifically, the communication module receives the server handshake message and server certificate sent by the gateway device, and uses the functions in the security chip and the stored related trust roots, verification algorithms and other resources to authenticate the received server certificate. For example, verify whether the issuing authority of the certificate is legal, whether the certificate is within the validity period, whether the certificate content has been tampered with, etc. Only through these strict verification processes can the identity of the gateway device be confirmed to be reliable, and subsequent communications can continue based on trust.

[0086] After confirming that the server certificate is valid, the communication module will inject the key according to the target and use the PRF algorithm to generate the first working key inside the security chip. The first working key is used for subsequent encrypted communication with the gateway device, data integrity verification and other operations.

[0087] S105. Send the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key.

[0088] The communication module sends its own client certificate to the gateway device so that the gateway device can verify the identity of the communication module. The client certificate also contains relevant information that can prove the identity of the communication module and is the identifier of the legal identity of the communication module in the entire secure communication system.

[0089] After receiving the client certificate, the gateway device will submit it to the quantum cryptography management service platform for authentication. The quantum cryptography management service platform determines the legitimacy of the client certificate based on the trust information and verification rules stored in itself. After the authentication is passed, the second working key is generated using the PRF algorithm based on the target injection key. Among them, the second working key corresponds to the first working key generated by the communication module, and the two are subsequently used together for secure communication operations such as encryption and decryption between the two parties.

[0090] S106. Establish a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the IoT terminal and the IoT service platform.

[0091] Specifically, after the communication module and the gateway device have generated the first working key and the second working key respectively, the two parties establish an SSL VPN (virtual private network) tunnel based on the negotiated working keys through specific encryption, encapsulation and other network communication technical means. The SSL VPN tunnel opens up a secure communication channel between the IoT terminal and the IoT service platform in the public network environment, and builds an exclusive, encrypted pipeline.

[0092] When the VPN tunnel is successfully established, the service data packets between the IoT terminal and the IoT service platform can be transmitted through the VPN tunnel. During the transmission process, the service data packets will be encrypted and decrypted using the encryption and decryption algorithm based on the first working key and the second working key to ensure the confidentiality of the service data packets.

[0093] In summary, an embodiment of the present application provides a quantum key-based secure communication method, which is applied to a control unit in a communication module in an Internet of Things terminal. The method includes: obtaining the serial number of the target injection key from the security chip in the communication module and generating client handshake information; sending the client handshake information to a gateway device, so that the gateway device obtains the target injection key from the quantum cryptography management service platform according to the serial number of the target injection key, and generates a server handshake message, and receives the server handshake message and server certificate sent by the gateway device; calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key, sending the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key; finally, according to the first working key and the second working key, establishing a VPN tunnel between the communication module and the gateway device for transmitting business data messages between the Internet of Things terminal and the Internet of Things business platform. The method of the present application adds a communication module with an integrated security chip, a quantum cryptography management service platform and a gateway device to the existing IoT terminal equipment and IoT business platform, forming a complete secure communication channel for data transmission, namely a VPN tunnel, which can ensure the reliability, security and integrity of business data message transmission.

[0094] Based on the above embodiments, the present application also provides another possible implementation of a quantum key-based secure communication method. Figure 3 A second flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 3 As shown, the serial number of the target injection key is obtained from the security chip in the communication module, and the client handshake information is generated, including:

[0095] S201. Determine an unused charging key from multiple charging keys of a security chip as a target charging key, and obtain a serial number of the target charging key.

[0096] In this embodiment, multiple charging keys are pre-stored in the security chip of the communication module. In order to ensure the security of each communication connection and the standardization of key use, it is necessary to select a charging key that has not been used from the multiple charging keys as the target charging key corresponding to this communication. If a charging key that has been used in other communication processes is reused, there may be security risks, such as the key being cracked or the information being leaked, etc., which can be used by criminals. Therefore, an unused charging key is selected to ensure that each new communication connection has an independent, secure and reliable key basis.

[0097] Since each charging key has a corresponding unique serial number, obtaining the serial number of the target charging key allows the gateway device to accurately obtain the corresponding target charging key from the quantum cryptography management service platform based on the serial number.

[0098] S202: Generate client handshake information according to the serial number of the target injection key and the device identification of the communication module.

[0099] The device identification of the communication module is the unique identification of the communication module in the IoT terminal system or a specific network environment. By obtaining the device identification of the communication module, the gateway device can accurately determine the communication module that initiated the connection request, and it is also convenient for accurate identity verification in subsequent authentication and other links to avoid security issues such as illegal device impersonation.

[0100] The serial number of the target injection key and the device identification of the communication module are filled in the extended field of the client handshake information, that is, the Client Hello message based on the SSL protocol, and finally the client handshake information is generated.

[0101] In the method provided in the embodiment of the present application, an unused injection key is determined from multiple injection keys of the security chip as the target injection key, and the serial number of the target injection key is obtained; client handshake information is generated according to the serial number of the target injection key and the device identification of the communication module, and the client handshake information is generated by reasonably selecting the target injection key and obtaining its serial number, and then combining the device identification of the communication module itself, in preparation for subsequently establishing a secure and reliable communication connection with the gateway device.

[0102] The present application also provides another possible implementation of a quantum key-based secure communication method. Figure 4 A third flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 4 As shown, before obtaining the serial number of the target injection key from the security chip in the communication module and generating the client handshake information, the method also includes:

[0103] S301. Send a key injection request to the quantum cryptography management service platform so that the quantum cryptography management service platform generates an injection key file.

[0104] The charging key file includes: multiple charging keys.

[0105] In this embodiment, the communication module sends a key charging request to the quantum cryptography management service platform through the key charging terminal in advance, so that the quantum cryptography management service platform generates a charging key file according to the established security policy. The charging key file contains multiple charging keys, each of which has unique encryption properties and functions, providing a rich key reserve for the subsequent secure communication between the communication module and the gateway device.

[0106] S302. Obtain the charging key file returned by the quantum cryptography management service platform.

[0107] S303: Store the charging key file in the security chip.

[0108] Specifically, through the corresponding network communication interface and secure data transmission mechanism, the communication module receives the charging key file from the quantum cryptography management service platform, and stores the charging key file in the secure storage space of the security chip.

[0109] In the method provided in the embodiment of the present application, a key charging request is sent to the quantum cryptography management service platform so that the quantum cryptography management service platform generates a charging key file; the charging key file includes: multiple charging keys; the charging key file returned by the quantum cryptography management service platform is obtained, and the charging key file is stored in the security chip, so that the quantum cryptography management service platform and the security chip store the same charging key, thereby ensuring that the quantum cryptography management service platform can find the target charging key according to the serial number of the target charging key.

[0110] The present application embodiment also provides another possible implementation of a quantum key-based secure communication method. Figure 5 A fourth flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 5 As shown, calling the security chip to authenticate the server certificate and generating a first working key in the security chip according to the target injection key includes:

[0111] S401: Call the authentication interface of the security chip to authenticate the server certificate.

[0112] S402, calling the algorithm interface of the security chip, calculating the first master key according to the target injection key, the first client random number, the first server random number, and the constant character string, and calculating the first working key according to the first master key.

[0113] S403: Store the first working key in the security chip.

[0114] In this embodiment, a special authentication interface is provided inside the security chip, which is used to handle the external interaction channel of the functional module for various certificate authentication related operations. In the process of establishing a secure connection between the communication module and the gateway device, after receiving the server certificate sent by the gateway device, the authentication interface is called to verify the server certificate. It integrates a set of authentication rules and verification mechanisms preset inside the security chip, and can conduct rigorous verification of the legitimacy, integrity and validity of the server certificate based on relevant standards and trust models.

[0115] For example, check whether the issuing authority of the certificate is a trusted authority and verify whether the certificate is within the validity period. An expired certificate can obviously no longer be used to prove identity and ensure secure communication. In addition, check whether the certificate content has been tampered with. By verifying the digital signature and other information in the certificate, its integrity is ensured. If the certificate content has been tampered with, there is a high possibility of security risks such as man-in-the-middle attacks. Only when the server certificate successfully passes these verifications performed by the authentication interface can the identity of the gateway device be confirmed to be reliable.

[0116] Specifically, the algorithm interface of the security chip is the key entry point for implementing various core algorithm operations such as encryption and key generation. It encapsulates advanced, secure and reliable encryption algorithms, key derivation algorithms and other functional modules. By calling the algorithm interface, the PRF algorithm is used to calculate the first master key based on the target injection key, the first client random number, the first server random number, and the constant string, and the PRF algorithm is used again to calculate the first working key based on the first master key. Among them, the first client random number is a random value generated by the communication module as a client role when the handshake is initially initiated, that is, the random number saved in the client handshake information, and the first server random number is the random number saved in the server handshake message sent by the gateway device. Finally, the first working key is stored in the security chip.

[0117] In the method provided in the embodiment of the present application, the authentication interface of the security chip is called to authenticate the server certificate; the algorithm interface of the security chip is called to calculate the first master key according to the target injection key, the first client random number, the first server random number, and the constant character string, and the first working key is calculated according to the first master key; finally, the first working key is stored in the security chip, and the authentication of the server certificate and the generation and storage of the key first working key are completed by calling different functional interfaces inside the security chip, thereby laying a solid foundation for building a secure communication connection between the communication module and the gateway device.

[0118] The present application embodiment also provides another possible implementation of a quantum key-based secure communication method. Figure 6 A fifth flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 6 As shown, the method includes:

[0119] S501. Obtain a first service data message generated by a service module in an Internet of Things terminal.

[0120] S502: Call the security chip to encrypt the first service data message according to the first working key and encapsulate it into a first service data ciphertext.

[0121] S503. Based on the VPN tunnel, the first business data ciphertext is sent to the gateway device, so that the gateway device calls the quantum cryptography management service platform, decapsulates and decrypts the first business data ciphertext according to the second working key, obtains the first business data message, and forwards it to the Internet of Things business platform.

[0122] In this embodiment, the service module in the Internet of Things terminal generates a first service data message, the main control chip in the Internet of Things terminal matches the configured route according to the destination address of the first service data message, forwards the first service data message to the virtual network card, and the SSL VPN client software program reads the first service data message in the virtual network card.

[0123] Then, the encryption operation is performed using the first working key generated and stored in the security chip. The first working key is obtained through a complex key negotiation and generation process, has unique encryption properties, and matches the second working key corresponding to the gateway device. Through the encryption algorithm integrated inside the security chip, the first working key is used as the key parameter to encrypt the first business data message, and convert the first business data message in plain text into ciphertext. After completing the encryption operation, the encrypted content needs to be encapsulated to form the first business data ciphertext. The encapsulation process may involve adding some additional header information, verification information, etc., which helps the gateway device to accurately identify, decapsulate, and perform subsequent processing operations.

[0124] Based on the VPN tunnel, the first business data ciphertext is sent to the gateway device. After the gateway device receives the first business data ciphertext, it needs to perform decapsulation and decryption operations to restore it to the original first business data message. First, the gateway device will call the quantum cryptography management service platform, and use the relevant functions provided by the platform and the second working key generated by itself to perform decapsulation and decryption operations. The decapsulation process is to remove the additional content such as header information and verification information previously added to the IoT terminal, and restore the encrypted data part. Then, based on the second working key, through the decryption algorithm corresponding to the encryption process (because the first working key and the second working key are matched with each other, the encryption and decryption algorithms are also corresponding), the encrypted data is decrypted to obtain the original first business data message.

[0125] After the gateway device restores the first business data ciphertext to the first business data message, it forwards the first business data message to the IoT business platform according to the established network routing and business process. After receiving these data messages, the IoT business platform can perform corresponding processing, analysis, and subsequent business decision-making operations based on the business information contained therein, thereby realizing safe and effective business data interaction between the IoT terminal and the IoT business platform.

[0126] In the method provided in the embodiment of the present application, the first business data message generated by the business module in the IoT terminal is obtained; the security chip is called to encrypt the first business data message according to the first working key and encapsulate it into the first business data ciphertext; based on the VPN tunnel, the first business data ciphertext is sent to the gateway device, so that the gateway device calls the quantum cryptography management service platform, decapsulates and decrypts the first business data ciphertext according to the second working key, obtains the first business data message, and forwards it to the IoT business platform. This ensures that the business data generated by the IoT terminal can be safely and accurately transmitted to the IoT business platform in a complex network environment, and realizes the safe flow of business data in the entire IoT system.

[0127] The embodiment of the present application also provides another possible implementation of a quantum key-based secure communication method, the method further comprising:

[0128] If it is detected that the VPN tunnel is disconnected, or the connection time of the VPN tunnel exceeds the preset time, the target injection key in the security chip is destroyed.

[0129] In this embodiment, the VPN tunnel is a key channel to ensure secure communication between the communication module and the gateway device. However, due to the complexity of the network environment, various reasons may cause the VPN tunnel to be disconnected, such as network failure, server or client software failure, or external network attack, etc., making it impossible for the originally established VPN tunnel to maintain a normal connection state, and data transmission is forced to be interrupted.

[0130] Alternatively, in order to further ensure the security of communications and properly manage the use of key resources, a threshold for the VPN tunnel connection duration, that is, the preset duration, will be pre-set. When the VPN tunnel continues to maintain a connection for longer than this set duration, even if the tunnel connection is still normal at this time, the target injection key in the security chip needs to be destroyed. This is because using the same key for communication for a long time may increase security risks such as key cracking and information leakage. By limiting the connection duration to regularly update security resources such as keys, and promptly destroying target injection keys that may pose security risks, communication security can be better guaranteed.

[0131] The present application also provides a quantum key-based secure communication method, which is applied to a gateway device. Figure 7 A sixth flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Figure 7 As shown, the method also includes:

[0132] S601: Receive client handshake information sent by a control unit in a communication module in an Internet of Things terminal.

[0133] The client handshake information is the client handshake information generated by the control unit after obtaining the serial number of the target injection key from the security chip in the communication module.

[0134] In this embodiment, the client handshake information is the initial interaction content of the communication module initiating a secure communication connection with the gateway device. The client handshake information will contain important information such as the communication protocol version supported by the communication module itself, the client random number generated by itself, and the serial number of the target injection key.

[0135] S602. Obtain the target charging key from the quantum cryptography management service platform according to the serial number of the target charging key, and generate a server-side handshake message.

[0136] Specifically, after receiving the handshake information from the client, the gateway device will extract the serial number of the target injection key, and then initiate a request to the quantum cryptography management service platform to obtain the corresponding target injection key based on the serial number of the target injection key. As a platform for centralized management and storage of security resources such as keys, the quantum cryptography management service platform can find and provide the corresponding target injection key to the gateway device based on the serial number based on a strict authority management and search mechanism.

[0137] After obtaining the target injection key, the gateway device will generate a server handshake message. The server handshake message also contains some communication configuration information related to the gateway device itself, such as the supported protocol version and the client random number generated by itself, which is used to respond to the client handshake information of the communication module and continue to promote the process of establishing a secure connection between the two parties.

[0138] S603: Send a server handshake message and a server certificate to the control unit, so that the control unit calls the security chip to authenticate the server certificate and generates a first working key in the security chip according to the target injection key.

[0139] Specifically, after receiving the server handshake message and server certificate sent by the gateway device, the communication module uses the functions in the security chip and the stored related trust roots, verification algorithms and other resources to authenticate the received server certificate. For example, verify whether the issuing authority of the certificate is legal, whether the certificate is within the validity period, whether the certificate content has been tampered with, etc. Only through these strict verification processes can the identity of the gateway device be confirmed to be reliable, and subsequent communications can continue based on trust.

[0140] After confirming that the server certificate is valid, the communication module will inject the key according to the target and use the PRF algorithm to generate the first working key inside the security chip. The first working key is used for subsequent encrypted communication with the gateway device, data integrity verification and other operations.

[0141] S604, receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key.

[0142] After receiving the client certificate, the gateway device will submit it to the quantum cryptography management service platform for authentication. The quantum cryptography management service platform determines the legitimacy of the client certificate based on the trust information and verification rules stored in itself. After the authentication is passed, the second working key is generated using the PRF algorithm based on the target injection key. Among them, the second working key corresponds to the first working key generated by the communication module, and the two are subsequently used together for secure communication operations such as encryption and decryption between the two parties.

[0143] S605. Establish a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the IoT terminal and the IoT service platform.

[0144] Specifically, after the communication module and the gateway device have generated the first working key and the second working key respectively, the two parties establish an SSL VPN (virtual private network) tunnel based on the negotiated working keys through specific encryption, encapsulation and other network communication technical means. The SSL VPN tunnel opens up a secure communication channel between the IoT terminal and the IoT service platform in the public network environment, and builds an exclusive, encrypted pipeline.

[0145] When the VPN tunnel is successfully established, the service data packets between the IoT terminal and the IoT service platform can be transmitted through the VPN tunnel. During the transmission process, the service data packets will be encrypted and decrypted using the encryption and decryption algorithm based on the first working key and the second working key to ensure the confidentiality of the service data packets.

[0146] In summary, an embodiment of the present application provides a quantum key-based secure communication method, which is applied to a gateway device, and the method includes: receiving client handshake information sent by a control unit in a communication module in an Internet of Things terminal, the client handshake information is the control unit obtaining the serial number of the target injection key from the security chip in the communication module, and generating the client handshake information, obtaining the target injection key from the quantum cryptography management service platform according to the serial number of the target injection key, and generating a server handshake message; sending a server handshake message and a server certificate to the control unit, so that the control unit calls the security chip to authenticate the server certificate, and generates a first working key in the security chip according to the target injection key; receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key; establishing a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, for transmitting business data messages between the Internet of Things terminal and the Internet of Things business platform. The method of the present application adds a communication module with an integrated security chip, a quantum cryptography management service platform and a gateway device to the existing IoT terminal equipment and IoT business platform, forming a complete secure communication channel for data transmission, namely a VPN tunnel, which can ensure the reliability, security and integrity of business data message transmission.

[0147] Based on the above embodiments, the present application also provides another possible implementation of a quantum key-based secure communication method. Figure 8 A flowchart of a quantum key-based secure communication method provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key, including:

[0148] S701. Call the authentication interface of the quantum cryptography management service platform to authenticate the client certificate.

[0149] S702, calling the algorithm interface of the quantum cryptography management service platform, injecting the target key, the second client random number, the second server random number, and the constant string, calculating the second master key, and calculating the second working key based on the second master key.

[0150] S703: Store the second working key in the gateway device.

[0151] In this embodiment, a special authentication interface is provided inside the quantum cryptography management service platform, which is used to process the external interaction channel of the functional modules for various certificate authentication related operations. In the process of establishing a secure connection between the communication module and the gateway device, after receiving the client certificate sent by the communication module, the authentication interface is called to verify the client certificate, and the legitimacy, integrity and validity of the client certificate are rigorously checked.

[0152] For example, check whether the issuing authority of the certificate is a trusted authority and verify whether the certificate is within the validity period. An expired certificate can obviously no longer be used to prove identity and ensure secure communication. In addition, check whether the certificate content has been tampered with. By verifying the digital signature and other information in the certificate, its integrity is ensured. If the certificate content has been tampered with, there is a high possibility of security risks such as man-in-the-middle attacks. Only when the client certificate successfully passes these verifications performed by the authentication interface can the identity of the communication module be confirmed to be reliable.

[0153] Specifically, the algorithm interface of the quantum cryptography management service platform is the key entry point for implementing various encryption, key generation and other core algorithm operations. It encapsulates advanced, safe and reliable encryption algorithms, key derivation algorithms and other functional modules. By calling the algorithm interface, the PRF algorithm is used to calculate the second master key based on the target injection key, the second client random number, the second server random number, and the constant string, and the PRF algorithm is used again to calculate the second working key based on the second master key. Among them, the second client random number is a random value generated by the communication module as a client role when the handshake is initially initiated, that is, the random number saved in the client handshake information, and the second server random number is the random number saved in the server handshake message sent by the gateway device. Finally, the second working key is stored in the gateway device.

[0154] In the method provided in the embodiment of the present application, the client certificate is authenticated by calling the authentication interface of the quantum cryptography management service platform, the algorithm interface of the quantum cryptography management service platform is called, the target injection key, the second client random number, the second server random number, and the constant string are calculated, the second master key is calculated, and the second working key is calculated based on the second master key. Finally, the second working key is stored in the gateway device. By calling different functional interfaces inside the security chip, the authentication of the client certificate and the generation and storage of the key second working key are completed, laying a solid foundation for building a secure communication connection between the communication module and the gateway device.

[0155] The present application embodiment also provides another possible implementation of a quantum key-based secure communication method. Fig. 9 The eighth flow chart of a quantum key-based secure communication method provided in an embodiment of the present application is as follows: Fig. 9As shown, the method also includes:

[0156] S801. Obtain a second service data message generated by a service module in an Internet of Things service platform.

[0157] S802. Call the quantum cryptography management service platform to encrypt the second business data message according to the second working key and encapsulate it into a second business data ciphertext.

[0158] S803. Based on the VPN tunnel, the second business data ciphertext is sent to the communication module, so that the communication module calls the security chip, decapsulates and decrypts the second business data ciphertext according to the first working key, and obtains the second business data message.

[0159] In this embodiment, the business module in the IoT business platform is responsible for executing various specific business logics and operations, such as generating corresponding feedback instructions after analyzing and processing the data collected from many IoT terminals, or generating data that needs to be sent to IoT terminals based on the platform's own management, monitoring and other functions. The data generated by the business module will be organized and arranged in a specific format to form a second business data message, and forwarded to the gateway device through routing.

[0160] The SSL VPN server software program in the gateway device calls the encryption interface of the quantum cryptography management service platform, and encrypts the second service data message according to the built-in encryption algorithm and the second working key as the key parameter, converting the plaintext data into encrypted ciphertext. After completing the encryption operation, the encrypted content needs to be encapsulated to form the second service data ciphertext. The encapsulation process may involve adding some additional header information, verification information, etc., which helps the communication module to accurately identify, decapsulate and perform subsequent processing operations.

[0161] Based on the VPN tunnel, the second business data ciphertext is sent to the communication module. After the communication module receives the second business data ciphertext, it needs to perform decapsulation and decryption operations to restore it to the original second business data message. First, the ciphertext is decapsulated using the relevant functional modules in the security chip, that is, the header information, checksums and other additional contents previously added to the IoT business platform are removed to extract the encrypted data part. Then, based on the first working key stored in the security chip, the encrypted data is decrypted by the decryption algorithm corresponding to the encryption process (because the first working key and the second working key are mutually matched, and the corresponding encryption and decryption algorithms are also mutually adapted), so as to successfully obtain the original second business data message. Then, based on the second business data message, the corresponding subsequent operations are performed, such as passing the relevant instructions to the functional modules corresponding to the IoT terminal, etc., to realize the safe and effective information interaction between the IoT business platform and the IoT terminal.

[0162] In the method provided in the embodiment of the present application, the second business data message generated by the business module in the IoT business platform is obtained, the quantum cryptography management service platform is called, the second business data message is encrypted according to the second working key, and encapsulated into the second business data ciphertext, and the second business data ciphertext is sent to the communication module based on the VPN tunnel, so that the communication module calls the security chip, decapsulates and decrypts the second business data ciphertext according to the first working key, and obtains the second business data message. It ensures that the business data generated by the IoT terminal can be safely and accurately transmitted to the IoT business platform in a complex network environment, and realizes the safe flow of business data in the entire IoT system.

[0163] The embodiment of the present application also provides another possible implementation of a quantum key-based secure communication method, the method further comprising:

[0164] If it is detected that the VPN tunnel is disconnected, or the connection time of the VPN tunnel exceeds the preset time, the target injection key in the quantum cryptography management service platform will be destroyed.

[0165] In this embodiment, the VPN tunnel is a key channel to ensure secure communication between the communication module and the gateway device. However, due to the complexity of the network environment, various reasons may cause the VPN tunnel to be disconnected, such as network failure, server or client software failure, or external network attack, etc., making it impossible for the originally established VPN tunnel to maintain a normal connection state, and data transmission is forced to be interrupted.

[0166] Alternatively, in order to further ensure the security of communications and properly manage the use of key resources, a threshold for the VPN tunnel connection duration, that is, the preset duration, will be pre-set. When the VPN tunnel remains connected for longer than this set duration, even if the tunnel connection is still normal at this time, the target injection key in the quantum cryptography management service platform needs to be destroyed. This is because using the same key for communication for a long time may increase security risks such as key cracking and information leakage. By limiting the connection duration to regularly update security resources such as keys, and promptly destroying target injection keys that may pose security risks, communication security can be better guaranteed.

[0167] The following is a corresponding explanation of the quantum key-based secure communication device provided by any of the above embodiments of the present application. Its specific implementation process and the technical effects produced are the same as those of the corresponding method embodiments mentioned above. For the sake of brief description, for some parts not mentioned in this embodiment, please refer to the corresponding content in the method embodiment.

[0168] Fig.10A schematic diagram of the functional modules of a quantum key-based secure communication device provided in an embodiment of the present application. A control unit in a communication module used in an IoT terminal, such as Fig.10 As shown, the quantum key-based secure communication device 100 includes:

[0169] The first generating module 110 is used to obtain the serial number of the target injection key from the security chip in the communication module and generate the client handshake information;

[0170] The first sending module 120 is used to send the client handshake information to the gateway device, so that the gateway device obtains the target injection key from the quantum cryptography management service platform according to the serial number of the target injection key and generates a server handshake message;

[0171] The first receiving module 130 is used to receive the server handshake message and server certificate sent by the gateway device;

[0172] The first generating module 110 is further used to call the security chip to authenticate the server certificate and generate a first working key in the security chip according to the target injection key;

[0173] The first sending module 120 is further used to send the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform and generates a second working key according to the target injection key;

[0174] The first establishing module 140 is used to establish a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the IoT terminal and the IoT service platform.

[0175] Optionally, the first generation module 110 is also used to determine an unused injection key from multiple injection keys of the security chip as a target injection key, and obtain the serial number of the target injection key; generate client handshake information according to the serial number of the target injection key and the device identification of the communication module.

[0176] Optionally, the first sending module 120 is further used to send a key charging request to the quantum cryptography management service platform, so that the quantum cryptography management service platform generates a charging key file; the charging key file includes: multiple charging keys;

[0177] The first acquisition module is used to obtain the charging key file returned by the quantum cryptography management service platform;

[0178] The first storage module is used to store the injection key file in the security chip.

[0179] Optionally, the first generation module 110 is also used to call the authentication interface of the security chip to authenticate the server certificate; call the algorithm interface of the security chip to calculate the first master key according to the target injection key, the first client random number, the first server random number, and the constant string, and calculate the first working key according to the first master key; store the first working key in the security chip.

[0180] Optionally, the first storage module is further used to obtain a first service data message generated by a service module in the Internet of Things terminal;

[0181] A first encryption module, used to call the security chip, encrypt the first service data message according to the first working key, and encapsulate it into a first service data ciphertext;

[0182] The first sending module 120 is also used to send the first business data ciphertext to the gateway device based on the VPN tunnel, so that the gateway device calls the quantum cryptography management service platform, decapsulates and decrypts the first business data ciphertext according to the second working key, obtains the first business data message, and forwards it to the Internet of Things business platform.

[0183] Optionally, the device further comprises:

[0184] The first destruction module is used to destroy the target injection key in the security chip if it is detected that the VPN tunnel is disconnected or the connection time of the VPN tunnel exceeds a preset time.

[0185] Fig.11 A schematic diagram of the functional modules of another quantum key-based secure communication device provided in an embodiment of the present application. Applied to a gateway device, such as Fig.11 As shown, the quantum key-based secure communication device 200 includes:

[0186] The second receiving module 210 is used to receive the client handshake information sent by the control unit in the communication module in the IoT terminal, where the client handshake information is the client handshake information generated by the control unit after obtaining the serial number of the target injection key from the security chip in the communication module;

[0187] The second generation module 220 is used to obtain the target injection key from the quantum cryptography management service platform according to the serial number of the target injection key and generate a server handshake message;

[0188] The second sending module 230 is used to send a server handshake message and a server certificate to the control unit, so that the control unit calls the security chip to authenticate the server certificate and generates a first working key in the security chip according to the target injection key;

[0189] The second generating module 220 is further used to receive the client certificate of the communication module sent by the control unit, authenticate the client certificate through the quantum cryptography management service platform, and generate a second working key according to the target injection key;

[0190] The second establishing module 240 is used to establish a VPN tunnel between the communication module and the gateway device according to the first working key and the second working key, so as to transmit business data messages between the IoT terminal and the IoT business platform.

[0191] Optionally, the second generation module 220 is also used to call the authentication interface of the quantum cryptography management service platform to authenticate the client certificate; call the algorithm interface of the quantum cryptography management service platform, target injection key, second client random number, second server random number, constant string, calculate the second master key, and calculate the second working key based on the second master key; store the second working key in the gateway device.

[0192] Optionally, the device further comprises:

[0193] A second acquisition module, used to acquire a second service data message generated by a service module in the Internet of Things service platform;

[0194] A second encryption module is used to call the quantum cryptography management service platform, encrypt the second business data message according to the second working key, and encapsulate it into a second business data ciphertext;

[0195] The second sending module 230 is also used to send the second business data ciphertext to the communication module based on the VPN tunnel, so that the communication module calls the security chip, decapsulates and decrypts the second business data ciphertext according to the first working key, and obtains the second business data message.

[0196] Optionally, the device further comprises:

[0197] The second destruction module is used to destroy the target injection key in the quantum cryptography management service platform if it is detected that the VPN tunnel is disconnected or the connection time of the VPN tunnel exceeds a preset time.

[0198] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0199] The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0200] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A secure communication method based on quantum key, characterized in that: A control unit in a communication module applied to an Internet of Things terminal, the method comprising: Obtaining the serial number of the target injection key from the security chip in the communication module and generating client handshake information; Sending the client handshake information to a gateway device, so that the gateway device obtains the target charging key from a quantum cryptography management service platform according to the serial number of the target charging key, and generates a server handshake message; Receive the server handshake message and server certificate sent by the gateway device; Calling the security chip to authenticate the server certificate, and generating a first working key in the security chip according to the target injection key; Sending the client certificate of the communication module to the gateway device, so that the gateway device authenticates the client certificate through the quantum cryptography management service platform, and generates a second working key according to the target injection key; A VPN tunnel is established between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the Internet of Things terminal and the Internet of Things service platform.

2. The method according to claim 1, characterized in that The step of obtaining the serial number of the target injection key from the security chip in the communication module and generating client handshake information includes: Determine an unused charging key from the multiple charging keys of the security chip as the target charging key, and obtain the serial number of the target charging key; The client handshake information is generated according to the serial number of the target injection key and the device identification of the communication module.

3. The method according to claim 1, characterized in that Before obtaining the serial number of the target injection key from the security chip in the communication module and generating the client handshake information, the method further includes: Sending a key charging request to the quantum cryptography management service platform so that the quantum cryptography management service platform generates a charging key file; the charging key file includes: multiple charging keys; Obtaining the injection key file returned by the quantum cryptography management service platform; The charging key file is stored in the security chip.

4. The method according to claim 1, characterized in that The calling of the security chip to authenticate the server certificate and generating a first working key in the security chip according to the target injection key includes: Calling the authentication interface of the security chip to authenticate the server certificate; Calling the algorithm interface of the security chip, calculating the first master key according to the target injection key, the first client random number, the first server random number, and the constant character string, and calculating the first working key according to the first master key; The first working key is stored in the security chip.

5. The method according to claim 1, characterized in that The method further comprises: Acquire a first service data message generated by a service module in the Internet of Things terminal; Calling the security chip, encrypting the first service data message according to the first working key, and encapsulating it into a first service data ciphertext; Based on the VPN tunnel, the first business data ciphertext is sent to the gateway device, so that the gateway device calls the quantum cryptography management service platform, decapsulates and decrypts the first business data ciphertext according to the second working key, obtains the first business data message, and forwards it to the Internet of Things business platform.

6. The method according to claim 1, characterized in that The method further comprises: If it is detected that the VPN tunnel is disconnected, or the connection duration of the VPN tunnel exceeds a preset duration, the target injection key in the security chip is destroyed.

7. A secure communication method based on quantum key, characterized in that: Applied to a gateway device; the method comprises: Receiving client handshake information sent by a control unit in a communication module in an IoT terminal, wherein the client handshake information is the client handshake information generated by the control unit after obtaining the serial number of the target injection key from the security chip in the communication module; Obtain the target charging key from the quantum cryptography management service platform according to the serial number of the target charging key, and generate a server-side handshake message; Sending the server handshake message and the server certificate to the control unit, so that the control unit calls the security chip to authenticate the server certificate, and generates a first working key in the security chip according to the target injection key; Receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key; A VPN tunnel is established between the communication module and the gateway device according to the first working key and the second working key, so as to transmit service data messages between the Internet of Things terminal and the Internet of Things service platform.

8. The method according to claim 7, characterized in that The receiving the client certificate of the communication module sent by the control unit, authenticating the client certificate through the quantum cryptography management service platform, and generating a second working key according to the target injection key includes: Calling the authentication interface of the quantum cryptography management service platform to authenticate the client certificate; Calling the algorithm interface of the quantum cryptography management service platform, the target charging key, the second client random number, the second server random number, and the constant string, calculating the second master key, and calculating the second working key according to the second master key; The second working key is stored in the gateway device.

9. The method according to claim 7, characterized in that: The method further comprises: Obtaining a second service data message generated by a service module in the Internet of Things service platform; Calling the quantum cryptography management service platform, encrypting the second service data message according to the second working key, and encapsulating it into a second service data ciphertext; Based on the VPN tunnel, the second business data ciphertext is sent to the communication module, so that the communication module calls the security chip, decapsulates and decrypts the second business data ciphertext according to the first working key, and obtains the second business data message.

10. The method according to claim 7, characterized in that The method further comprises: If it is detected that the VPN tunnel is disconnected, or the connection duration of the VPN tunnel exceeds a preset duration, the target injection key in the quantum cryptography management service platform is destroyed.

Images