Information encryption method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses an information encryption method and device, electronic equipment, a storage medium and a program product, belongs to the technical field of information security, and is used for improving information security. The method comprises the following steps: extracting a target quantum key from a quantum key group according to the number of quantum keys in the quantum key group and a generated random character string encryption value; and sending the target quantum key to a terminal device, so that the terminal device encrypts to-be-encrypted sensitive information according to the target quantum key to obtain encrypted information.

Description

Technical Field

[0001] The present application belongs to the field of information security technology, and specifically relates to an information encryption method, device, electronic device, storage medium and program product. Background Art

[0002] With the rapid development of the Internet era, the number of information users is increasing day by day. When users use APP software, there is a risk of personal sensitive information being stolen. The current symmetric and asymmetric encryption methods and technologies are relatively old. With the continuous deepening of quantum computing research and the emergence of large-scale quantum computers, many commonly used cryptographic systems will be quickly cracked. Therefore, the current encryption algorithm does not have the hidden danger of being cracked by calculation, which leads to the risk of modifying, imitating or replaying the transmitted information content during the data transmission process, threatening the security of communication. Summary of the invention

[0003] The embodiments of the present application provide an information encryption method, device, electronic device, storage medium and program product, which can solve the problem of threatening the security of communications.

[0004] In a first aspect, an embodiment of the present application provides an information encryption method, the method comprising: extracting a target quantum key from a quantum key group according to the number of quantum keys in the quantum key group and a generated random string encryption value; sending the target quantum key to a terminal device, so that the terminal device encrypts sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0005] In a second aspect, an embodiment of the present application provides an information encryption method, the method comprising: receiving a target quantum key sent by a server, wherein the target quantum key is extracted by the server from the quantum key group based on the number of quantum keys in the quantum key group and a generated random string encryption value; encrypting sensitive information to be encrypted by using the target quantum key to obtain encrypted information.

[0006] In a third aspect, an embodiment of the present application provides an information encryption device, including: a working module, used to extract a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and a generated random string encryption value; a sending module, used to send the target quantum key to a terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0007] In a fourth aspect, an embodiment of the present application provides an information encryption device, comprising: a receiving module, used to receive a target quantum key sent by a server, wherein the target quantum key is extracted by the server from the quantum key group based on the number of quantum keys in the quantum key group and a generated random string encryption value; a processing module, used to encrypt sensitive information to be encrypted using the target quantum key to obtain encrypted information.

[0008] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect or implements the steps of the method described in the second aspect.

[0009] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect or the steps of the method described in the second aspect are implemented.

[0010] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first aspect or implements the steps of the method described in the second aspect.

[0011] In an embodiment of the present application, a target quantum key is extracted from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value; the target quantum key is sent to a terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information, thereby improving the security of the information. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of an information encryption method provided in an embodiment of the present application; Figure 2 This is a schematic diagram of a quantum key system provided in an embodiment of the present application; Figure 3 This is a schematic diagram of terminal information processing provided by an embodiment of the present application; Figure 4 It is a schematic diagram of server information processing provided by an embodiment of the present application; Figure 5 It is a flowchart of another information encryption method provided in an embodiment of the present application; Figure 6This is a schematic diagram of an information interaction process provided by an embodiment of the present application; Figure 7 It is a structural schematic diagram of an information encryption device provided in an embodiment of the present application; Figure 8 is a structural schematic diagram of another information encryption device provided in an embodiment of the present application; Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0014] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0015] The information encryption method, device, electronic device, storage medium and program product provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0016] Figure 1 An information encryption method provided by an embodiment of the present application is shown, and the method can be executed by a server. In other words, the method can be executed by software or hardware installed on the server, and the method includes the following steps: Step 102: extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value.

[0017] In the embodiment of the present application, the target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and the generated random string encryption value. Specifically, the application of the terminal device can obtain the number of the user's terminal device by accessing the mobile authentication SDK capability. After the mobile terminal obtains the basic user information such as the mobile phone number, device number, and device machine IP, it can temporarily save the message.

[0018] The terminal device (also known as the mobile authentication function server) then initiates a quantum encryption request to the server (also known as the quantum key server), and the server obtains the quantum key from the quantum key system. The quantum key is based on the indivisibility and non-cloning of quantum, and uses the polarization state fluctuation of photons and the measurement basis principle of photons to generate multiple sets of quantum bit data, and randomly selects the test basis, by making some bit segments public, and finally intercepting a section of public data for comparison. If the comparison results are the same, the undisclosed part can be used as a common key. If the comparison results are different, it means that a hacker is eavesdropping on the data, and the communication is invalid.

[0019] In an embodiment of the present application, a quantum key system is provided, such as Figure 2 As shown in the figure, the quantum key system integrates the quantum key distribution system (Quantum Key Distribution Machine, QKM) and the electronic code machine (Electronic Code Machine, ECM), in which the quantum key distribution system (QKM) obtains quantum random numbers from the electronic code machine (ECM) to generate quantum keys (Quantum Encryption key, QEK). After multiple iterations of the above process, the electronic code machine (ECM) generates a quantum encryption key group (Quantum Encryption key Group, QEKG). As shown in Table 1 below, two groups of polarization orthogonal basis are randomly selected during QKM quantum distribution. ( and (use represent), (use Represents any one of) to coordinate the single-photon sending key. If the polarization basis of the sender and the receiver are the same, the correct key value will be obtained. If they are different, it will be randomly assigned to a certain receiver.

[0020] Table 1

[0021] In one implementation, before extracting the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value, it also includes: receiving single photon information sent by the quantum key system through a preselected polarization basis; converting the single photon information into photon information bits according to the single photon polarization quantity measurement, and sending the photon information bits to the quantum key system; receiving the single photon information polarization state of the single photon information sent by the quantum key system; selecting the corresponding single photon information polarization state and the bit value of the photon information bit through the quantum key system and the server for comparison, and using the undisclosed part of the same bit value as the quantum key, thereby forming the quantum key group.

[0022] Specifically, the iterative generation process of the quantum key group is as follows: the quantum key system randomly selects a set of polarization bases, modulates the single photon information according to the polarization base, and assumes that the single photon information is (100111010); the server randomly selects a set of polarization bases to receive the single photon information, and converts the single photon information into a set of photon information bits according to the single photon polarization measurement, which is assumed to be (100010011), and transmits it to the quantum key system through the channel. At the same time, the quantum key system also discloses the polarization state of the single photon information to the server. The quantum key system and the server select the corresponding single photon information polarization state and photon information bit, and select a segment of the bit value to publish. If there is a difference in the sequence, it means that there is eavesdropping and tampering, and the key acquisition is performed this time. If there is no difference, the undisclosed part of the same bit can be used as the final key value. As shown in the following table, the final generated key fragment is 011.

[0023] Table 2

[0024] In one implementation, after the corresponding single-photon information polarization state and the bit value of the photon information bit are selected by the quantum key system and the server for comparison, it also includes: when the proportion of quantum keys that fail the comparison exceeds a threshold, regenerating the quantum key group; and performing XOR processing on the quantum key through the generated quantum key random number.

[0025] In order to further improve the security of the key, based on the principle of quantum key generation, in order to avoid the waste of resources caused by multiple retries after a failure to obtain the key, the embodiment of the present application adds a multiple iteration mechanism to the key generation rule, wherein the failed polarization state is controlled during the multiple polarization state comparisons of the quantum key, as shown in the following formula: ={ ... } in Set the threshold for quantum keys that represent the risk of eavesdropping due to polarization state comparison failure : >

[0026] When the threshold is exceeded, it is proved that the risk of the quantum key group is too high, and it is discarded and the key group is regenerated.

[0027] After multiple polarization state comparisons, the quantum key generates a quantum key group and returns it to the business server for storage. In order to ensure the confidentiality of the storage, a quantum key random number is generated by a random number machine. , through random number XOR processing, to prevent the risk of theft in the machine storage cache, as follows: ={ ... } In this way, after obtaining the quantum key group, the server can extract the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value.

[0028] Multiple groups of keys are generated based on the quantum key polarization state measurement basis, in which the key matching error rate is controlled and relevant thresholds are set to eliminate quantum key groups with high failure rates. At the same time, the quantum keys are XORed using multiple random numbers to ensure that even if the data memory in the cache is leaked, hackers cannot obtain the specific value of the quantum key.

[0029] Step 104: Send the target quantum key to a terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0030] Specifically, after the terminal device requests a quantum key from the server, the server can send the extracted target quantum key to the terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0031] The information encryption method provided in the embodiment of the present application extracts a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value; sends the target quantum key to the terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information, obtains a quantum key set of a certain number of values ​​from the quantum key system, and then caches the set on a server and transmits the set to the terminal device, wherein the random string encryption value hash value is used for random extraction and disturbance, and finally a suitable quantum key is selected for encryption, thereby realizing secure transmission of information in the entire process and improving the security of the information.

[0032] In one implementation, before encrypting the value according to the number of quantum keys in the quantum key group and the generated random character string, it also includes: receiving a signature value, encrypted data and encrypted ciphertext sent by the terminal device, wherein the encrypted data and the encrypted ciphertext are generated by the terminal device according to the random number and the data set, the data set is generated by the terminal device concatenating the timestamp and the credential sent by the server, and the signature value is obtained by the terminal device signing the relevant information in the data transmission process.

[0033] Specifically, after obtaining the key group, the server will return the certificate to the terminal device. ,like Figure 3 As shown, the terminal device stores the credentials and concatenates them with the timestamp to form a data set. , as follows: ={ || } The terminal device will send the IP request end sent by the client SDK to the relevant data during the transmission process. , requesting Mac device number , user service number code , a single transaction serial number , timestamp , the above related information is signed by the private key of the SM2 algorithm. The signature value is mainly used to verify that the information is initiated by the client side, which is equivalent to a summary. After the server receives the information, it verifies the signature value to confirm that the information comes from the client side, not from an unknown request end, as shown in the following formula: Sign= ( || || || || ) SDK terminal device pre-embeds the server SM2 public key The server random number machine generates a random number Rand, and the terminal device generates a random number Rand for the transmitted user data set. , use the SM4 algorithm, use Rand as the key for symmetric encryption, and generate encrypted data SC. The formula is as follows: SC= (Rand ) After obtaining the SC value, use the SM2 algorithm and the server public key The random number Rand is asymmetrically encrypted to obtain the encrypted ciphertext SR. The formula is as follows: SR=Enc( (Rand )) After obtaining the SC and SR values, the terminal device summarizes the server public key, SC, SR and other related information into a data packet Req={ , SC, SR}, and transmit the server through https. The server can receive the signature value, encrypted data and encrypted ciphertext sent by the terminal device.

[0034] In one implementation, extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value includes: verifying the signature value, and if the verification passes, decrypting the ciphertext to obtain the random number; decrypting the encrypted data to obtain the data set; parsing the data set to obtain the credential; and if the credential is successfully verified, extracting the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value.

[0035] Figure 4 A server information processing flow chart provided in an embodiment of the present application is shown as follows: Figure 4 As shown, after receiving the data packet Req, the server parses the data packet and uses the SM2 algorithm to calculate the signature value ( || || || || ) data is signed. After the signature is verified, the encrypted ciphertext SR parameter is decrypted by SM2 to obtain the Rand parameter. The formula is as follows: Rand=Dec( (SR )) After obtaining the Rand parameter, the server uses the SM4 symmetric algorithm to decrypt the encrypted data SC and obtain the data set , the formula is as follows: = (Rand SC) Get the data collection After that, the service side parses and obtains the certificate The server can verify the credentials. After verifying that the information is correct, the server can extract the target quantum key from the quantum key group based on the number of quantum keys in the quantum key group and the generated random string encryption value.

[0036] In one implementation, extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value includes: using a hash value obtained by hashing the generated random string as the random string encryption value; performing a modulus process on the number of quantum keys in the quantum key group according to the random string encryption value, and extracting a corresponding quantum key from the quantum key group according to the obtained modulus value as the target quantum key.

[0037] In order to further increase the security and reliability of encryption, the server generates a 32-bit non-repeating random string, performs hash processing on the generated random string to obtain the random string encryption value, and then performs random number extraction principle of the key group and performs modulo processing on the array. The formula is as follows: Num= ) mod

[0038] in, ) represents a random number The encrypted value of a random string, Represents the number of quantum keys in the entire quantum key group, and Num represents the number of the drawn quantum key.

[0039] After obtaining the modulus parameter, the Numth target quantum key is extracted and returned to the client together with the random string. At the same time, the server uses the randomly generated string as the target quantum key corresponding to the cache key value pair. Cache.

[0040] After sending the target quantum key to the terminal device so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain the encrypted information, the method further includes: receiving the encrypted information sent by the terminal device; and decrypting the encrypted information by using the target quantum key to obtain the sensitive information.

[0041] Specifically, after receiving the target quantum key, the terminal device can encrypt the sensitive information with the target quantum key to obtain the encrypted information, and then send the encrypted information to the server. After receiving the encrypted information, the server can obtain the corresponding target quantum key from the cache according to the random string. , and perform SM4’s quantum key decryption on the encrypted information to obtain sensitive information.

[0042] In one implementation, after sending the target quantum key to a terminal device so that the terminal device encrypts sensitive information to be encrypted according to the target quantum key to obtain the encrypted information, the method further includes: destroying the used target quantum key.

[0043] At the same time, in order to maintain the uncertainty of the key group and avoid the possibility of the key being used multiple times or stored for a long time and being stolen by the outside world, a key destruction mechanism is set in the quantum key group. After the server obtains the quantum key and uses it for encryption and decryption, the server will destroy the target quantum key in the quantum key group.

[0044] In one implementation, after extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value, the method further includes: destroying the quantum key group if the number of quantum keys remaining in the quantum key group after destroying the target quantum key is less than a number threshold; and timing after obtaining the quantum key group, and destroying the quantum key group if the timing time exceeds a time threshold.

[0045] The embodiment of the present application sets a key destruction mechanism and also sets a minimum number of keys. , expiration time . The remaining number of keys in the key group after destruction is N. When N< When the entire key group is destroyed, a new key group is generated. After the server obtains the quantum key group, it starts timing, and the time is T. When time T> When the timeout destruction mechanism is triggered, the entire key array is too long, so it is completely destroyed and updated.

[0046] The time wheel destruction mechanism is used to destroy the used target quantum keys and regularly clear the quantum keys that have timed out and are not used. After clearing, the quantum keys are updated to maintain the uncertainty of the key group keys, further reducing the possibility of being cracked.

[0047] Figure 5 Another information encryption method provided in an embodiment of the present application is shown, the method is executed by a terminal device, and the method comprises the following steps: Step 502: Receive the target quantum key sent by the server.

[0048] Specifically, after the server extracts the quantum key from the key group, it can send the target quantum key to the terminal device, and the terminal device can receive the target quantum key sent by the server. The target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and the generated random string encryption value.

[0049] Step 504: Encrypt the sensitive information to be encrypted using the target quantum key to obtain encrypted information.

[0050] Specifically, after receiving the target quantum key, the terminal device uses the SM4 algorithm to transmit the user's sensitive message Encrypt to form encrypted information , and transmit it to the server via https, as shown below: =Enc( ( )) in The encrypted information is encrypted on behalf of the client and transmitted to the server via the https network.

[0051] The server receives After receiving relevant information, the corresponding target quantum key is obtained from the cache through a random string. , and for Perform quantum key decryption of SM4.

[0052] The information encryption method provided by the embodiment of the present application receives a target quantum key sent by a server, wherein the target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and the generated random string encryption value; the sensitive information to be encrypted is encrypted by using the target quantum key to obtain encrypted information, and the random string encryption value hash value is used for random extraction and disturbance, and finally a suitable quantum key is selected to encrypt the sensitive information, so as to realize the secure transmission of information in the whole process, and improve the security of information.

[0053] In one implementation, the encrypted value of the random character string is a hash value obtained by the server performing hash processing on the generated random character string.

[0054] In order to further increase the security and reliability of encryption, the server generates a 32-bit non-repeating random string, performs hash processing on the generated random string to obtain the random string encryption value, and then performs the random number extraction principle of the key group and performs modulo processing on the array. The formula is as follows: Num= ) mod

[0055] in, ) represents a random number The encrypted value of a random string, Represents the number of quantum keys in the entire quantum key group, and Num represents the number of the drawn quantum key.

[0056] After obtaining the modulus parameter, the Numth target quantum key is extracted and returned to the client together with the random string. At the same time, the server uses the randomly generated string as the target quantum key corresponding to the cache key value pair. Cache.

[0057] In one implementation, before the target quantum key sent by the server is received, the method further includes: concatenating the timestamp and the certificate sent by the server to generate a data set; signing the relevant information in the data transmission process to obtain a signature value; generating encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number according to the random number and the data set; and sending the signature value, the encrypted data and the encrypted ciphertext to the server, so that the server can extract the target quantum key from the quantum key group when the verification is successful according to the signature value, the encrypted data and the encrypted ciphertext.

[0058] Specifically, Figure 3 Specifically, after obtaining the key group, the server will return the certificate to the terminal device. , the terminal device stores the credentials and concatenates them with the timestamp to form a data set , as follows: ={ || } The terminal device will send the IP request end sent by the client SDK to the relevant data during the transmission process. , requesting Mac device number , user service number code , a single transaction serial number , timestamp , the above related information is signed by the private key of the SM2 algorithm. The signature value is mainly used to verify that the information is initiated by the client side, which is equivalent to a summary. After the server receives the information, it verifies the signature value to confirm that the information comes from the client side, not from an unknown request end, as shown in the following formula: Sign= ( || || || || ) In one implementation, generating encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number based on the random number and the data set includes: symmetrically encrypting the data set using the random number to obtain the encrypted data; and asymmetrically encrypting the random number to obtain the encrypted ciphertext.

[0059] Specifically, the SDK terminal device pre-buries the server SM2 public key The server random number machine generates a random number Rand, and the terminal device generates a random number Rand for the transmitted user data set. , use the SM4 algorithm, use Rand as the key for symmetric encryption, and generate encrypted data SC. The formula is as follows: SC= (Rand ) After obtaining the SC value, use the SM2 algorithm and the server public key The random number Rand is asymmetrically encrypted to obtain the encrypted ciphertext SR. The formula is as follows: SR=Enc( (Rand )) After obtaining the SC and SR values, the terminal device summarizes the server public key, SC, SR and other related information into a data packet Req={ , SC, SR}, and transmit the server via https.

[0060] Figure 6 An information interaction process provided by an embodiment of the present application is shown, such as Figure 6As shown, the server requests the quantum key system to issue a quantum key. The quantum key system obtains a random number, generates a quantum key, and generates a quantum key group through multiple iterations, and sends the quantum key group to the server. After obtaining the key group, the server returns the credential to the terminal device. The terminal device signs the relevant information using the server private key SC, randomly generates a random number R, and uses the SM4 composite encryption algorithm to symmetric encrypt R and the credential information, and then uses the SM2 algorithm and the authentication server public key PS to encrypt the random number R. After performing the non-composite decryption of SM2 and the symmetric decryption of SM4, the server obtains the credential and verifies the validity of the credential, and issues the target quantum key and random string. After the relevant information is returned to the terminal device, the terminal device uses the SM4 algorithm and the quantum key to encrypt the user's sensitive information, and transmits the encrypted information to the server. The server obtains the target quantum key based on the random string and decrypts the encrypted information.

[0061] In the embodiment of the present application, the purpose of generating a quantum key group is mainly to obtain the entire data set through a one-time request to the quantum key machine system based on the principle and measurement of quantum polarization state, wherein a one-time call connection can reduce frequent calls to the quantum system, and at the same time, through the generation of random strings and hashing and modulo calculation, each request can use the quantum key evenly, without the risk of cracking due to the fixed use of a specific key value, thereby further improving security.

[0062] The embodiment of the present application uses a quantum key system to generate a quantum key group, uses a randomly generated string for formal analysis, and cooperates with digital envelope encryption to solidify information transmission security, in order to prevent the fixed quantum key from being obtained by hackers through network technology during storage and transmission. The quantum key distribution system generates a quantum key group through multiple iterations. During the storage of the quantum key group, the system integrates a quantum key distribution system (Quantum Key Distribution Machine, QKM) to further optimize quantum key distribution (Quantum key Distribution, QKD), and further cooperates with the national secret algorithm SM2, SM4 to resist quantum computing attacks. After quantum key generation iterations and multiple selections of polarization bases, a quantum key combination is formed, as shown below: ={ ... } In the embodiment of the present application, after the quantum key system generates a quantum key group, a quantum key random number is generated by a random number machine. , through random number XOR processing, to prevent the risk of theft in the machine storage cache, as shown below: ={ ... } After the terminal device obtains the credentials and random string, when it requests the quantum key from the server, the server will determine the selected target quantum key based on the hash value, and then transmit the quantum key result after XOR processing to the terminal device. The terminal device will then extract the target quantum key, encrypt the sensitive information to obtain the encrypted information, and then transmit it to the server. The server then extracts the terminal device for decryption. During the transmission process, since the attacker cannot identify the internal conversion rules, even if he obtains the encrypted information transmitted on the network, he cannot extract the key.

[0063] In the comparison between the embodiment of the present application and the traditional asymmetric encryption algorithm RSA and the symmetric algorithm AES, the encryption and decryption time of SM2 and SM4 are similar, while the encryption and decryption time of RSA will increase significantly with the increase of encrypted data, while the encryption and decryption time of the national secret algorithm will increase more slowly than that of RSA. Compared with the traditional RSA+quantum key encryption combination, it has more advantages in performance.

[0064] It should be noted that the information encryption method provided in the embodiment of the present application can be executed by an information encryption device or a control module in the information encryption device for executing the information encryption method. In the embodiment of the present application, the information encryption device provided in the embodiment of the present application is described by taking the information encryption device executing the information encryption method as an example.

[0065] Figure 7 Schematic diagram of the structure of the information encryption device according to the embodiment of the present application. Figure 7 As shown, the information encryption device 700 includes: a working module 710 and a sending module 720.

[0066] The working module 710 is used to extract a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value; the sending module 720 is used to send the target quantum key to the terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0067] In one implementation, the working module 710 is also used to receive a signature value, encrypted data and encrypted ciphertext sent by the terminal device, wherein the encrypted data and the encrypted ciphertext are generated by the terminal device based on a random number and the data set, the data set is generated by the terminal device concatenating a timestamp and a credential sent by the server, and the signature value is obtained by the terminal device signing relevant information in the data transmission process.

[0068] In one implementation, the working module 710 is used to verify the signature value, and if the verification is successful, decrypt the encrypted ciphertext to obtain the random number; decrypt the encrypted data to obtain the data set; parse the data set to obtain the credential; and if the credential is successfully verified, extract the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value.

[0069] In one implementation, the working module 710 is configured to use a hash value obtained by performing hash processing on the generated random string as the random string encryption value; perform modulo processing on the number of quantum keys in the quantum key group through the random string encryption value, and extract a corresponding quantum key from the quantum key group according to the obtained modulo value as the target quantum key.

[0070] In one implementation, the working module 710 is further used to receive the encrypted information sent by the terminal device; decrypt the encrypted information using the target quantum key to obtain the sensitive information.

[0071] In one implementation, the working module 710 is further used to destroy the used target quantum key.

[0072] In one implementation, the working module 710 is further configured to destroy the quantum key group if the number of quantum keys remaining in the quantum key group after the target quantum key is destroyed is less than a quantity threshold; and to perform timing after obtaining the quantum key group, and to destroy the quantum key group if the timing time exceeds a time threshold.

[0073] In one implementation, the working module 710 is used to receive single-photon information sent by a quantum key system through a preselected polarization basis; convert the single-photon information into photon information bits according to the single-photon polarization quantity measurement, and send the photon information bits to the quantum key system; receive the single-photon information polarization state of the single-photon information sent by the quantum key system; select the corresponding single-photon information polarization state and the bit value of the photon information bit through the quantum key system and the server for comparison, and use the undisclosed part of the same bit value as the quantum key, thereby forming the quantum key group.

[0074] In one implementation, the working module 710 is further configured to regenerate a quantum key group when the proportion of quantum keys that fail to be compared exceeds a threshold; and perform XOR processing on the quantum key using the generated quantum key random number.

[0075] The information encryption device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0076] The information encryption device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0077] The information encryption device provided in the embodiment of the present application can achieve Figures 1 to 4 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0078] Figure 8 Schematic diagram of the structure of the information encryption device according to the embodiment of the present application. Figure 8 As shown, the information encryption device 800 includes: a receiving module 810 and a processing module 820.

[0079] The receiving module 810 is used to receive a target quantum key sent by a server, wherein the target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and the generated random string encryption value; the processing module 820 is used to encrypt the sensitive information to be encrypted by using the target quantum key to obtain encrypted information.

[0080] In one implementation, the encrypted value of the random character string is a hash value obtained by the server performing hash processing on the generated random character string.

[0081] In one implementation, the processing module 820 is further used to concatenate the timestamp and the server-sent credential to generate a data set; sign the relevant information in the data transmission process to obtain a signature value; generate encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number according to the random number and the data set; send the signature value, the encrypted data and the encrypted ciphertext to the server, so that the server extracts the target quantum key from the quantum key group when the server successfully verifies the signature value, the encrypted data and the encrypted ciphertext. In one implementation, the processing module 820 is used to symmetrically encrypt the data set using the random number to obtain the encrypted data; and asymmetrically encrypt the random number to obtain the encrypted ciphertext.

[0082] The information encryption device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0083] The information encryption device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0084] The information encryption device provided in the embodiment of the present application can achieve Figure 3 and Figure 5 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0085] like Fig. 9As shown, an embodiment of the present application further provides an electronic device 900, including a processor 901 and a memory 902, wherein the memory 902 stores a program or instruction that can be run on the processor 901, and when the program or instruction is executed by the processor 901, it is implemented as follows: according to the number of quantum keys in the quantum key group and the generated random string encryption value, a target quantum key is extracted from the quantum key group; the target quantum key is sent to a terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

[0086] In one implementation, before the encryption value is generated according to the number of quantum keys in the quantum key group and the random string, a signature value, encrypted data and encrypted ciphertext sent by the terminal device are received, wherein the encrypted data and the encrypted ciphertext are generated by the terminal device according to the random number and the data set, the data set is generated by the terminal device by concatenating the timestamp and the credential sent by the server, and the signature value is obtained by the terminal device signing the relevant information in the data transmission process.

[0087] In one implementation, the signature value is verified, and if the verification is successful, the encrypted ciphertext is decrypted to obtain the random number; the encrypted data is decrypted to obtain the data set; the data set is parsed to obtain the credential; In case the credential is successfully verified, a target quantum key is extracted from the quantum key group according to the number of quantum keys in the quantum key group and the generated random character string encryption value.

[0088] In one implementation, a hash value obtained by hashing the generated random string is used as the random string encryption value; the number of quantum keys in the quantum key group is modulo processed by the random string encryption value, and a corresponding quantum key is extracted from the quantum key group according to the obtained modulo value as the target quantum key.

[0089] In one implementation, the target quantum key is sent to a terminal device so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key. After obtaining the encrypted information, the encrypted information sent by the terminal device is received; and the encrypted information is decrypted by the target quantum key to obtain the sensitive information.

[0090] In one implementation, the target quantum key is sent to a terminal device so that the terminal device encrypts sensitive information to be encrypted according to the target quantum key, and after obtaining the encrypted information, the used target quantum key is destroyed.

[0091] In an implementation manner, after extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random character string encryption value, the quantum key group is destroyed if the number of quantum keys remaining in the quantum key group after the target quantum key is destroyed is less than a quantity threshold; and timing is performed after obtaining the quantum key group, and if the timing time exceeds a time threshold, the quantum key group is destroyed.

[0092] In one implementation, before extracting the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value, it also includes: receiving single photon information sent by the quantum key system through a preselected polarization basis; converting the single photon information into photon information bits according to the single photon polarization quantity measurement, and sending the photon information bits to the quantum key system; receiving the single photon information polarization state of the single photon information sent by the quantum key system; selecting the corresponding single photon information polarization state and the bit value of the photon information bit through the quantum key system and the server for comparison, and using the undisclosed part of the same bit value as the quantum key, thereby forming the quantum key group.

[0093] In one implementation, after the corresponding single-photon information polarization state and the bit value of the photon information bit are selected by the quantum key system and the server for comparison, it also includes: when the proportion of quantum keys that fail the comparison exceeds a threshold, regenerating the quantum key group; and performing XOR processing on the quantum key through the generated quantum key random number.

[0094] Alternatively, when the program or instruction is executed by the processor 901, it is implemented as follows: receiving a target quantum key sent by a server, wherein the target quantum key is extracted by the server from the quantum key group according to the number of quantum keys in the quantum key group and a generated random character string encryption value; encrypting the sensitive information to be encrypted by using the target quantum key to obtain encrypted information.

[0095] In one implementation, the encrypted value of the random character string is a hash value obtained by the server performing hash processing on the generated random character string.

[0096] In one implementation, before the target quantum key sent by the server is received, the timestamp and the certificate sent by the server are concatenated to generate a data set; the relevant information in the data transmission process is signed to obtain a signature value; according to the random number and the data set, encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number are generated; the signature value, the encrypted data and the encrypted ciphertext are sent to the server, so that the server extracts the target quantum key from the quantum key group when the verification is successful according to the signature value, the encrypted data and the encrypted ciphertext.

[0097] In one implementation, the data set is symmetrically encrypted using the random number to obtain the encrypted data; and the random number is asymmetrically encrypted to obtain the encrypted ciphertext.

[0098] The specific execution steps can refer to the various steps of the above-mentioned information encryption method embodiment, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0099] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0100] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0101] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0102] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0103] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned information encryption method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0104] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as ROM, RAM, magnetic disk or optical disk.

[0105] An embodiment of the present application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the various processes of the embodiment of the above-mentioned information encryption method and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0106] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0107] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0108] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. An information encryption method, characterized in that: Applicable to servers, including: Extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value; The target quantum key is sent to a terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

2. The method according to claim 1, characterized in that Before encrypting the value according to the number of quantum keys in the quantum key group and the generated random character string, it also includes: Receive the signature value, encrypted data and encrypted ciphertext sent by the terminal device, wherein the encrypted data and the encrypted ciphertext are generated by the terminal device based on a random number and the data set, the data set is generated by the terminal device concatenating a timestamp and a credential sent by the server, and the signature value is obtained by the terminal device signing relevant information in the data transmission process.

3. The method according to claim 2, characterized in that The step of extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random character string encryption value comprises: Verify the signature value, and if the verification passes, decrypt the encrypted ciphertext to obtain the random number; Decrypting the encrypted data to obtain the data set; Parsing the data set to obtain the credential; In the case where the credential is successfully verified, a target quantum key is extracted from the quantum key group according to the number of quantum keys in the quantum key group and the generated random character string encryption value.

4. The method according to claim 3, characterized in that The step of extracting a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random character string encryption value comprises: The hash value obtained by hashing the generated random string is used as the encrypted value of the random string; The number of quantum keys in the quantum key group is modulo processed by the encrypted value of the random character string, and the corresponding quantum key is extracted from the quantum key group as the target quantum key according to the obtained modulo value.

5. The method according to claim 1, characterized in that After sending the target quantum key to the terminal device so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain the encrypted information, the method further includes: Receiving the encrypted information sent by the terminal device; The encrypted information is decrypted using the target quantum key to obtain the sensitive information.

6. The method according to claim 1, characterized in that After sending the target quantum key to the terminal device so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain the encrypted information, the method further includes: The used target quantum key is destroyed.

7. The method according to claim 1, characterized in that After extracting the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value, the method further includes: When the number of quantum keys remaining in the quantum key group after destroying the target quantum key is less than a quantity threshold, destroying the quantum key group; After obtaining the quantum key group, timing is performed, and when the timing time exceeds a time threshold, the quantum key group is destroyed.

8. The method according to claim 1, characterized in that Before extracting the target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value, the method further includes: Receive single photon information sent by a quantum key system through a pre-selected polarization basis; Convert the single photon information into photon information bits according to the single photon polarization measurement, and send the photon information bits to the quantum key system; Receiving the single photon information polarization state of the single photon information sent by the quantum key system; The quantum key system and the server select the corresponding single-photon information polarization state and the bit value of the photon information bit for comparison, and use the undisclosed part of the same bit value as the quantum key to form the quantum key group.

9. The method according to claim 8, characterized in that After the corresponding single photon information polarization state and the bit value of the photon information bit are selected by the quantum key system and the server for comparison, the method further includes: When the proportion of quantum keys that fail to be compared exceeds a threshold, a quantum key group is regenerated; The quantum key is XORed using the generated quantum key random number.

10. An information encryption method, characterized in that: Applied to terminal equipment, including: Receiving a target quantum key sent by a server, wherein the target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and the generated random character string encryption value; The target quantum key is used to encrypt the sensitive information to obtain encrypted information.

11. The method according to claim 10, characterized in that The encrypted value of the random character string is a hash value obtained by hashing the generated random character string by the server.

12. The method according to claim 10, characterized in that Before receiving the target quantum key sent by the server, the method further includes: Concatenate the timestamp and the credential sent by the server to generate a data set; Sign the relevant information during data transmission to obtain the signature value; Generate encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number according to the random number and the data set; The signature value, the encrypted data and the encrypted ciphertext are sent to the server, so that the server extracts the target quantum key from the quantum key group when verification is successful according to the signature value, the encrypted data and the encrypted ciphertext.

13. The method according to claim 12, characterized in that The step of generating, according to the random number and the data set, encrypted data corresponding to the data set and encrypted ciphertext corresponding to the random number comprises: Symmetrically encrypt the data set using the random number to obtain the encrypted data; The random number is asymmetrically encrypted to obtain the encrypted ciphertext.

14. An information encryption device, characterized in that: Applicable to servers, including: A working module, configured to extract a target quantum key from the quantum key group according to the number of quantum keys in the quantum key group and the generated random string encryption value; The sending module is used to send the target quantum key to the terminal device, so that the terminal device encrypts the sensitive information to be encrypted according to the target quantum key to obtain encrypted information.

15. An information encryption device, characterized in that: Applied to terminal equipment, including: A receiving module, configured to receive a target quantum key sent by a server, wherein the target quantum key is extracted from the quantum key group by the server according to the number of quantum keys in the quantum key group and a generated random character string encryption value; The processing module is used to encrypt the sensitive information to be encrypted by using the target quantum key to obtain encrypted information.

16. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the information encryption method as described in any one of claims 1 to 9 are implemented or the steps of the information encryption method as described in any one of claims 10 to 13 are implemented.

17. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the information encryption method as described in any one of claims 1 to 9 or the steps of the information encryption method as described in any one of claims 10 to 13 are implemented.

18. A computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer executes the steps of the information encryption method as described in any one of claims 1 to 9 or implements the steps of the information encryption method as described in any one of claims 10 to 13.

Images