Personal application level global quantum security encryption proxy gateway and communication system

Abstract

The invention discloses a personal application level global quantum security encryption proxy gateway and a communication system. A terminal application, needing to interact with a service application subjected to global quantum security protection, in a universal terminal can establish a security session with a security agent module in the personal application level global quantum security encryption agent gateway and negotiate to determine a session key; therefore, the personal application level global quantum security encryption proxy gateway can provide quantum security service for the universal terminal based on a specific application instead of performing quantum security protection on all business applications on the universal terminal, and normal access when the universal terminal accesses public network business is prevented from being influenced. Moreover, on the basis of the established secure session and the negotiated session key, the service data is encrypted and interacted by adopting a national secret / commercial secret symmetric encryption algorithm, so that the security and confidentiality of the service data in the transmission process are ensured.

Description

Technical Field

[0001] The present application relates to the field of information security and quantum encryption technology, and in particular to a personal application-level global quantum security encryption proxy gateway and communication system. Background Art

[0002] With the rapid development of information technology, data security and privacy protection have become core issues in today's society. Global quantum security protection has emerged, aiming to treat the entire business application device as a highly secure privacy area through quantum encryption, ensuring that all business data entering and leaving the business application device is strictly protected by quantum security encryption devices. The introduction of this technical framework marks that data security protection has entered a new quantum era, providing strong technical support for responding to increasingly complex network attacks and data leakage risks.

[0003] However, in actual application, global quantum security protection faces some challenges that cannot be ignored. First of all, terminal devices usually need to take into account the access needs of both secure and non-secure services. Taking personal devices as an example, these devices not only need to access business applications of data assets protected by global quantum security, but also need to access business applications for daily information interaction with other individuals or enterprises. However, considering that not all business applications accessed by the terminal device use global quantum security protection, if the terminal device is directly upgraded to a global quantum security terminal to ensure the encryption of the terminal device's communications, this will cause the terminal device to be unable to communicate with business applications that do not use global quantum security protection, thereby affecting some of the user's normal business activities.

[0004] Moreover, in the process of promoting and popularizing global quantum security protection, there is a transitional stage that cannot be ignored. Due to the limitations of factors such as the cost, time and user acceptance of technology upgrades, it is impossible for all terminal devices to be upgraded to global quantum security protection at the same time. Therefore, over a period of time, it is inevitable that some terminal devices have been upgraded to global quantum security protection, while other terminal devices have not been upgraded to global quantum security protection. This unbalanced upgrade status poses a great challenge to how to achieve effective business communications between users with different encryption levels.

[0005] To sum up, how to realize a universal terminal that can not only meet the requirements of quantum secure encryption communication but also smoothly conduct public network business communications under the premise of ensuring data security has become a key issue that needs to be urgently solved in the current field of quantum secure encryption communication. Summary of the invention

[0006] The present application provides a personal application-level global quantum secure encryption proxy gateway and communication system, which is used to achieve a universal terminal that can meet the requirements of quantum secure encryption communication and smoothly carry out public network business communications while ensuring data security.

[0007] In a first aspect, the present application provides a personal application-level global quantum security encryption proxy gateway, wherein the personal application-level global quantum security encryption proxy gateway is used to provide quantum security communication services for terminal applications installed on general terminals when interacting with business applications protected by global quantum security in a global quantum security network. The personal application-level global quantum security encryption proxy gateway includes the following modules: a security proxy module, an interaction module, a transceiver module, and a quantum encryption module; the interaction module is connected to the security proxy module, the transceiver module, and the quantum encryption module respectively;

[0008] The security proxy module is used to establish a secure session with the terminal application and negotiate to determine a session key; based on the session key, the secure proxy module uses a pre-agreed national secret / commercial secret symmetric encryption algorithm with the terminal application to encrypt interactive business data; wherein the business data includes first business data sent by the terminal application to the business application protected by global quantum security, and second business data sent by the business application protected by global quantum security to the terminal application;

[0009] The interaction module is used to realize the data transmission between different modules and verify the security of the transmitted data;

[0010] The quantum encryption module is used to request access to an access base station in the global quantum security network, so that the personal application-level global quantum security encryption proxy gateway has the authority to communicate with the business application protected by the global quantum security; and, receive the first business data transmitted by the interaction module, obtain the first key to perform quantum encryption processing on the first business data, and, based on the pre-stored symmetric key paired with the access base station, perform quantum encryption processing on the first key; and, receive the quantum-encrypted second business data and the quantum-encrypted second key transmitted by the interaction module; based on the symmetric key, perform quantum decryption on the quantum-encrypted second key; based on the second key, perform quantum decryption processing on the quantum-encrypted second business data; through the interaction module, the second business data is transmitted to the security proxy module;

[0011] The transceiver module is used to receive the first business data after quantum encryption and the first key after quantum encryption through the interaction module; send the first business data after quantum encryption to the business application protected by global quantum security through the traditional network, and relay the first key after quantum encryption to the business application protected by global quantum security through the global quantum security network; receive the second business data after quantum encryption sent by the business application protected by global quantum security through the traditional network, and the second key after quantum encryption relayed through the global quantum security network; and transmit the second business data after quantum encryption and the second key after quantum encryption to the quantum encryption module through the interaction module.

[0012] In a second aspect, the present application also provides a proxy-type global quantum security encryption communication system, the system comprising a universal terminal, a personal application-level global quantum security encryption proxy gateway as described above, a public network application device, and a business application device protected by global quantum security;

[0013] For the terminal application in the universal terminal that interacts with the public network application device, the terminal application directly interacts with the public network application device for service data;

[0014] For the terminal application in the universal terminal that interacts with the business application device protected by global quantum security, the terminal application interacts with the business application device protected by global quantum security through the quantum security service provided by the personal application-level global quantum security encryption proxy gateway to perform business data interaction with the business application device protected by global quantum security.

[0015] The beneficial effects of this application are as follows:

[0016] 1. Through the personal application-level global quantum security encryption proxy gateway, it is possible to provide quantum security communication services between terminal applications installed on universal terminals and protected business applications in the global quantum security network without quantum transformation of universal terminals. This feature ensures that the transmission of sensitive business data can achieve quantum-level security even in traditional network environments.

[0017] 2. Only terminal applications in general terminals that need to interact with business applications protected by global quantum security will establish a secure session with the security proxy module in the personal application-level global quantum security encryption proxy gateway and negotiate to determine the session key, which is conducive to the personal application-level global quantum security encryption proxy gateway providing quantum security services for the general terminal based on specific applications, rather than quantum security protection for all business applications on the general terminal, to avoid affecting the normal access of the general terminal to public network services. In addition, based on the established secure session and the negotiated session key, the national secret / commercial secret symmetric encryption algorithm is used to encrypt and interact with the business data to ensure the security and confidentiality of the business data during transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0019] Figure 1 A schematic diagram of the structure of a personal application-level global quantum security encryption proxy gateway provided in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of the workflow of a specific personal application-level global quantum secure encryption proxy gateway provided in an embodiment of the present application;

[0021] Figure 3 A system structure diagram of a proxy-based global quantum secure encrypted communication provided for this application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0023] The global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the network, regardless of their geographical location. A core of the global quantum security network is to use the access base station as a communication hub to connect quantum security terminals to the global quantum security network, and to achieve key relay between terminals connected to the global quantum security network.

[0024] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, that is, a unique terminal identifier for the entire global quantum security network, which is used to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security network through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security network through the access base station.

[0025] During the key relay process, the encryption end will relay the key through the encryption end access base station through the global quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.

[0026] In the above-mentioned global quantum security network, the two ends of direct communication, for example, between a quantum security terminal and an access base station, or between access base stations, use a symmetric encryption method based on a true random number one-time key. This symmetric encryption method requires that only the two ends of direct communication have a unique true random number symmetric key to ensure the privacy of the communication.

[0027] However, in actual application, global quantum security protection faces some challenges that cannot be ignored. First of all, terminal devices usually need to take into account the access needs of both secure and non-secure services. Taking personal devices as an example, these devices not only need to access business applications of data assets protected by global quantum security, but also need to access business applications for daily information interaction with other individuals or enterprises. However, considering that not all business applications accessed by the terminal device use global quantum security protection, if the terminal device is directly upgraded to a global quantum security terminal to ensure the encryption of the terminal device's communications, this will cause the terminal device to be unable to communicate with business applications that do not use global quantum security protection, thereby affecting some of the user's normal business activities.

[0028] Moreover, in the process of promoting and popularizing global quantum security protection, there is a transitional stage that cannot be ignored. Due to the limitations of factors such as the cost, time and user acceptance of technology upgrades, it is impossible for all terminal devices to be upgraded to global quantum security protection at the same time. Therefore, over a period of time, it is inevitable that some terminal devices have been upgraded to global quantum security protection, while other terminal devices have not been upgraded to global quantum security protection. This unbalanced upgrade status poses a great challenge to how to achieve effective business communications between users with different encryption levels.

[0029] Based on this, the present application provides a personal application-level global quantum secure encryption proxy gateway and communication system, so that, under the premise of ensuring data security, a universal terminal can meet the demands of quantum secure encryption communication and smoothly carry out public network business communications.

[0030] Embodiment 1:

[0031] Figure 1 A schematic diagram of the structure of a personal application-level global quantum security encryption proxy gateway provided in an embodiment of the present application, wherein the personal application-level global quantum security encryption proxy gateway 100 is used to provide quantum security communication services for terminal applications installed on general terminals when interacting with business applications protected by global quantum security in a global quantum security network, and the personal application-level global quantum security encryption proxy gateway 100 includes the following modules: a security proxy module 110, an interaction module 120, a transceiver module 130, and a quantum encryption module 140; the interaction module 120 is connected to the security proxy module 110, the transceiver module 130, and the quantum encryption module 140, respectively;

[0032] The security proxy module 110 is used to establish a secure session with the terminal application and negotiate to determine a session key; based on the session key, the secure proxy module 110 uses a pre-agreed national secret / commercial secret symmetric encryption algorithm with the terminal application to encrypt interactive service data; wherein the service data includes first service data sent by the terminal application to the service application protected by global quantum security, and second service data sent by the service application protected by global quantum security to the terminal application;

[0033] The interaction module 120 is used to realize the data transmission between different modules and verify the security of the transmitted data;

[0034] The quantum encryption module 140 is used to request access to an access base station in the global quantum security network so that the personal application-level global quantum security encryption proxy gateway 100 has the authority to communicate with the business application protected by the global quantum security; and, receive the first business data transmitted by the interaction module 120, obtain the first key to perform quantum encryption processing on the first business data, and, based on the pre-stored symmetric key paired with the access base station, perform quantum encryption processing on the first key; and, receive the quantum-encrypted second business data and the quantum-encrypted second key transmitted by the interaction module 120; based on the symmetric key, perform quantum decryption on the quantum-encrypted second key; based on the second key, perform quantum decryption processing on the quantum-encrypted second business data; through the interaction module 120, the second business data is transmitted to the security proxy module 110;

[0035] The transceiver module 130 is used to receive the first business data after quantum encryption and the first key after quantum encryption through the interaction module 120; send the first business data after quantum encryption to the business application protected by global quantum security through the traditional network, and relay the first key after quantum encryption to the business application protected by global quantum security through the global quantum security network; receive the second business data after quantum encryption sent by the business application protected by global quantum security through the traditional network, and the second key after quantum encryption relayed through the global quantum security network; and transmit the second business data after quantum encryption and the second key after quantum encryption to the quantum encryption module 140 through the interaction module 120.

[0036] In order to enable a universal terminal to perform quantum secure encrypted communication without affecting the public network services of the universal terminal, a personal application-level global quantum secure encryption proxy gateway 100 (hereinafter referred to as "proxy gateway 100") is provided in the present application. By connecting the proxy gateway 100 to the universal terminal, it is possible to provide quantum security services to the universal terminal when the universal terminal needs to access business applications protected by global quantum security without quantum transformation of the universal terminal, and when the universal terminal accesses public network services, it does not affect the normal access of the universal terminal. Among them, the universal terminal refers to a terminal device that is not protected by global quantum security, such as a smart phone, a computer, etc. The proxy gateway 100 includes a security proxy module 110, an interaction module 120, a transceiver module 130, a quantum encryption module 140 and a quantum key module. The interaction module 120 is respectively connected to the security proxy module 110, the transceiver module 130 and the quantum encryption module 140, and the quantum encryption module 140 is connected to the quantum key module. The functions of each module in the proxy gateway 100 are introduced below:

[0037] A. Interaction module 120.

[0038] The interaction module 120 plays a vital role in the proxy gateway 100. Its core responsibility is to isolate and protect different modules within the proxy gateway 100, ensure the security of data transmitted within the proxy gateway 100 and the stable operation of the system, and prevent the external network from directly threatening the data in the quantum encryption module 140 and the security proxy module 110 through the transceiver module 130 of the proxy gateway 100. In particular, the interaction module 120 isolates the quantum encryption module 140 from other modules to prevent unauthorized data access, thereby protecting the core functions and data security of the quantum encryption module 140.

[0039] On this basis, the interaction module 120 needs to be responsible for transmitting data between different modules within the proxy gateway 100. This includes receiving the first business data from the security proxy module 110, and then passing it to the quantum encryption module 140 for quantum encryption processing, or receiving the first business data after quantum encryption from the quantum encryption module 140, and then passing it to the transceiver module 130 for sending, or receiving the second business data after quantum encryption from the transceiver module 130, and then passing it to the quantum encryption module 140 for quantum decryption processing, or receiving the second business data from the quantum encryption module 140, and then passing it to the security proxy module 110, etc.

[0040] During the data transmission process, the interactive module 120 will perform security checks on the data, such as verifying the integrity and compliance of the data, to ensure the overall quality of the data and the security of transmission, and to prevent the injection of malicious data. For example, by comparing the hash value or checksum of the data, the interactive module 120 can detect whether any form of tampering or damage has occurred to the data during transmission, thereby verifying the integrity of the data. For another example, the interactive module 120 can verify the compliance of the data. This usually involves checking whether the format, range, type, etc. of the data meet the expected standards, thereby verifying the compliance of the data.

[0041] In a possible implementation, the interaction module 120 is specifically configured to send the data to be quantum encrypted to the quantum encryption module 140 for quantum encryption processing if it is determined that the data type of the data to be quantum encrypted meets the pre-configured quantum security encryption and forwarding requirements.

[0042] When the interaction module 120 receives data that needs to be transmitted to the quantum encryption module 140 for quantum encryption (referred to as data to be quantum encrypted), it can check the data type of the data to be quantum encrypted. In order to accurately determine the data type, the interaction module 120 usually relies on the data header information of the data to be quantum encrypted. The data header is the starting part of a data packet, which contains important information about the content of the data packet, such as data type, data length, checksum, etc. By parsing the data header information, the interaction module 120 can quickly and accurately determine the data type of the data to be quantum encrypted. Then, the interaction module 120 will determine whether these data meet the quantum security encryption and forwarding requirements according to the pre-configured rules. Among them, the quantum security encryption and forwarding requirements may include data types that are allowed to be transmitted, and / or data types that are not allowed to be transmitted. For example, some highly sensitive data types can be explicitly listed as data types that are not allowed to be sent out, while some normal business data data types are listed as data types that must be quantum encrypted. If the interaction module 120 determines that the data to be quantum encrypted does not meet the quantum security encryption and forwarding requirements, the interaction module 120 can refuse to transmit the data to be quantum encrypted. If the interaction module 120 determines that the data to be quantum encrypted meets the quantum security encryption and forwarding requirements, the interaction module 120 can send the data to be quantum encrypted to the quantum encryption module 140 for quantum encryption processing.

[0043] In a possible implementation, the interaction module 120 is specifically configured to send the data to be quantum decrypted to the quantum encryption module 140 for quantum decryption processing if it is determined that the encryption protocol of the data to be quantum decrypted satisfies a pre-configured quantum secure encryption communication protocol.

[0044] In order to prevent forged messages from entering the quantum encryption module 140 through the transceiver module 130, thereby affecting the security of the proxy gateway 100, in the present application, the interactive module 120 can check the encryption protocol of the data to be quantum decrypted when receiving the data that needs to be passed to the quantum encryption module 140 for quantum decryption (recorded as data to be quantum decrypted). The encryption protocol refers to the encryption technology and standards used in the transmission or storage process of data, which determines how the data is encrypted and how it should be decrypted. The interactive module 120 identifies its encryption protocol by reading the metadata or specific protocol identifier in the data header. If the encryption protocol of the data to be quantum decrypted does not meet the pre-configured quantum secure encryption communication protocol, the interactive module 120 can refuse to pass the data to be quantum decrypted. If the encryption protocol of the data to be quantum decrypted meets the pre-configured quantum secure encryption communication protocol, the interactive module 120 can send the data to be quantum decrypted to the quantum encryption module 140 for quantum decryption processing.

[0045] B. Security agent module 110.

[0046] The security proxy module 110 is a bridge for data exchange between the proxy gateway 100 and the universal terminal. It is responsible for receiving requests from universal terminals to access global quantum security business applications, and forwarding these requests to other modules in the proxy gateway 100 for global quantum security protection processing. At the same time, it also returns business data from global quantum security business applications to universal terminals.

[0047] Exemplarily, before the security proxy module 110 interacts with the terminal application installed on the universal terminal for business data, it first needs to establish a secure session to identify the terminal application in the universal terminal that requires the proxy gateway 100 to provide quantum security services, and ensure the security of data transmission between the proxy gateway 100 and the terminal application. At the same time, the security proxy module 110 will also negotiate with the terminal application the session key and national secret / commercial secret symmetric encryption algorithm required for subsequent business data transmission to ensure the confidentiality and integrity of the data.

[0048] In a possible implementation, the session key may be negotiated and determined by manually filling or configuring the universal terminal and the proxy gateway 100 .

[0049] In another possible implementation, the security proxy module 110 is specifically used to receive a secure session establishment request sent by the terminal application; wherein the secure session establishment request is used to indicate that the terminal application wishes to interact with the business application protected by global quantum security; send a secure session establishment response carrying a digital certificate to the terminal application, so that the terminal application verifies the identity legitimacy of the personal application-level global quantum security encryption proxy gateway 100 based on the digital certificate; wherein the digital certificate includes the following information: a pre-configured public key of the security proxy module 110, a signature of a certificate authority of the digital certificate and a validity period; receive a session key and identity authentication information encrypted and sent by the terminal application based on the public key; wherein the identity authentication information includes the application digital certificate, user name, and password of the terminal application; based on the session key, decrypt the encrypted session key and identity authentication information; when it is determined that the terminal application is legitimate based on the identity authentication information, determine to provide quantum secure communication services for the terminal application, and save the session key.

[0050] In the process of establishing a secure session, the security proxy module 110 first receives a secure session establishment request from the terminal application. The secure session establishment request is a clear representation that the terminal application wants to interact with a business application protected by global quantum security.

[0051] After receiving the security establishment request, the security proxy module 110 can obtain the pre-saved digital certificate, and then send the security session establishment response carrying the digital certificate to the terminal application. Among them, the digital certificate is the identity proof of the security proxy module 110, which is used to ensure that the terminal application can verify the legitimacy of the identity of the proxy gateway 100. The digital certificate includes the following information: the public key of the pre-configured security proxy module 110, the signature of the certificate issuing authority of the digital certificate, and the validity period of the digital certificate. The public key is used to protect the confidentiality of the session key. The signature of the certificate issuing authority of the digital certificate is used to prove the authenticity and validity of the digital certificate and prevent the forgery of the digital certificate. The validity period is used to indicate the validity period of the digital certificate to ensure that the digital certificate is no longer used after expiration.

[0052] After receiving the secure session establishment response carrying the digital certificate, the terminal application parses the secure session establishment response to obtain the digital certificate. Then, based on the digital certificate, the legitimacy of the identity of the proxy gateway 100 is verified. If it is determined that the identity of the proxy gateway 100 is not legal, the response is rejected; if it is determined that the identity of the proxy gateway 100 is legal, the identity authentication information is obtained and a session key is generated. The identity authentication information is used to verify the legitimacy of the terminal application, which includes the application digital certificate, user name and password of the terminal application. Based on the public key, the identity authentication information and the session key are encrypted and sent to the secure proxy module 110 of the proxy gateway 100.

[0053] The terminal application may send the identity authentication information and the session key to the security agent module 110 simultaneously, or may send them to the security agent module 110 asynchronously, which is not specifically limited here.

[0054] When the security proxy module 110 receives the encrypted identity authentication information and the encrypted session key sent by the terminal application, it obtains the pre-configured private key. According to the private key, the encrypted identity authentication information and the encrypted session key are decrypted to obtain the plain text of the session key and the identity authentication information. The security proxy module 110 verifies the legitimacy of the terminal application based on the decrypted identity authentication information. If the terminal application is determined to be illegal based on the identity authentication information, the terminal application is refused to respond; if the terminal application is determined to be legal based on the identity authentication information, it is determined to provide quantum secure communication services for the terminal application, and the session key is saved for use in subsequent communication processes, thereby establishing a secure and reliable communication channel between the proxy gateway 100 and the terminal application.

[0055] Based on the above embodiment, a secure session can be established between the security agent module 110 and the terminal application, and a session key can be determined through negotiation. Subsequently, the security agent module 110 and the terminal application can use a pre-agreed national secret / commercial secret symmetric encryption algorithm based on the session key to encrypt and transmit business data. Among them, the national secret / commercial secret symmetric encryption algorithm refers to a national secret algorithm (such as SM1, SM2, SM3, SM4, SM7, SM9, etc.) or a commercial encryption algorithm (such as AES, DES, etc.).

[0056] Exemplarily, when the terminal application needs to send data (first business data) to a business application protected by global quantum security, the terminal application will encrypt the first business data based on the session key through a pre-agreed national secret / commercial secret symmetric encryption algorithm, and transmit the first business data after classical encryption to the security agent module 110 of the proxy gateway 100. After receiving the first business data after classical encryption, the security agent module 110 decrypts the first business data after classical encryption based on the session key through a pre-agreed national secret / commercial secret symmetric encryption algorithm to obtain the first business data. The security agent module 110 securely sends the first business data to the business application protected by global quantum security that is desired to be accessed through other modules of the proxy gateway 100 (such as the transceiver module 130, the quantum encryption module 140, the interaction module 120, etc.).

[0057] In another exemplary embodiment, the security proxy module 110 of the proxy gateway 100 obtains the business data (recorded as the second business data) sent to the terminal application by the business application protected by global quantum security through the interactive module 120 of the proxy gateway 100. The security proxy module 110 encrypts the second business data based on the session key through the pre-agreed national secret / commercial secret symmetric encryption algorithm, and transmits the classically encrypted second business data to the terminal application. After the terminal application receives the classically encrypted second business data, it decrypts the classically encrypted second business data based on the session key through the pre-agreed national secret / commercial secret symmetric encryption algorithm to obtain the second business data.

[0058] C. Quantum encryption module 140.

[0059] The quantum encryption module 140 is a core component of the proxy gateway 100 that ensures the security of data during network transmission. It is mainly responsible for the following key tasks:

[0060] I. Network communication and access rights acquisition

[0061] The quantum encryption module 140 is first responsible for communicating with the access base station in the global quantum security network. This step is crucial because it involves the process of requesting access to the global quantum security network and obtaining communication rights in the network. Only by successfully obtaining communication rights can the quantum encryption module 140 ensure that subsequent access to business applications protected by global quantum security can proceed smoothly. Exemplarily, after the proxy gateway 100 is powered on, the quantum encryption module 140 will automatically initiate an access authentication process to the access base station and request access to the global quantum security network.

[0062] It should be noted that when the quantum encryption module 140 successfully accesses the access base station in the global quantum security network, the quantum encryption module 140 will save the symmetric key paired with the access base station. Similarly, the access base station will also save the symmetric key paired with the proxy gateway 100 to facilitate the subsequent provision of key relay services for the proxy gateway 100.

[0063] In one example, the quantum encryption module 140 is further configured to generate a successful access notification message upon receiving a response message sent by the access base station indicating successful access; and send the successful access notification message to the security proxy module 110 through the interaction module 120;

[0064] The security agent module 110 is specifically configured to establish a security session with the terminal application and negotiate to determine a session key when receiving the successful access notification message.

[0065] In the present application, after the proxy gateway 100 successfully accesses the global quantum security network, it will notify the security proxy module 110 that the access is successful, so as to notify the security proxy module 110 that it can normally establish a secure session with the terminal application. Exemplarily, when the quantum encryption module 140 receives a response message sent by the access base station indicating successful access, it can generate a successful access notification message, and then send the successful access notification message to the interaction module 120, so as to pass the successful access notification message to the security proxy module 110 through the interaction module 120. Once the security proxy module 110 receives the successful access notification message, it means that the security proxy module 110 can normally establish a secure session with the terminal application, and then the security proxy module 110 can establish a secure session with the terminal application and negotiate to determine the session key.

[0066] In a possible implementation, considering that there may be situations such as the access base station being offline, access authentication failure, etc., resulting in the proxy gateway 100 not being successfully connected to the global quantum security network, the quantum encryption module 140, when determining that the proxy gateway 100 has not successfully connected to the global quantum security network, can generate a failed access notification message to notify the security proxy module 110 that the current proxy gateway 100 has failed to access the global quantum security network, and the security proxy module 110 directly rejects the secure session establishment request received by the terminal application. Exemplarily, the quantum encryption module 140 can generate a failed access notification message when it does not receive a response message representing successful access sent by the access base station, and then send the failed access notification message to the interaction module 120, so that the failed access notification message is transmitted to the security proxy module 110 through the interaction module 120. Once the security proxy module 110 receives the failed access notification message, it means that the security proxy module 110 cannot provide quantum security services for the terminal application, and then the security proxy module 110 rejects the secure session establishment request when it receives the secure session establishment request initiated by the terminal application.

[0067] II. Provide quantum encryption processing.

[0068] For the first business data sent by the terminal application to the global quantum security protection, the quantum encryption module 140 can perform quantum encryption processing on the first business data to achieve the first business data in the subsequent network transmission process. The data cannot be easily decrypted even if it is intercepted during the transmission process, thereby ensuring the security of the data.

[0069] Exemplarily, based on the above embodiment, the quantum encryption module 140 can receive the first business data transmitted by the security proxy module 110 through the interaction module 120. For the first business data, the quantum encryption module 140 can obtain the key (referred to as the first key) used to quantum encrypt the first business data, and then based on the first key, perform quantum encryption processing on the first business data to obtain the first business data after quantum encryption processing. At the same time, the quantum encryption module 140 will also obtain the pre-saved symmetric key paired with the access base station accessed by the proxy gateway 100. Based on the symmetric key, the first key is quantum encrypted to obtain the first key after quantum encryption. The purpose of this is double protection. Even if the first key is intercepted during transmission, the attacker cannot directly obtain the real key information.

[0070] III. Provide quantum decryption processing.

[0071] Corresponding to the quantum encryption processing, the quantum decryption processing is another important function of the quantum encryption module 140. For the second business data after quantum encryption that is protected and sent by the global quantum security, the quantum encryption module 140 can perform quantum decryption processing on it to restore the original second business data. Exemplarily, when the quantum encryption module 140 receives the second business data after quantum encryption through the interaction module 120, it will obtain the key (referred to as the second key) for decrypting the second business data after quantum encryption. Then, based on the second key, the second business data after quantum encryption is quantum decrypted to restore the original second business data. The second business data is then transmitted to the security agent module 110 through the interaction module 120.

[0072] Among them, the second key is relayed by the business application protected by global quantum security through the global quantum security network. In addition, in order to protect the security of the second key from the access base station to the proxy gateway 100, the access base station, when obtaining the second key, performs quantum encryption on the second key based on the symmetric key paired with the proxy gateway 100 to obtain the second key after quantum encryption. Then the second key after quantum encryption is sent to the proxy gateway 100. Therefore, the quantum encryption module 140 of the proxy gateway 100 can receive the second key after quantum encryption from the transceiver module 130 of the proxy gateway 100 through the interaction module 120. Then, based on the symmetric key paired with the access base station, the second key after quantum encryption is decrypted to obtain the second key.

[0073] In a possible implementation, the quantum encryption module 140 may include a quantum encryption and decryption processing submodule and a quantum key submodule. The quantum encryption and decryption processing submodule is connected to the interaction module 120 and the quantum key submodule respectively. The quantum key submodule is mainly used to store and manage the key area, and when the quantum encryption and decryption processing submodule needs a quantum key, it provides the quantum encryption and decryption processing submodule with a quantum key. The quantum encryption and decryption processing submodule is used to request access to an access base station in the global quantum security network so that the proxy gateway 100 has the authority to communicate with the business application protected by the global quantum security; and, receive the first business data transmitted by the interaction module 120, obtain the first key from the quantum key submodule, and based on the first key, perform quantum encryption processing on the first business data, and, based on the symmetric key paired with the access base station obtained from the quantum key submodule, perform quantum encryption processing on the first key; and, receive the quantum-encrypted second business data and the quantum-encrypted second key transmitted by the interaction module 120; based on the symmetric key paired with the access base station obtained from the quantum key submodule, perform quantum decryption on the quantum-encrypted second key; based on the second key, perform quantum decryption processing on the quantum-encrypted second business data; and transmit the second business data to the security proxy module 110 through the interaction module 120.

[0074] D. transceiver module 130.

[0075] The transceiver module 130 is a key module in the proxy gateway 100 responsible for communicating with external networks (including traditional networks and global quantum security networks). The following describes the transceiver scenarios of the transceiver module 130:

[0076] Scenario 1: Sending scenario.

[0077] In this scenario, the transceiver module 130 is mainly responsible for sending data to business applications protected by global quantum security through an external network.

[0078] Exemplarily, the transceiver module 130 can receive the quantum encrypted first business data and its corresponding destination address transmitted by the quantum encryption module 140 through the interaction module 120 of the proxy gateway 100. Then, through the traditional network, according to the destination address, the quantum encrypted first business data is sent to the business application protected by the global quantum security.

[0079] The destination address is transmitted to the security proxy module 110 of the proxy gateway 100 when the terminal application transmits the first service data. The security proxy module 110 transmits the destination address and the first service data to the quantum encryption module 140 through the interaction module 120.

[0080] In another exemplary embodiment, the transceiver module 130 may also receive the first key after quantum encryption transmitted by the quantum encryption module 140 through the interaction module 120. The first key after quantum encryption is sent to the access base station for relaying through the global quantum security network.

[0081] Scenario 2: Receiving scenario.

[0082] In addition to sending data, the transceiver module 130 is also used to receive data. The transceiver module 130 can receive the second business data after quantum encryption sent by the business application protected by global quantum security through the traditional network, and receive the second key after quantum encryption from the business application protected by global quantum security from the access base station through the global quantum security network. Once the second business data after quantum encryption is obtained, the transceiver module 130 can pass the second business data after quantum encryption to the quantum encryption module 140 through the interaction module 120 for subsequent quantum decryption processing. Similarly, once the second key after quantum encryption is obtained, the transceiver module 130 passes the second key after quantum encryption to the quantum encryption module 140 through the interaction module 120, so that the quantum encryption module 140 can perform subsequent quantum decryption processing based on the second key after quantum encryption.

[0083] The beneficial effects of this application are as follows:

[0084] 1. Through the personal application-level global quantum security encryption proxy gateway 100, it is possible to provide quantum security communication services between terminal applications installed on universal terminals and protected business applications in the global quantum security network without quantum transformation of universal terminals. This feature ensures that even in traditional network environments, the transmission of sensitive business data can achieve quantum-level security.

[0085] 2. The terminal application in the general terminal that needs to interact with the business application protected by global quantum security will establish a secure session with the security agent module 110 in the personal application-level global quantum security encryption proxy gateway 100, and negotiate to determine the session key, which is conducive to the personal application-level global quantum security encryption proxy gateway 100 to provide quantum security services for the general terminal based on specific applications, rather than quantum security protection for all business applications on the general terminal, to avoid affecting the normal access of the general terminal to the public network business. In addition, based on the established secure session and the negotiated session key, the national secret / commercial secret symmetric encryption algorithm is used to encrypt and interact with the business data to ensure the security and confidentiality of the business data during transmission.

[0086] 3. The interactive module 120 in the personal application-level global quantum security encryption proxy gateway 100 isolates and protects different modules inside the proxy gateway 100, ensuring the security of data transmitted inside the proxy gateway 100 and the stable operation of the system, and preventing the external network from directly threatening the data in the quantum encryption module 140 and the security proxy module 110 through the transceiver module 130 of the proxy gateway 100. In particular, the interactive module 120 isolates the quantum encryption module 140 from other modules to prevent unauthorized data access, thereby protecting the core functions and data security of the quantum encryption module 140.

[0087] 4. The quantum encryption module 140 in the personal application-level global quantum security encryption proxy gateway 100 obtains the permission to communicate with the business application protected by global quantum security by requesting access to the access base station in the global quantum security network. At the same time, the quantum encryption module 140 can also provide quantum encryption and decryption processing, thereby ensuring the secure transmission of business data in the quantum security network.

[0088] Embodiment 2:

[0089] The following is an explanation of the workflow of the personal application-level global quantum security encryption proxy gateway provided by this application through a specific embodiment. Figure 2 A schematic diagram of the workflow of a specific personal application-level global quantum security encryption proxy gateway provided in an embodiment of the present application. The process mainly includes an access phase, a session establishment phase, and a communication phase. For each phase, the following steps are performed:

[0090] Phase 1: Access phase.

[0091] S201: After the proxy gateway is powered on, the quantum encryption and decryption processing submodule of the proxy gateway will automatically initiate an access authentication process to the access base station, requesting access to the global quantum security network.

[0092] S202: When receiving a response message indicating successful access sent by the access base station, the quantum encryption and decryption processing submodule generates a successful access notification message and sends it to the interaction module of the proxy gateway.

[0093] S203: When the interaction module determines that the successful access notification message passes the security check, the interaction module sends the successful access notification message to the security proxy module of the proxy gateway.

[0094] S204: Upon receiving the successful access notification message, the security proxy module determines that a secure session can be established with the terminal application on the universal terminal.

[0095] In a possible implementation, the quantum encryption module may generate a failed access notification message when it does not receive a response message sent by the access base station indicating successful access, and then send the failed access notification message to the interaction module, so that the failed access notification message is passed to the security agent module through the interaction module. Once the security agent module receives the failed access notification message, it means that the security agent module cannot provide quantum security services for the terminal application. Then, when the security agent module receives a secure session establishment request initiated by the terminal application, it rejects the secure session establishment request.

[0096] Phase 2: Session establishment phase.

[0097] S301: When a terminal application on a general terminal needs to access a business application protected by global quantum security, a secure session establishment request is sent to the secure proxy module of the proxy gateway.

[0098] S302: After receiving the security establishment request, the security proxy module may obtain a pre-stored digital certificate, and then send a security session establishment response carrying the digital certificate to the terminal application.

[0099] Among them, the digital certificate is the identity proof of the security proxy module, which is used to ensure that the terminal application can verify the legitimacy of the identity of the proxy gateway. The digital certificate includes the following information: the public key of the pre-configured security proxy module, the signature of the certificate authority of the digital certificate, and the validity period of the digital certificate. The public key is used to protect the confidentiality of the session key. The signature of the certificate authority of the digital certificate is used to prove the authenticity and validity of the digital certificate and prevent the forgery of the digital certificate. The validity period is used to indicate the validity period of the digital certificate to ensure that the digital certificate is no longer used after it expires.

[0100] S303: After receiving the secure session establishment response carrying the digital certificate, the terminal application verifies the legitimacy of the identity of the proxy gateway based on the digital certificate.

[0101] S304: When it is determined that the identity of the proxy gateway is legitimate, identity authentication information is obtained and a session key is generated. Based on the public key, the identity authentication information and the session key are encrypted and sent to the security proxy module of the proxy gateway.

[0102] The identity authentication information is used to verify the legitimacy of the terminal application, and includes the application digital certificate, user name and password of the terminal application.

[0103] In a possible implementation, if the terminal application determines that the identity of the proxy gateway is illegal based on the digital certificate, the terminal application refuses to respond.

[0104] S305: When the security proxy module receives the encrypted identity authentication information and the encrypted session key sent by the terminal application, it obtains the pre-configured private key, decrypts the encrypted identity authentication information and the encrypted session key according to the private key, and obtains the plain text of the session key and the identity authentication information.

[0105] S306: The security proxy module verifies the legitimacy of the terminal application based on the decrypted identity authentication information.

[0106] S307: When it is determined that the terminal application is legitimate based on the identity authentication information, the security agent module determines to provide quantum secure communication services for the terminal application and saves the session key.

[0107] Phase three: communication phase.

[0108] For sending scenarios:

[0109] S401: The terminal application uses the session key and the national / commercial symmetric encryption algorithm to encrypt the first business data, and sends the first business data after classical encryption to the security proxy module of the proxy gateway.

[0110] S402: The security proxy module decrypts the classically encrypted first business data using a pre-agreed national secret / commercial secret symmetric encryption algorithm based on the session key to obtain the first business data.

[0111] S403: The security proxy module transmits the first service data to the interaction module.

[0112] S404: The interaction module determines whether the data type of the first business data meets the quantum security encryption and forwarding requirements.

[0113] S405: When determining that the data type of the first business data meets the quantum security encryption and forwarding requirements, the interaction module forwards the first business data to the quantum encryption module.

[0114] S406: The quantum encryption and decryption processing submodule receives the business data of the terminal application, obtains the first key used to quantum encrypt the first business data from the quantum key submodule, and then performs quantum encryption processing on the first business data based on the first key to obtain the first business data after quantum encryption processing.

[0115] S407: The quantum encryption and decryption processing submodule obtains the symmetric key paired with the access base station from the quantum key submodule, and based on the symmetric key, performs quantum encryption processing on the first key to obtain the first key after quantum encryption.

[0116] S408: The quantum encryption and decryption processing submodule sends the quantum-encrypted first business data and its corresponding destination address, as well as the quantum-encrypted first key to the interaction module.

[0117] S409: The interaction module forwards the quantum-encrypted first business data and its corresponding destination address, as well as the quantum-encrypted first key to the transceiver module of the proxy gateway.

[0118] S410: When receiving the first business data after quantum encryption and its corresponding destination address, the transceiver module sends the first business data after quantum encryption to the business application protected by global quantum security through a traditional network according to the destination address.

[0119] S411: When the transceiver module receives the first key after quantum encryption, it sends the first key after quantum encryption to the access base station for relaying through the global quantum security network, so that the first key is relayed to the business application protected by the global quantum security.

[0120] For the receiving scenario:

[0121] S501: When the transceiver module receives quantum-encrypted second business data sent by a business application protected by global quantum security through a traditional network, the quantum-encrypted second business data is transmitted to the interaction module, and S503 is executed.

[0122] S502: When the transceiver module receives the second key after quantum encryption relayed from the service application protected by the global quantum security from the access base station through the global quantum security network, the second key after quantum encryption is transmitted to the interaction module.

[0123] S503: The interaction module checks whether the encryption protocol of the data to be quantum decrypted satisfies the pre-configured quantum secure encryption communication protocol.

[0124] The data to be quantum decrypted includes the second business data after quantum encryption and the second key after quantum encryption.

[0125] S504: When it is determined that the encryption protocol of the data to be quantum decrypted satisfies the pre-configured quantum secure encryption communication protocol, the interaction module sends the data to be quantum decrypted to the quantum encryption and decryption processing submodule for quantum decryption processing.

[0126] In a possible implementation, if the encryption protocol of the data to be quantum decrypted does not satisfy the pre-configured quantum secure encryption communication protocol, the interaction module may refuse to transmit the data to be quantum decrypted.

[0127] S505: For the second key after quantum encryption received by the quantum encryption and decryption processing submodule, the quantum encryption and decryption processing submodule can obtain the symmetric key paired with the access base station from the quantum key submodule, and decrypt the second key after quantum encryption based on the symmetric key to obtain the second key.

[0128] S506: For the quantum encrypted second business data received by the quantum encryption and decryption processing submodule, the quantum encryption and decryption processing submodule obtains a second key, and decrypts the quantum encrypted second business data based on the second key to obtain the second business data.

[0129] S507: The quantum encryption and decryption processing submodule transmits the second service data to the interaction module.

[0130] S508: The interaction module performs security verification on the second service data.

[0131] S509: When the interaction module determines that the second service data passes the security check, the second service data is transmitted to the security proxy module.

[0132] S510: The security proxy module encrypts the second business data based on the session key using a national secret / commercial secret symmetric encryption algorithm, and sends the second business data after classical encryption to the terminal application.

[0133] S511: The terminal application decrypts the received classically encrypted second service data using a national secret / commercial secret symmetric encryption algorithm based on the session key to obtain the second service data.

[0134] Embodiment 3:

[0135] Based on the same inventive concept, the present application also provides a proxy-based global quantum secure encryption communication system. Figure 3 A system structure diagram of a proxy-based global quantum security encryption communication provided by the present application, the system comprising a general terminal 31, a personal application-level global quantum security encryption proxy gateway 32 as in any of the above embodiments, a public network application device 33, and a business application device 34 protected by global quantum security;

[0136] For the terminal application in the universal terminal 31 that interacts with the public network application device 33, the terminal application 31 directly interacts with the public network application device 33 for business data;

[0137] For the terminal application in the universal terminal 31 that interacts with the business application device 34 protected by global quantum security, the terminal application interacts with the business application device 34 protected by global quantum security through the quantum security service provided by the personal application-level global quantum security encryption proxy gateway 32 to perform business data interaction with the business application device 34 protected by global quantum security.

[0138] After being processed by the personal application-level global quantum security encryption proxy gateway 32, when the general terminal needs to access the business application device 34 protected by global quantum security, it will first access the personal application-level global quantum security encryption proxy gateway 32. The communication between the general terminal 31 and the personal application-level global quantum security encryption proxy gateway 32 adopts national secret / commercial secret symmetric encryption communication. After being decrypted by the national secret / commercial secret of the personal application-level global quantum security encryption proxy gateway 32, it is converted into quantum security encryption to access the business application device 34 protected by global quantum security. In other words, the first business data sent by the terminal application on the general terminal 31 to the business application device 34 protected by global quantum security is converted into data protected by quantum encryption and transmitted in the network after being processed by the personal application-level global quantum security encryption proxy gateway 32.

[0139] Similarly, the quantum-encrypted second business data sent by the business application device 34 protected by global quantum security to the terminal application of the universal terminal 31 can also be first sent to the personal application-level global quantum security encryption proxy gateway 32 for decryption processing, and then the decrypted second business data can be sent to the terminal application through national / commercial symmetric encryption communication.

[0140] If the universal terminal 31 interacts with the public network application device 33, the terminal application in the universal terminal 31 that interacts with the public network application device 33 can directly establish a connection with the public network application device 33, and interact with the business data of the public network application service on the public network application device using public network encryption or unencrypted mode.

[0141] Based on this, general terminals can access both quantum security services and public network services on a single device, with national / commercial encryption protection adopted at the near end.

[0142] It should be noted that the principle of solving the specific problem by the personal application-level global quantum secure encryption proxy gateway is the same as the principle of solving the technical problem in the above-mentioned device embodiment, and the repeated parts will not be repeated.

Claims

1. A personal application-level global quantum security encryption proxy gateway, characterized in that: The personal application-level global quantum security encryption proxy gateway is used to provide quantum security communication services for terminal applications installed on general terminals when interacting with business applications protected by global quantum security in the global quantum security network. The personal application-level global quantum security encryption proxy gateway includes the following modules: a security proxy module, an interaction module, a transceiver module, and a quantum encryption module; the interaction module is connected to the security proxy module, the transceiver module, and the quantum encryption module respectively; The security proxy module is used to establish a secure session with the terminal application and negotiate to determine a session key; based on the session key, the secure proxy module uses a pre-agreed national secret / commercial secret symmetric encryption algorithm with the terminal application to encrypt interactive business data; wherein the business data includes first business data sent by the terminal application to the business application protected by global quantum security, and second business data sent by the business application protected by global quantum security to the terminal application; The interaction module is used to realize the data transmission between different modules and verify the security of the transmitted data; The quantum encryption module is used to request access to an access base station in the global quantum security network, so that the personal application-level global quantum security encryption proxy gateway has the authority to communicate with the business application protected by the global quantum security; and, receive the first business data transmitted by the interaction module, obtain the first key to perform quantum encryption processing on the first business data, and, based on the pre-stored symmetric key paired with the access base station, perform quantum encryption processing on the first key; and, receive the quantum-encrypted second business data and the quantum-encrypted second key transmitted by the interaction module; based on the symmetric key, perform quantum decryption on the quantum-encrypted second key; based on the second key, perform quantum decryption processing on the quantum-encrypted second business data; through the interaction module, the second business data is transmitted to the security proxy module; The transceiver module is used to receive the first business data after quantum encryption and the first key after quantum encryption through the interaction module; send the first business data after quantum encryption to the business application protected by global quantum security through the traditional network, and relay the first key after quantum encryption to the business application protected by global quantum security through the global quantum security network; receive the second business data after quantum encryption sent by the business application protected by global quantum security through the traditional network, and the second key after quantum encryption relayed through the global quantum security network; and transmit the second business data after quantum encryption and the second key after quantum encryption to the quantum encryption module through the interaction module.

2. The personal application-level global quantum-safe encryption proxy gateway according to claim 1, characterized in that: The security proxy module is specifically used to receive a security session establishment request sent by the terminal application; wherein the security session establishment request is used to indicate that the terminal application wishes to interact with the business application protected by global quantum security; send a security session establishment response carrying a digital certificate to the terminal application, so that the terminal application verifies the identity legitimacy of the personal application-level global quantum security encryption proxy gateway based on the digital certificate; wherein the digital certificate includes the following information: a pre-configured public key of the security proxy module, a signature of a certificate authority and a validity period of the digital certificate; receive a session key and identity authentication information encrypted and sent by the terminal application based on the public key; wherein the identity authentication information includes the application digital certificate, user name, and password of the terminal application; based on the session key, decrypt the encrypted session key and identity authentication information; when it is determined that the terminal application is legitimate based on the identity authentication information, determine to provide quantum secure communication services for the terminal application, and save the session key.

3. The personal application-level global quantum-safe encryption proxy gateway according to claim 1, characterized in that: The quantum encryption module is further configured to generate a successful access notification message upon receiving a response message sent by the access base station indicating successful access; and send the successful access notification message to the security proxy module through the interaction module; The security proxy module is specifically configured to establish a security session with the terminal application and negotiate to determine a session key when receiving the successful access notification message.

4. The personal application-level global quantum secure encryption proxy gateway as claimed in claim 1, characterized in that: The security proxy module is specifically used to receive the first business data after classical encryption sent by the terminal application; decrypt the first business data after classical encryption based on the session key through the national secret / commercial secret symmetric encryption algorithm to obtain the first business data; and, receive the second business data through the interaction module; encrypt the second business data based on the session key through the national secret / commercial secret symmetric encryption algorithm and send the classically encrypted second business data to the terminal application.

5. The personal application-level global quantum-safe encryption proxy gateway according to claim 1, characterized in that: The interaction module is specifically used to send the data to be quantum encrypted to the quantum encryption module for quantum encryption processing if it is determined that the data type of the data to be quantum encrypted meets the pre-configured quantum security encryption and forwarding requirements.

6. The personal application-level global quantum-safe encryption proxy gateway according to claim 1, characterized in that: The interactive module is specifically used to send the data to be quantum decrypted to the quantum encryption module for quantum decryption processing if it is determined that the encryption protocol of the data to be quantum decrypted meets the pre-configured quantum secure encryption communication protocol.

7. The personal application-level global quantum-safe encryption proxy gateway according to claim 1, characterized in that: The quantum encryption module includes a quantum encryption and decryption processing submodule and a quantum key submodule; wherein the quantum encryption and decryption processing submodule is connected to the interaction module and the quantum key submodule respectively; The quantum key submodule is used to store and manage quantum keys, and to provide the quantum encryption and decryption processing submodule with keys required for quantum encryption and decryption processing; The quantum encryption and decryption processing submodule is used to request access to an access base station in the global quantum security network so that the personal application-level global quantum security encryption proxy gateway has the authority to communicate with the business application protected by the global quantum security; and, receive the first business data transmitted by the interaction module, obtain the first key from the quantum key submodule, perform quantum encryption processing on the first business data based on the first key, and, based on the symmetric key stored in the quantum key submodule, perform quantum encryption processing on the first key; and, receive the quantum encrypted second business data and the quantum encrypted second key transmitted by the interaction module; perform quantum decryption on the quantum encrypted second key based on the symmetric key stored in the quantum key submodule; perform quantum decryption on the quantum encrypted second business data based on the second key; and transmit the second business data to the security proxy module through the interaction module.

8. A proxy-based global quantum secure encryption communication system, characterized in that: The system comprises: a universal terminal, a personal application-level global quantum security encryption proxy gateway as claimed in any one of claims 1 to 7, a public network application device, and a business application device protected by global quantum security; For the terminal application in the universal terminal that interacts with the public network application device, the terminal application directly interacts with the public network application device for service data; For the terminal application in the universal terminal that interacts with the business application device protected by global quantum security, the terminal application interacts with the business application device protected by global quantum security through the quantum security service provided by the personal application-level global quantum security encryption proxy gateway to perform business data interaction with the business application device protected by global quantum security.

Images