Data storage device based on quantum random numbers in intranet and its encryption implementation method

Abstract

This invention discloses a data storage device based on quantum random numbers in an intranet and its encryption implementation method, relating to the field of encrypted storage technology. The encryption method includes: executed by the encrypted data storage device: obtaining a gateway address and a gateway public key, and establishing a network connection with the intranet gateway; generating corresponding device public and private keys, and sending the device public key to the intranet gateway through the established network connection; generating a first link identifier and a first session key using random numbers, and negotiating with the intranet gateway to establish a first session link identified by the first link identifier and encrypted with the first session key; obtaining the device identifier and intranet signature through the first session link; and secretly storing registration information to enable the data storage device to encrypt transmitted data under intranet conditions. This invention improves the security of data storage devices under intranet conditions, enables multi-user collaborative work, and enhances the convenience of data storage devices.

Description

Technical Field

[0001] This invention relates to the field of encrypted storage technology, and in particular to a data storage device based on quantum random numbers in an intranet and its encryption implementation method. Background Technology

[0002] A self-encrypting drive (SED) is a storage device that integrates hardware encryption, enabling it to automatically encrypt and decrypt its stored data without relying on the host system's software or operating system. The encryption and decryption process is transparent and requires no manual intervention from the user.

[0003] The mainstream encryption standard for self-encrypting data storage devices in current technology is AES (Advanced Encryption Standard), which typically uses a 256-bit key length. Its encryption and decryption processes are transparent; the data storage device controller automatically encrypts and decrypts data. All data written to the data storage device is automatically encrypted, and data is automatically decrypted when read. Based on the key storage location, it can be broadly divided into built-in key management and external key management methods. Built-in key methods typically use hardware modules (such as TPMs or independent encryption chips) to store and manage encryption keys. The keys are usually stored in the data storage device controller and never leave the data storage device; only authenticated users can unlock them. External key methods allow self-encrypting data storage devices to integrate with external key management systems (Key Management Interoperability Protocol, KMIP). The external key manager (such as an enterprise key management server) is responsible for managing and storing the encryption keys.

[0004] With the emergence of numerous business and technology scenarios such as mobile office, enterprise design outsourcing, enterprise development collaboration, and network data storage and access, enterprises and individuals are increasingly concerned about the risks and concerns of organizational data asset and personal data leakage. Practice has shown that in mobile or collaborative office scenarios, existing data storage devices, whether using built-in key management or external key management methods, are insufficient in terms of both security and convenience. Summary of the Invention

[0005] This invention provides a quantum random number-based data storage device and its encryption implementation method for intranets, which improves the security and convenience of the encryption process of data storage devices in existing technologies in mobile or collaborative office scenarios.

[0006] To address the aforementioned technical problems, the first aspect of this invention discloses a method for encrypting a data storage device based on quantum random numbers in an intranet. The method is applied to the encrypted data storage device and includes:

[0007] The encrypted data storage device obtains the gateway address and gateway public key, and establishes a network connection with the intranet gateway.

[0008] The encrypted data storage device generates a corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection.

[0009] The encrypted data storage device uses a random number to generate a first link identifier IDsession1 and a first session key KS1, and negotiates with the intranet gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1.

[0010] The encrypted data storage device obtains the device identifier Diskid and the intranet signature Disksign through the first session link. The device identifier Diskid is an identifier generated by the intranet gateway for the encrypted data storage device, and the intranet signature Disksign is a signature of the encrypted data storage device by the intranet gateway using the gateway private key.

[0011] The encrypted data storage device secretly stores registration information to enable the encrypted data storage device to encrypt transmitted data under intranet conditions. The registration information includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign.

[0012] As an optional implementation, in the first aspect of the present invention, the method further includes:

[0013] The encrypted data storage device generates a corresponding first key component K1 and a second key component K2, and uses the gateway public key to encrypt the first key component K1 to obtain the first encrypted key component K1'.

[0014] The encrypted data storage device obtains the accessible user identifier;

[0015] The encrypted data storage device secretly stores initialization information to enable the encrypted data storage device to manage access users under intranet conditions. The initialization information includes the second key component K2, the first encryption key component K1', and the accessible user identifier.

[0016] As an optional implementation, in the first aspect of the present invention, the method further includes:

[0017] In response to the access request of the currently accessing user, the encrypted data storage device generates a second link identifier IDsession2 and a second session key KS2 using a random number;

[0018] The encrypted data storage device uses the second session key KS2 to encrypt the second link identifier IDsession2, and uses the device private key Diskpri to sign it, thus obtaining the second encrypted link identifier IDsession2'.

[0019] The encrypted data storage device uses the second session key KS2 to encrypt the device identifier Diskid, and uses the device private key Diskpri to sign it, thus obtaining the encrypted device identifier Diskid'.

[0020] The encrypted data storage device uses the gateway public key to encrypt the second session key KS2, and uses the device private key Diskpri to sign it, to obtain the second encrypted session key KS2'.

[0021] The encrypted data storage device sends the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the intranet gateway, so that the intranet gateway uses the gateway public key to decrypt the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to decrypt the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid.

[0022] When the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct, a second session link is established between the encrypted data storage device and the intranet gateway. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0023] As an optional implementation, in the first aspect of the present invention, the method further includes:

[0024] The encrypted data storage device receives user information sent by the access terminal and matches the user information with the accessible user identifier in the pre-stored initialization information;

[0025] If the user information matches the accessible user identifier, the encrypted data storage device sends the first encryption key component K1' to the intranet gateway.

[0026] The encrypted data storage device obtains the first decryption key component K1” sent by the intranet gateway. The first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1” using the gateway private key.

[0027] When the encrypted data storage device determines that the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows the access terminal corresponding to the user information to access the data.

[0028] A second aspect of this invention discloses an encryption implementation method for a data storage device based on quantum random numbers in an intranet, the method being applied to an intranet gateway, the method comprising:

[0029] The intranet gateway sends its gateway address and gateway public key to the encrypted data storage device and establishes a network connection with the encrypted data storage device.

[0030] The intranet gateway receives the device public key Discpub sent by the encrypted data storage device through the established network connection. The device public key Discpub corresponds to the device private key Diskpri, and the device public key Discpub and the device private key Diskpri are generated by the encrypted data storage device.

[0031] After negotiation between the intranet gateway and the encrypted data storage device, a first session link is established, identified by the first link identifier IDsession1 and encrypted by the first session key KS1. The first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using random numbers.

[0032] The intranet gateway generates a device identifier Diskid for the encrypted data storage device. The intranet gateway signs the encrypted data storage device using its private key to obtain an intranet signature Disksign. The intranet gateway sends the device identifier Diskid and the intranet signature Disksign to the encrypted data storage device using the first session link, so that the encrypted data storage device can secretly store registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign.

[0033] As an optional implementation, in a second aspect of the invention, the method further includes:

[0034] In response to the access request of the currently accessing user, the intranet gateway receives the second encrypted link identifier IDsession2', the encryption device identifier Diskid', and the second encrypted session key KS2' sent by the encrypted data storage device;

[0035] The intranet gateway uses the gateway public key to calculate the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to calculate the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid.

[0036] The intranet gateway confirms whether the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correct, and the intranet gateway confirms whether the device identifier Diskid is correct;

[0037] When the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct, a second session link is established between the intranet gateway and the encrypted data storage device. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0038] Furthermore, the second encrypted link identifier IDsession2' is obtained by the encrypted data storage device encrypting the second link identifier IDsession2 using the second session key KS2 and signing it using the device private key Diskpri; the encrypted device identifier Diskid' is obtained by the encrypted data storage device encrypting the device identifier Diskid using the second session key KS2 and signing it using the device private key Diskpri; the second encrypted session key KS2' is obtained by the encrypted data storage device encrypting the second session key KS2 using the gateway public key and signing it using the device private key Diskpri; the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using random numbers.

[0039] As an optional implementation, in a second aspect of the invention, the method further includes:

[0040] When the encrypted data storage device determines that the user information received from the access terminal matches the accessible user identifier in the pre-stored initialization information, the intranet gateway receives the first encryption key component K1' sent by the encrypted data storage device;

[0041] The intranet gateway uses the gateway private key to decrypt the first encryption key component K1' to obtain the first decryption key component K1'". The intranet gateway sends the first decryption key component K1' to the encryption key, so that when the encrypted data storage device determines that the first decryption key component K1' matches the second key component K2 in the pre-stored initialization information, it allows the access terminal corresponding to the user information to access the encrypted data storage device.

[0042] Furthermore, the first encryption key component K1' is obtained by the encryption data storage device encrypting the first key component K1 using the gateway public key, and the first key component K1 and the second key component K2 correspond to each other and are generated by the encryption data storage device.

[0043] A third aspect of this invention discloses a data storage device based on quantum random numbers in an intranet, characterized in that the data storage device includes a storage medium, an encrypted bridge, an authentication device, a quantum random number generator, and an external interface, wherein:

[0044] One end of the external interface is used to communicate with the intranet gateway, and the other end of the external interface is used to communicate with the encrypted bridge.

[0045] The encrypted bridge is used to obtain the gateway address and gateway public key through the external interface and establish a network connection with the internal network gateway.

[0046] The quantum random number generator is used to generate the corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection;

[0047] The quantum random number generator is also used to generate a first link identifier IDsession1 and a first session key KS1 using quantum random numbers;

[0048] The encrypted bridge is also used to negotiate with the intranet gateway to establish a first session link identified as the first link identifier IDsession1 and encrypted by the first session key KS1.

[0049] The encrypted bridge is also used to obtain the device identifier Diskid and the intranet signature Disksign through the first session link, wherein the device identifier Diskid is an identifier generated by the intranet gateway for the data storage device, and the intranet signature Disksign is a signature of the data storage device by the intranet gateway using the gateway private key.

[0050] The authentication device is used to secretly store registration information, which includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign.

[0051] As an optional implementation, in a third aspect of the invention, the quantum random number generator is further used to generate corresponding first key component K1 and second key component K2;

[0052] The encrypted bridge is also used to encrypt the first key component K1 using the gateway public key to obtain the first encrypted key component K1'; the encrypted bridge is also used to obtain the accessible user identifier;

[0053] The authentication device is also used to secretly store initialization information, which includes the second key component K2, the first encryption key component K1', and the accessible user identifier.

[0054] As an optional implementation, in a second aspect of the invention, the quantum random number generator is further configured to generate a second link identifier IDsession2 and a second session key KS2 using random numbers based on the access request of the currently accessing user.

[0055] The encrypted bridge is also used to encrypt the second link identifier IDsession2 using the second session key KS2, and to sign it using the device private key Diskpri to obtain the second encrypted link identifier IDsession2'.

[0056] The encrypted bridge is also used to encrypt the device identifier Diskid using the second session key KS2 and to sign it using the device private key Diskpri to obtain the encrypted device identifier Diskid'.

[0057] The encrypted bridge is also used to encrypt the second session key KS2 using the gateway public key and sign it using the device private key Diskpri to obtain the second encrypted session key KS2'.

[0058] The encrypted bridge is also used to send the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the intranet gateway via an external interface, so that the intranet gateway uses the gateway public key to decrypt the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to decrypt the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid;

[0059] The encrypted bridge is further configured to establish a second session link with the intranet gateway when the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct. The second session link is identified by the second encrypted link identifier IDsession2 and is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0060] As an optional implementation, in a third aspect of the present invention, the authentication device is further configured to match the user information sent by the access terminal with the accessible user identifier in the pre-stored initialization information;

[0061] The encrypted bridge is also used to send the first encryption key component K1' to the intranet gateway when the authentication device determines that the user information matches the accessible user identifier.

[0062] The authentication device is also used to determine whether the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information, wherein the first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1’ using the gateway private key;

[0063] The encrypted bridge is also used to allow access to the access terminal corresponding to the user information when the authentication device determines that the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information.

[0064] The fourth aspect of this invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute the encryption implementation method of a data storage device based on quantum random numbers in an intranet disclosed in the first aspect of this invention.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] This invention enables registration between the encrypted data storage device and the intranet gateway. The encrypted data storage device secretly stores registration information such as the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign. The device identifier Diskid is known only to the intranet gateway and the encrypted data storage device, thereby improving the security of the encrypted data storage device under intranet conditions. In addition, based on the registration relationship established between the encrypted data storage device and the intranet gateway, the encrypted data storage device can be expanded to support multi-person collaborative work, thereby improving the convenience of the encrypted data storage device. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is a schematic diagram of a data storage device structure based on quantum random numbers in an intranet, as disclosed in an embodiment of the present invention.

[0069] Figure 2 This is a schematic diagram of the authentication device storing content in an embodiment of the present invention;

[0070] Figure 3 This is a flowchart illustrating an encryption implementation method for a data storage device based on quantum random numbers in an intranet, as disclosed in an embodiment of the present invention.

[0071] Figure 4 This is a timing diagram of the encrypted access process of the encrypted data storage device in an embodiment of the present invention;

[0072] Figure 5 This is a flowchart illustrating another encryption implementation method for a data storage device based on quantum random numbers in an intranet, as disclosed in an embodiment of the present invention. Detailed Implementation

[0073] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or end that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or ends.

[0075] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0076] Example 1

[0077] like Figure 1 As shown, Figure 1 This invention discloses a quantum random number-based data storage device for an intranet, which can be a hard disk, USB flash drive, or disk. The data storage device includes a storage medium, an encryption bridge, an authentication device, a quantum random number generator, and an external interface. The external interface, the encryption bridge chip, and the storage medium together form a self-encrypting data storage device. The self-encrypting data storage device, together with the authentication device and the quantum random number generator, constitutes the quantum random number-based data storage device for an intranet in this invention, referred to as the encrypted data storage device.

[0078] The intranet gateway is deployed within a personal or corporate environment and cannot be accessed from the outside. The gateway stores the device identifier ID disk, the gateway private key Priint, and the personal account information Accountin.

[0079] The access terminal can be a mobile terminal or a desktop terminal device. Optionally, corresponding access management software can be installed on the access terminal for user interaction and management of the encrypted data storage device. The access terminal establishes communication with the mobile data storage device through the external interface of the encrypted data storage device and controls access to the encrypted data storage device. Optionally, the external interface can be a USB interface. The access management software can establish a network connection with the intranet gateway. Communication between the encrypted data storage device and the intranet gateway is achieved through the access management software.

[0080] A quantum random number generator produces a sequence of random numbers that can be used as an encryption key.

[0081] Storage media include data storage media such as disks, magnetic tapes, Flash, and ROM.

[0082] The authentication device consists of a specific security chip used to store and verify user identity information. It generates public-private key pairs and provides encrypted storage circuitry, allowing data and other content to be stored using built-in keys and algorithms. Access control can employ a key-sharing mechanism, dividing the key into multiple components; authentication succeeds when a key component meets a threshold condition.

[0083] An encrypted bridge consists of encryption circuitry and chips, providing an external interface and internal data storage management. The functions of an encrypted bridge are as follows:

[0084] It enables communication with the access terminal and manages access to the storage medium; the scheduling authentication device verifies the user's identity information and allows the access terminal to access the storage medium based on the verification result.

[0085] Receive and store the key provided by the quantum random number generator, and ensure that the key cannot be accessed by external parties using circuits or software.

[0086] The stored key is used to encrypt or decrypt data flowing through the external interface.

[0087] Once the key is reset or updated, the data stored on the storage medium cannot be decrypted, and the encrypted data storage device needs to be reinitialized for continued use, resulting in the loss of the stored data.

[0088] To address the shortcomings in security and convenience of existing self-encrypting data storage devices, whether using built-in key management or external key management, the encrypted data storage device in this invention embodiment also includes the following design:

[0089] One end of the external interface is used for communication with the internal network gateway, and the other end is used for communication with the encrypted bridge. The external interface acts as a bridge between the encrypted data storage device system and the internal network gateway. It has two endpoints: one connected to the internal network gateway, and the other connected to the encrypted bridge. This interface can be physical (e.g., USB, SATA) or virtual (e.g., via a network). Optionally, the external interface can also communicate with the internal network gateway through an access terminal (e.g., a computer or other device), where the communication connection includes wired and wireless connections.

[0090] An encrypted bridge is used to obtain the gateway address and public key through an external interface and establish a network connection with the internal network gateway. The encrypted bridge is an intermediate device that connects the external interface and the internal network gateway. It is responsible for obtaining the gateway address and public key and establishing a network connection with the internal network gateway.

[0091] The quantum random number generator is used to generate the corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection; the quantum random number generator uses the principles of quantum mechanics to generate real random numbers, which are used to generate the corresponding device public key Discpub and device private key Diskpri. The intranet gateway obtains the device public key Discpub, thereby realizing the decryption of the data encrypted by the device private key Diskpri.

[0092] The quantum random number generator is also used to generate a first link identifier IDsession1 and a first session key KS1 using quantum random numbers; the encrypted bridge is also used to negotiate with the intranet gateway to establish a first session link identified as the first link identifier IDsession1 and encrypted with the first session key KS1; the first session link is established by the encrypted bridge and the intranet gateway through negotiation, and is encrypted using the first link identifier and the first session key, and is used to securely transmit data between the encrypted bridge and the intranet gateway.

[0093] The encrypted bridge is also used to obtain the device identifier Diskid and the internal network signature Disksign through the first session link. The device identifier Diskid is an identifier generated by the internal network gateway for the data storage device, and the internal network signature Disksign is the signature of the data storage device by the internal network gateway using its private key. The device identifier is a unique identifier generated by the internal network gateway for the data storage device, used to identify the data storage device, and the internal network signature is the signature of the data storage device by the internal network gateway using its private key, used to verify the legitimacy and integrity of the data storage device.

[0094] The authentication device is used to secretly store registration information, which includes the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and internal network signature Disksign.

[0095] As can be seen, the quantum random number-based data storage device in the intranet of this invention can realize the registration between the encrypted data storage device and the intranet gateway. The encrypted data storage device secretly stores registration information such as the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign. The device identifier Diskid is known only to the intranet gateway and the encrypted data storage device, thereby improving the security of the encrypted data storage device under intranet conditions. In addition, based on the registration relationship established between the encrypted data storage device and the intranet gateway, the encrypted data storage device can be expanded to support multi-person collaborative work, thereby improving the convenience of the encrypted data storage device.

[0096] In an optional embodiment, the quantum random number generator is also used to generate corresponding first key component K1 and second key component K2;

[0097] The encrypted bridge is also used to encrypt the first key component K1 using the gateway's public key to obtain the first encrypted key component K1'; the encrypted bridge is also used to obtain the accessible user identifier;

[0098] The authentication device also secretly stores initialization information, which includes the second key component K2, the first encryption key component K1', and the accessible user identifier. Thus, the information stored by the authentication device is as follows: Figure 2 As shown.

[0099] In this optional embodiment, since it is under intranet conditions, only the encrypted data storage device needs to store the accessible user identifier; no other verification conditions are required. The optional user identifier can be biometric information such as IP address, user account, or fingerprint. The first key component K1 and the second key component K2 are corresponding and can be generated using a key sharing algorithm or by using random numbers to generate the first key component K1 and the second key component K2 of equal length.

[0100] As can be seen, this optional embodiment can initialize users in the encrypted data storage device. In team collaboration scenarios, it can identify all team members' user identifiers as accessible user identifiers, thereby improving the ease of use of the encrypted data storage device and making it suitable for team collaboration applications. Furthermore, by employing a key-sharing mechanism, the key is divided into multiple components, each stored separately by the encrypted data storage device and the intranet gateway. Authentication is only successful when a key component meets a threshold condition, further enhancing the security of the encrypted data storage device while ensuring its ease of use.

[0101] In yet another optional embodiment, the quantum random number generator is further configured to generate a second link identifier IDsession2 and a second session key KS2 using random numbers based on the access request of the currently accessing user.

[0102] The encrypted bridge is also used to encrypt the second link identifier IDsession2 using the second session key KS2 and sign it using the device private key Diskpri to obtain the second encrypted link identifier IDsession2';

[0103] The encrypted bridge is also used to encrypt the device identifier Diskid using the second session key KS2 and to sign it using the device private key Diskpri to obtain the encrypted device identifier Diskid';

[0104] The encrypted bridge is also used to encrypt the second session key KS2 using the gateway's public key and sign it using the device's private key Diskpri to obtain the second encrypted session key KS2'.

[0105] At this point, only the intranet gateway can decrypt the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2'. The second session key is encrypted with the device's private key, and the second link identifier IDsession2 and the device identifier Diskid are jointly encrypted with the second session key KS2 and the device's private key Diskpri, resulting in higher security.

[0106] The encrypted bridge is also used to send the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the internal network gateway via an external interface, so that the internal network gateway can use its public key to calculate the second encrypted session key KS2' to obtain the second session key KS2; and the internal network gateway can use the second session key KS2 to calculate the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid;

[0107] The encrypted bridge is also used to establish a second session link with the intranet gateway when the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0108] As can be seen, this optional embodiment can dynamically generate session keys and link identifiers based on user access requests, providing an independent security environment for each session and enabling dynamic session management, greatly improving the convenience of encrypted data storage devices during team coordination. Furthermore, during the establishment of the second session link, the second session key is encrypted with the device's private key, and the second link identifier IDsession2 and the encrypted device identifier Diskid are jointly encrypted with the second session key KS2 and the device's private key Diskpri. Therefore, only the intranet gateway can decrypt the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2', further enhancing the security of the encrypted data storage device.

[0109] In another optional embodiment, the authentication device is further configured to match the user information sent by the access terminal with the accessible user identifier in the pre-stored initialization information;

[0110] The encrypted bridge is also used to send the first encryption key component K1' to the intranet gateway when the authentication device determines that the user information matches the accessible user identifier. This step is to verify whether the user currently trying to access the encrypted data storage device is an authorized team member. Since in the intranet environment, it is only necessary to determine whether the user is a team member before proceeding to the next step, no further verification steps are required.

[0111] The authentication device is also used to determine whether the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information. The first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1’ using the gateway private key. This step is a key link in key verification, ensuring that only users with the correct key component can access the encrypted data storage device.

[0112] The encrypted bridge is also used to indicate that the access of the access terminal is legitimate when the authentication device determines that the first decryption key component K1 matches the second key component K2 in the pre-stored initialization information, allowing the access terminal corresponding to the user information to access the terminal.

[0113] As can be seen, in this optional embodiment, precise authentication and access control can be achieved by matching user information and accessible user identifiers, as well as verifying key components.

[0114] Example 2

[0115] like Figure 3 As shown, Figure 3 This is a flowchart of an encryption implementation method for a data storage device based on quantum random numbers in an intranet, as proposed in Embodiment 2 of the present invention. This method is applicable to any encrypted data storage device, such as the encrypted data storage device described in Embodiment 1. The method can be integrated into the encrypted data storage device, access terminal, intranet gateway, or server, or it can be integrated separately into certain storage media. When these storage media are executed by a processor, the method is implemented. The method may include:

[0116] Step 201: The encrypted data storage device obtains the gateway address and gateway public key, and establishes a network connection with the intranet gateway; optionally, the network connection includes wired connection and wireless connection.

[0117] Step 202: The encrypted data storage device generates a corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection; the intranet gateway obtains the device public key Discpub, thereby realizing the decryption of the data encrypted by the device private key Diskpri.

[0118] Step 203: The encrypted data storage device generates a first link identifier (IDsession1) and a first session key (KS1) using a random number, and negotiates with the intranet gateway to establish a first session link identified by the first link identifier (IDsession1) and encrypted with the first session key (KS1). The first session link is established through negotiation between the encrypted data storage device and the intranet gateway, and is encrypted using the first link identifier and the first session key, for secure data transmission between the encrypted data storage device and the intranet gateway.

[0119] Step 204: The encrypted data storage device obtains the device identifier Diskid and the internal network signature Disksign through the first session link. The device identifier Diskid is an identifier generated by the internal network gateway for the encrypted data storage device, and the internal network signature Disksign is the signature of the encrypted data storage device by the internal network gateway using its private key. The device identifier is a unique identifier generated by the internal network gateway for the data storage device, used to identify the data storage device, and the internal network signature is the signature of the data storage device by the internal network gateway using its private key, used to verify the legality and integrity of the data storage device.

[0120] Step 205: The encrypted data storage device secretly stores the registration information so that it can encrypt transmitted data under intranet conditions. The registration information includes the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign.

[0121] As can be seen, the encryption implementation method of the data storage device based on quantum random numbers in the intranet in this embodiment of the invention can realize the registration between the encrypted data storage device and the intranet gateway. The encrypted data storage device secretly stores registration information such as the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign. The device identifier Diskid is known only to the intranet gateway and the encrypted data storage device, thereby improving the security of the encrypted data storage device under intranet conditions. In addition, based on the registration relationship established between the encrypted data storage device and the intranet gateway, the encrypted data storage device can be expanded to support multi-person collaborative work, thereby improving the convenience of the encrypted data storage device.

[0122] In an optional embodiment, such as Figure 4 As shown in the timing diagram, the method may further include:

[0123] The encrypted data storage device generates corresponding first key component K1 and second key component K2, and encrypts the first key component K1 using the gateway public key to obtain the first encrypted key component K1';

[0124] The encrypted data storage device obtains an accessible user identifier;

[0125] The encrypted data storage device secretly stores initialization information to enable the encrypted data storage device to manage access users under intranet conditions. The initialization information includes a second key component K2, a first encryption key component K1', and an accessible user identifier.

[0126] As can be seen, this optional embodiment can initialize users in the encrypted data storage device. In team collaboration scenarios, it can identify all team members' user identifiers as accessible user identifiers, thereby improving the ease of use of the encrypted data storage device and making it suitable for team collaboration applications. Furthermore, by employing a key-sharing mechanism, the key is divided into multiple components, each stored separately by the encrypted data storage device and the intranet gateway. Authentication is only successful when a key component meets a threshold condition, further enhancing the security of the encrypted data storage device while ensuring its ease of use.

[0127] In yet another alternative embodiment, such as Figure 4 As shown in the timing diagram, the method may further include:

[0128] In response to the access request from the current user, the encrypted data storage device generates a second link identifier IDsession2 and a second session key KS2 using a random number;

[0129] The encrypted data storage device uses the second session key KS2 to encrypt the second link identifier IDsession2, and signs it with the device private key Diskpri to obtain the second encrypted link identifier IDsession2'.

[0130] The encrypted data storage device uses the second session key KS2 to encrypt the device identifier Diskid and signs it with the device private key Diskpri to obtain the encrypted device identifier Diskid'.

[0131] The encrypted data storage device uses the gateway public key to encrypt the second session key KS2 and signs it with the device private key Diskpri to obtain the second encrypted session key KS2'.

[0132] The encrypted data storage device sends the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the intranet gateway, so that the intranet gateway uses the gateway public key to decrypt the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to decrypt the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid.

[0133] When the intranet gateway confirms that the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encryption device identifier Diskid', and the second encrypted session key KS2' is correct, and the device identifier Diskid is correct, a second session link is established between the encrypted data storage device and the intranet gateway. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0134] As can be seen, this optional embodiment can dynamically generate session keys and link identifiers based on user access requests, providing an independent security environment for each session and enabling dynamic session management, greatly improving the convenience of encrypted data storage devices during team coordination. Furthermore, during the establishment of the second session link, the second session key is encrypted with the device's private key, and the second link identifier IDsession2 and the encrypted device identifier Diskid are jointly encrypted with the second session key KS2 and the device's private key Diskpri. Therefore, only the intranet gateway can decrypt the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2', further enhancing the security of the encrypted data storage device.

[0135] In yet another alternative embodiment, such as Figure 4 As shown in the timing diagram, the method may further include:

[0136] The encrypted data storage device receives user information sent by the access terminal and matches the user information with the accessible user identifier in the pre-stored initialization information;

[0137] If the user information matches the accessible user identifier, the encrypted data storage device will send the first encryption key component K1' to the intranet gateway.

[0138] The encrypted data storage device obtains the first decryption key component K1” sent by the intranet gateway. The first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1” using the gateway private key.

[0139] When the encrypted data storage device determines that the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows the access terminal corresponding to the user information to access the device.

[0140] As can be seen, in this optional embodiment, precise authentication and access control can be achieved by matching user information and accessible user identifiers, as well as verifying key components.

[0141] Example 3

[0142] like Figure 5 As shown, Figure 5 This is a flowchart of another encryption implementation method for a data storage device based on quantum random numbers in an intranet, as proposed in Embodiment 3 of the present invention. This method is applied to an intranet gateway. The method can be integrated into an encrypted data storage device, access terminal, intranet gateway, or server, or it can be integrated separately into certain storage media. When these storage media are executed by a processor, the method is implemented. The method may include:

[0143] Step 301: The intranet gateway sends its gateway address and gateway public key to the encrypted data storage device and establishes a network connection with the encrypted data storage device.

[0144] Step 302: The intranet gateway receives the device public key Discpub sent by the encrypted data storage device through the established network connection. The device public key Discpub corresponds to the device private key Diskpri, and the device public key Discpub and device private key Diskpri are generated by the encrypted data storage device.

[0145] Step 303: After negotiation between the intranet gateway and the encrypted data storage device, a first session link is established with the identifier IDsession1 and encrypted with the first session key KS1. The first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using random numbers.

[0146] Step 304: The intranet gateway generates a device identifier Diskid for the encrypted data storage device. The intranet gateway uses its private key to sign the encrypted data storage device, obtaining an intranet signature Disksign. The intranet gateway uses the first session link to send the device identifier Diskid and the intranet signature Disksign to the encrypted data storage device, so that the encrypted data storage device can secretly store the registration information, which includes the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign.

[0147] As can be seen, the encryption implementation method of the data storage device based on quantum random numbers in the intranet in this embodiment of the invention can realize the registration between the encrypted data storage device and the intranet gateway. The encrypted data storage device secretly stores registration information such as the gateway address, gateway public key, device private key Diskpri, device identifier Diskid, and intranet signature Disksign. The device identifier Diskid is known only to the intranet gateway and the encrypted data storage device, thereby improving the security of the encrypted data storage device under intranet conditions. In addition, based on the registration relationship established between the encrypted data storage device and the intranet gateway, the encrypted data storage device can be expanded to support multi-person collaborative work, thereby improving the convenience of the encrypted data storage device.

[0148] In an optional embodiment, the method may further include:

[0149] In response to the access request from the current user, the intranet gateway receives the second encrypted link identifier IDsession2', the encryption device identifier Diskid', and the second encrypted session key KS2' sent by the encrypted data storage device;

[0150] The intranet gateway uses the gateway public key to calculate the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to calculate the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid.

[0151] The intranet gateway verifies whether the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correct, and verifies whether the device identifier Diskid is correct.

[0152] When the intranet gateway confirms that the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encryption device identifier Diskid', and the second encrypted session key KS2' is correct, and the device identifier Diskid is correct, a second session link is established between the intranet gateway and the encrypted data storage device. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

[0153] Furthermore, the second encrypted link identifier IDsession2' is obtained by encrypting the second link identifier IDsession2 using the second session key KS2 and signing it with the device private key Diskpri; the encrypted device identifier Diskid' is obtained by encrypting the device identifier Diskid using the second session key KS2 and signing it with the device private key Diskpri; the second encrypted session key KS2' is obtained by encrypting the second session key KS2 using the gateway public key and signing it with the device private key Diskpri; the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using random numbers.

[0154] As can be seen, this optional embodiment can dynamically generate session keys and link identifiers based on user access requests, providing an independent security environment for each session and enabling dynamic session management, greatly improving the convenience of encrypted data storage devices during team coordination. Furthermore, during the establishment of the second session link, the second session key is encrypted with the device's private key, and the second link identifier IDsession2 and the encrypted device identifier Diskid are jointly encrypted with the second session key KS2 and the device's private key Diskpri. Therefore, only the intranet gateway can decrypt the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2', further enhancing the security of the encrypted data storage device.

[0155] In yet another optional embodiment, the method may further include:

[0156] When the encrypted data storage device determines that the user information received from the access terminal matches the accessible user identifier in the pre-stored initialization information, the intranet gateway receives the first encryption key component K1' sent by the encrypted data storage device.

[0157] The intranet gateway uses its private key to decrypt the first encryption key component K1' to obtain the first decryption key component K1". The intranet gateway sends the first decryption key component K1" to the encryption key so that when the encrypted data storage device determines that the first decryption key component K1" matches the second key component K2 in the pre-stored initialization information, it allows the access terminal corresponding to the user information to access the encrypted data storage device.

[0158] Furthermore, the first encryption key component K1' is obtained by encrypting the first key component K1 using the gateway public key by the encryption data storage device, and the first key component K1 and the second key component K2 correspond to each other and are generated by the encryption data storage device.

[0159] As can be seen, in this optional embodiment, precise authentication and access control can be achieved by matching user information and accessible user identifiers, as well as verifying key components.

[0160] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0161] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0162] Finally, it should be noted that the data storage device and encryption implementation method based on quantum random numbers in an intranet disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for encrypting a data storage device based on quantum random numbers in an intranet, characterized in that, The method is applied to an encrypted data storage device, and the method includes: The encrypted data storage device obtains the gateway address and gateway public key, and establishes a network connection with the intranet gateway. The encrypted data storage device generates a corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection. The encrypted data storage device uses a random number to generate a first link identifier IDsession1 and a first session key KS1, and negotiates with the intranet gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1. The encrypted data storage device obtains the device identifier Diskid and the intranet signature Disksign through the first session link. The device identifier Diskid is an identifier generated by the intranet gateway for the encrypted data storage device, and the intranet signature Disksign is a signature of the encrypted data storage device by the intranet gateway using the gateway private key. The encrypted data storage device secretly stores registration information to enable the encrypted data storage device to encrypt transmitted data under intranet conditions. The registration information includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign. The encrypted data storage device generates a corresponding first key component K1 and a second key component K2, and uses the gateway public key to encrypt the first key component K1 to obtain the first encrypted key component K1'. The encrypted data storage device obtains the accessible user identifier; The encrypted data storage device secretly stores initialization information so that it can manage accessing users under intranet conditions. The initialization information includes the second key component K2, the first encrypted key component K1', and the accessible user identifier. The encrypted data storage device receives user information sent by the access terminal and matches the user information with the accessible user identifier in the pre-stored initialization information; If the user information matches the accessible user identifier, the encrypted data storage device sends the first encryption key component K1' to the intranet gateway. The encrypted data storage device obtains the first decryption key component K1” sent by the intranet gateway. The first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1” using the gateway private key. When the encrypted data storage device determines that the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows the access terminal corresponding to the user information to access the data.

2. The encryption implementation method for a data storage device based on quantum random numbers in an intranet according to claim 1, characterized in that, The method further includes: In response to the access request of the currently accessing user, the encrypted data storage device generates a second link identifier IDsession2 and a second session key KS2 using a random number; The encrypted data storage device uses the second session key KS2 to encrypt the second link identifier IDsession2, and uses the device private key Diskpri to sign it, thus obtaining the second encrypted link identifier IDsession2'. The encrypted data storage device uses the second session key KS2 to encrypt the device identifier Diskid, and uses the device private key Diskpri to sign it, thus obtaining the encrypted device identifier Diskid'. The encrypted data storage device uses the gateway public key to encrypt the second session key KS2, and uses the device private key Diskpri to sign it, to obtain the second encrypted session key KS2'. The encrypted data storage device sends the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the intranet gateway, so that the intranet gateway uses the gateway private key to decrypt the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to decrypt the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid. When the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct, a second session link is established between the encrypted data storage device and the intranet gateway. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

3. A method for encrypting a data storage device based on quantum random numbers in an intranet, characterized in that, The method is applied to an intranet gateway, and the method includes: The intranet gateway sends its gateway address and gateway public key to the encrypted data storage device and establishes a network connection with the encrypted data storage device. The intranet gateway receives the device public key Discpub sent by the encrypted data storage device through the established network connection. The device public key Discpub corresponds to the device private key Diskpri, and the device public key Discpub and the device private key Diskpri are generated by the encrypted data storage device. After negotiation between the intranet gateway and the encrypted data storage device, a first session link is established, identified by the first link identifier IDsession1 and encrypted by the first session key KS1. The first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using random numbers. The intranet gateway generates a device identifier Diskid for the encrypted data storage device. The intranet gateway signs the encrypted data storage device using its private key to obtain an intranet signature Disksign. The intranet gateway sends the device identifier Diskid and the intranet signature Disksign to the encrypted data storage device using the first session link, so that the encrypted data storage device can secretly store registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign. When the encrypted data storage device determines that the user information received from the access terminal matches the accessible user identifier in the pre-stored initialization information, the intranet gateway receives the first encryption key component K1' sent by the encrypted data storage device; The intranet gateway uses the gateway private key to decrypt the first encryption key component K1' to obtain the first decryption key component K1'". The intranet gateway sends the first decryption key component K1' to the encryption key, so that when the encrypted data storage device determines that the first decryption key component K1' matches the second key component K2 in the pre-stored initialization information, it allows the access terminal corresponding to the user information to access the encrypted data storage device. Furthermore, the first encryption key component K1' is obtained by the encryption data storage device encrypting the first key component K1 using the gateway public key, and the first key component K1 and the second key component K2 correspond to each other and are generated by the encryption data storage device.

4. The encryption implementation method for a data storage device based on quantum random numbers in an intranet according to claim 3, characterized in that, The method further includes: In response to the access request of the currently accessing user, the intranet gateway receives the second encrypted link identifier IDsession2', the encryption device identifier Diskid', and the second encrypted session key KS2' sent by the encrypted data storage device; The intranet gateway uses the gateway private key to calculate the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to calculate the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid. The intranet gateway confirms whether the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correct, and the intranet gateway confirms whether the device identifier Diskid is correct; When the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct, a second session link is established between the intranet gateway and the encrypted data storage device. The identifier of the second session link is the second encrypted link identifier IDsession2, and the second session link is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions. Furthermore, the second encrypted link identifier IDsession2' is obtained by the encrypted data storage device encrypting the second link identifier IDsession2 using the second session key KS2 and signing it using the device private key Diskpri; the encrypted device identifier Diskid' is obtained by the encrypted data storage device encrypting the device identifier Diskid using the second session key KS2 and signing it using the device private key Diskpri; the second encrypted session key KS2' is obtained by the encrypted data storage device encrypting the second session key KS2 using the gateway public key and signing it using the device private key Diskpri; the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using random numbers.

5. A data storage device based on quantum random numbers in an intranet, characterized in that, The data storage device includes a storage medium, an encrypted bridge, an authentication device, a quantum random number generator, and an external interface, wherein: One end of the external interface is used to communicate with the intranet gateway, and the other end of the external interface is used to communicate with the encrypted bridge. The encrypted bridge is used to obtain the gateway address and gateway public key through the external interface and establish a network connection with the internal network gateway. The quantum random number generator is used to generate the corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the intranet gateway through the established network connection; The quantum random number generator is also used to generate a first link identifier IDsession1 and a first session key KS1 using quantum random numbers; The encrypted bridge is also used to negotiate with the intranet gateway to establish a first session link identified as the first link identifier IDsession1 and encrypted by the first session key KS1. The encrypted bridge is also used to obtain the device identifier Diskid and the intranet signature Disksign through the first session link, wherein the device identifier Diskid is an identifier generated by the intranet gateway for the data storage device, and the intranet signature Disksign is a signature of the data storage device by the intranet gateway using the gateway private key. The authentication device is used to secretly store registration information, which includes the gateway address, the gateway public key, the device private key Diskpri, the device identifier Diskid, and the intranet signature Disksign; The quantum random number generator is also used to generate corresponding first key component K1 and second key component K2; The encrypted bridge is also used to encrypt the first key component K1 using the gateway public key to obtain the first encrypted key component K1'; the encrypted bridge is also used to obtain the accessible user identifier; The authentication device is also used to secretly store initialization information, which includes the second key component K2, the first encryption key component K1', and the accessible user identifier. The authentication device is also used to match the user information sent by the access terminal with the accessible user identifier in the pre-stored initialization information; The encrypted bridge is also used to send the first encryption key component K1' to the intranet gateway when the authentication device determines that the user information matches the accessible user identifier. The authentication device is also used to determine whether the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information, wherein the first decryption key component K1” is obtained by the intranet gateway after decrypting the first encryption key component K1’ using the gateway private key; The encrypted bridge is also used to allow access to the access terminal corresponding to the user information when the authentication device determines that the first decryption key component K1” matches the second key component K2 in the pre-stored initialization information.

6. The data storage device based on quantum random numbers in an intranet according to claim 5, characterized in that, The quantum random number generator is also used to generate a second link identifier IDsession2 and a second session key KS2 based on the access request of the current accessing user. The encrypted bridge is also used to encrypt the second link identifier IDsession2 using the second session key KS2, and to sign it using the device private key Diskpri to obtain the second encrypted link identifier IDsession2'. The encrypted bridge is also used to encrypt the device identifier Diskid using the second session key KS2 and to sign it using the device private key Diskpri to obtain the encrypted device identifier Diskid'. The encrypted bridge is also used to encrypt the second session key KS2 using the gateway public key and sign it using the device private key Diskpri to obtain the second encrypted session key KS2'. The encrypted bridge is also used to send the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' to the intranet gateway via an external interface, so that the intranet gateway uses the gateway private key to decrypt the second encrypted session key KS2' to obtain the second session key KS2; and the intranet gateway uses the second session key KS2 to decrypt the second encrypted link identifier IDsession2' and the encrypted device identifier Diskid' to obtain the second link identifier IDsession2 and the device identifier Diskid; The encrypted bridge is further configured to establish a second session link with the intranet gateway when the intranet gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted device identifier Diskid', and the second encrypted session key KS2' is correctly signed and the device identifier Diskid is correct. The second session link is identified by the second encrypted link identifier IDsession2 and is encrypted by the second session key KS2. The second session link is used to enable access to the encrypted data storage device under intranet conditions.

Images