Data storage device based on quantum random number in external network and encryption implementation method thereof

Abstract

The application discloses a data storage device based on quantum random numbers in an external network and an encryption implementation method thereof, and relates to the technical field of encrypted storage. The encryption method comprises the following steps: a gateway address and a gateway public key are acquired by an encrypted data storage device, and a network connection is established with a gateway of an external network; corresponding device public keys and device private keys are generated, and the device public keys are sent to the gateway of the external network through the established network connection; a first link identifier and a first session key are generated by using random numbers, and a first session link with the identifier of the first link identifier and encrypted by the first session key is established by negotiation with the gateway of the external network; an external network signature is acquired through the first session link, and registration information is secretly saved, so that the encrypted data storage device can encrypt transmission data under the condition of the external network. The application improves the security of the data storage device under the condition of the external network, enables the data storage device to expand multi-person collaborative office, and improves the convenience of the data storage device.

Description

Technical Field

[0001] The present invention relates to the field of encrypted storage technology, and in particular to a data storage device based on quantum random numbers in an external network and an encryption implementation method thereof. Background Art

[0002] A self-encrypting drive (SED) is a storage device with integrated hardware encryption capabilities that automatically encrypts and decrypts stored data without relying on the host system's software or operating system. The encryption and decryption process is transparent, requiring no manual user intervention.

[0003] The mainstream encryption standard for self-encrypting data storage devices in the prior art is AES (Advanced Encryption Standard), which typically uses a 256-bit key length. The encryption and decryption processes of this technology are transparent, and the data storage device controller automatically encrypts and decrypts data. All data written to the data storage device is automatically encrypted, and data read is automatically decrypted. Key storage locations can be broadly categorized into two types: internal key management within the data storage device and external key management. The internal key method typically uses a hardware module (such as a TPM or a standalone encryption chip) to store and manage encryption keys. Keys are typically stored within the data storage device controller and never leave the data storage device, allowing only authenticated users to unlock them. The external key method supports integration with an external key management system (Key Management Interoperability Protocol, KMIP). An external key manager (such as an enterprise key management server) is responsible for managing and storing encryption keys.

[0004] With the proliferation of business and technology scenarios such as mobile office, enterprise design outsourcing, enterprise development collaboration, and network data storage access, the risks and concerns of businesses and individuals regarding the leakage of organizational data assets and personal data are gradually increasing. Practice has shown that in mobile and collaborative office scenarios, existing data storage devices, whether using built-in key management or external key management methods, lack security and convenience. Summary of the Invention

[0005] The present invention provides a data storage device based on quantum random numbers in an external network and an encryption implementation method thereof, which is used to improve the security and convenience of the encryption process of the data storage device in the prior art in mobile office or collaborative office scenarios.

[0006] In order to solve the above technical problems, the first aspect of the present invention discloses a method for implementing encryption of a data storage device based on quantum random numbers in an external network, the method being applied to an encrypted data storage device, the method comprising:

[0007] The encrypted data storage device acquires the gateway address and the gateway public key, and establishes a network connection with the external network gateway;

[0008] The encrypted data storage device generates a corresponding device public key Discpub and device private key Diskpri, and sends the device public key Discpub to the external network gateway through the established network connection;

[0009] The encrypted data storage device generates a first link identifier IDsession1 and a first session key KS1 by using a random number, and negotiates with the external network gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1;

[0010] The encrypted data storage device acquires an external network signature Disksign through the first session link, wherein the external network signature Disksign is a signature of the encrypted data storage device by the external network gateway using a gateway private key;

[0011] The encrypted data storage device secretly saves registration information, so that the encrypted data storage device can realize encryption of transmission data under the condition of the external network, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign.

[0012] As an optional implementation, in the first aspect of the present application, the method further comprises:

[0013] The encrypted data storage device generates a corresponding first key component K1 and second key component K2, and encrypts the first key component K1 using a gateway public key to obtain a first encrypted key component K1';

[0014] The encrypted data storage device acquires accessible user identifiers and access password information corresponding to each of the accessible user identifiers;

[0015] The encrypted data storage device secretly saves initialization information, so that the encrypted data storage device can realize management of access users under the condition of the external network, wherein the initialization information includes the second key component K2, the first encrypted key component K1', the accessible user identifiers and the access password information corresponding to each of the accessible user identifiers.

[0016] As an optional implementation, in the first aspect of the present application, the method further comprises:

[0017] In response to the access application of the current access user, the encrypted data storage device generates a second link identification IDsession2 and a second session key KS2 using a random number;

[0018] The encrypted data storage device encrypts the second link identification IDsession2 using the second session key KS2 and signs using the device private key Diskpri to obtain a second encrypted link identification IDsession2';

[0019] The encrypted data storage device encrypts the access application using the second session key KS2 and signs using the device private key Diskpri to obtain an encrypted access application;

[0020] The encrypted data storage device encrypts the second session key KS2 using the gateway public key and signs using the device private key Diskpri to obtain a second encrypted session key KS2';

[0021] The encrypted data storage device sends the second encrypted link identification IDsession2', the encrypted access application and the second encrypted session key KS2' to the external network gateway, so that the external network gateway decrypts the second encrypted session key KS2' using the gateway public key to obtain the second session key KS2, and so that the external network gateway decrypts the second encrypted link identification IDsession2' and the encrypted access application using the second session key KS2 to obtain the second link identification IDsession2 and the access application;

[0022] When the external network gateway confirms that the device private key Diskpri signature corresponding to the second encrypted link identification IDsession2', the encrypted access application and the second encrypted session key KS2' is correct and the access application is correct, a second session link between the encrypted data storage device and the external network gateway is established, the identification of the second session link is the second encrypted link identification IDsession2 and the second session link is encrypted by the second session key KS2; wherein the second session link is used to realize the access to the encrypted data storage device under the condition of the external network.

[0023] As an optional implementation, in the first aspect of the present application, the method further comprises:

[0024] The encrypted data storage device receives the user identification and password information sent by the access terminal, and matches the user identification with the accessible user identification in the pre-stored initialization information, and if the user identification successfully matches the accessible user identification, determines whether the password information matches the accessible password information corresponding to the accessible user identification;

[0025] If the password information successfully matches the accessible password information corresponding to the accessible user identifier, the encrypted data storage device sends the first encryption key component K1' to the external network gateway;

[0026] The encrypted data storage device obtains the first decryption key component K1″ sent by the external network gateway. The first decryption key component K1″ is obtained by the external network gateway decrypting the first encryption key component K1′ using the gateway private key;

[0027] When the encrypted data storage device determines that the first decryption key component K1″ matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows access by the access terminal corresponding to the user identifier.

[0028] A second aspect of the present invention discloses another method for implementing encryption of a data storage device based on quantum random numbers in an external network, the method being applied to an external network gateway, the method comprising:

[0029] The external network gateway sends the gateway address and the gateway public key to the encrypted data storage device and establishes a network connection with the encrypted data storage device;

[0030] The external network gateway receives a device public key Discpub sent by the encrypted data storage device through the established network connection, wherein the device public key Discpub corresponds to a device private key Diskpri, and the device public key Discpub and the device private key Diskpri are generated by the encrypted data storage device;

[0031] The external network gateway negotiates with the encrypted data storage device to establish a first session link identified by a first link identifier IDsession1 and encrypted by a first session key KS1, wherein the first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using random numbers;

[0032] The external network gateway uses the gateway private key to sign the encrypted data storage device to obtain the external network signature Disksign; the external network gateway uses the first session link to send the external network signature Disksign to the encrypted data storage device; so that the encrypted data storage device secretly stores registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign.

[0033] As an optional embodiment, in the second aspect of the present invention, the method further includes:

[0034] In response to the access request of the current access user, the external network gateway receives the second encrypted link identifier IDsession2', the encrypted access request and the second encrypted session key KS2' sent by the encrypted data storage device;

[0035] The external network gateway uses the gateway public key to resolve the second encrypted session key KS2' to obtain the second session key KS2; and the external network gateway uses the second session key KS2 to resolve the second encrypted link identifier IDsession2' and the encrypted access request to obtain the second link identifier IDsession2 and the access request;

[0036] The external network gateway confirms whether the second encrypted link identifier IDsession2', the encrypted access request and the signature of the device private key Diskpri corresponding to the second encrypted session key KS2' are correct, and the external network gateway confirms whether the access request is correct;

[0037] When the external network gateway confirms that the second encrypted link identifier IDsession2', the encrypted access request, and the signature of the device private key Diskpri corresponding to the second encrypted session key KS2' are correct and the access request is correct, a second session link is established between the external network gateway and the encrypted data storage device, where the identifier of the second session link is the second encrypted link identifier IDsession2 and the second session link is encrypted by the second session key KS2; wherein the second session link is used to implement access to the encrypted data storage device under external network conditions;

[0038] And the second encrypted link identifier IDsession2' is obtained by the encrypted data storage device encrypting the second link identifier IDsession2 using the second session key KS2 and signing using the device private key Diskpri; the encrypted access application is obtained by the encrypted data storage device encrypting the access application using the second session key KS2 and signing using the device private key Diskpri; the second encrypted session key KS2' is obtained by the encrypted data storage device encrypting the second session key KS2 using the gateway public key and signing using the device private key Diskpri; and the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using random numbers.

[0039] As an optional implementation, in the second aspect of the present application, the method further comprises:

[0040] When the encrypted data storage device judges that the user identifier received from the access terminal matches the pre-stored accessible user identifier successfully, and the password information received from the access terminal matches the pre-stored accessible password information corresponding to the accessible user identifier successfully, the external network gateway receives the first encrypted key component K1' sent by the encrypted data storage device;

[0041] The external network gateway decrypts the first encrypted key component K1' using the gateway private key to obtain a first decrypted key component K1'', and sends the first decrypted key component K1'' to the encrypted data storage device, so that the encrypted data storage device allows the access terminal corresponding to the user identifier to access the encrypted data storage device when judging that the first decrypted key component K1'' matches the second key component K2 in the pre-stored initialization information.

[0042] And the first encrypted key component K1' is obtained by the encrypted data storage device encrypting a first key component K1 using a gateway public key, and the first key component K1 and the second key component K2 correspond to each other and are generated by the encrypted data storage device.

[0043] The third aspect of the present application discloses a data storage device based on quantum random numbers in an external network, characterized in that the data storage device comprises a storage medium, an encrypted bridge, an authentication device, a quantum random number generator and an external interface, wherein:

[0044] One end of the external interface is used for communication connection with an external network gateway, and the other end of the external interface is in communication connection with the encrypted bridge.

[0045] The encryption bridge is configured to acquire a gateway address and a gateway public key through the external interface, and establish a network connection with the external network gateway;

[0046] The quantum random number generator is configured to generate a corresponding device public key Discpub and a device private key Diskpri, and send the device public key Discpub to the external network gateway through the established network connection;

[0047] The quantum random number generator is configured to generate a first link identification IDsession1 and a first session key KS1 by using quantum random numbers;

[0048] The encryption bridge is further configured to negotiate with the external network gateway to establish a first session link identified by the first link identification IDsession1 and encrypted by the first session key KS1.

[0049] The encryption bridge is further configured to acquire an external network signature Disksign through the first session link, wherein the external network signature Disksign is a signature of the data storage device by the external network gateway using a gateway private key.

[0050] The authentication device is configured to secretly store registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign.

[0051] As an optional implementation, in the third aspect of the present application, the quantum random number generator is further configured to generate a corresponding first key component K1 and a second key component K2.

[0052] The encryption bridge is further configured to encrypt the first key component K1 using a gateway public key to obtain a first encrypted key component K1', and acquire accessible user identifications and access password information corresponding to each of the accessible user identifications.

[0053] The authentication device is further configured to secretly store initialization information, wherein the initialization information includes the second key component K2, the first encrypted key component K1', the accessible user identifications and the access password information corresponding to each of the accessible user identifications.

[0054] As an optional implementation, in the third aspect of the present application, the quantum random number generator is further configured to generate a second link identification IDsession2 and a second session key KS2 according to an access application of a current access user by using random numbers.

[0055] The encryption bridge is further configured to encrypt the second link identifier IDsession2 using the second session key KS2 and sign using the device private key Diskpri to obtain a second encrypted link identifier IDsession2';

[0056] The encryption bridge is further configured to encrypt the access application using the second session key KS2 and sign using the device private key Diskpri to obtain an encrypted access application;

[0057] The encryption bridge is further configured to encrypt the second session key KS2 using the gateway public key and sign using the device private key Diskpri to obtain a second encrypted session key KS2';

[0058] The encryption bridge is further configured to send the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' to the external network gateway via the external interface, so that the external network gateway decrypts the second encrypted session key KS2' using the gateway public key to obtain the second session key KS2, and decrypts the second encrypted link identifier IDsession2' and the encrypted access application using the second session key KS2 to obtain the second link identifier IDsession2 and the access application;

[0059] The encryption bridge is further configured to establish a second session link with the external network gateway when the external network gateway confirms that the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' is correctly signed and the access application is correct, the second session link has an identifier of the second encrypted link identifier IDsession2 and is encrypted by the second session key KS2; wherein the second session link is used to realize access to the data storage device in an external network condition.

[0060] As an optional implementation, in the third aspect of the present application, the authentication device is further configured to match the user identifier received from the access terminal with the accessible user identifier in the pre-stored initialization information, and match the password information received from the access terminal with the accessible password information corresponding to the accessible user identifier in the pre-stored initialization information;

[0061] The encryption bridge is further configured to send the first encrypted key component K1' to the external network gateway when the authentication device judges that the user identifier matches the pre-stored accessible user identifier successfully and the password information matches the accessible password information corresponding to the pre-stored accessible user identifier successfully;

[0062] The authentication device is further configured to determine whether the first decryption key component K1" and the second key component K2 in the pre-stored initialization information match, wherein the first decryption key component K1" is obtained by decrypting the first encryption key component K1' using the gateway private key by the external network gateway.

[0063] The encryption bridge is further configured to allow the user identity to access the corresponding access terminal when the authentication device determines that the first decryption key component K1" and the second key component K2 in the pre-stored initialization information match.

[0064] Compared with the prior art, the present application has the following beneficial effects:

[0065] The present application can realize the registration between the encryption data storage device and the external network gateway, and the registration information such as the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign is secretly stored by the encryption data storage device, thereby improving the security of the encryption data storage device under the condition of the external network. In addition, based on the registration relationship established between the encryption data storage device and the external network gateway, the encryption data storage device can be expanded for multi-person collaborative office, thereby improving the convenience of the encryption data storage device. BRIEF DESCRIPTION OF DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0067] Figure 1 is a structure schematic diagram of a data storage device based on quantum random numbers in an external network disclosed by the embodiments of the present application;

[0068] Figure 2 is a content storage schematic diagram of an authentication device in the embodiments of the present application;

[0069] Figure 3 is a flow schematic diagram of an encryption implementation method of a data storage device based on quantum random numbers in an external network disclosed by the embodiments of the present application;

[0070] Figure 4 is a timing diagram of an encryption access process of an encryption data storage device in the embodiments of the present application;

[0071] Figure 5 is a flow schematic diagram of another encryption implementation method of a data storage device based on quantum random numbers in an external network disclosed by the embodiments of the present application. DETAILED DESCRIPTION

[0072] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0073] The terms "first," "second," and so on, in the description and claims of the present invention and the accompanying drawings are used to distinguish between different items, not to describe a specific order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, apparatus, product, or end comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or end.

[0074] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0075] Example 1

[0076] like Figure 1 As shown, Figure 1 It is a data storage device based on quantum random numbers in an external network disclosed in the first embodiment of the present invention. The data storage device can be a hard disk, a USB flash drive, a magnetic disk, etc. The data storage device includes a storage medium, an encryption bridge, an authentication device, a quantum random number generator, and an external interface. Among them, the external interface, the encryption bridge chip and the storage medium together constitute a self-encrypting data storage device. The self-encrypting data storage device plus the authentication device and the quantum random number generator constitute the data storage device based on quantum random numbers in the external network in the embodiment of the present invention, referred to as an encrypted data storage device.

[0077] Among them, the external network gateway is deployed on the public domain network and can be publicly accessed. The gateway saves the external network user account Accountpub information and the external network private key Pubext.

[0078] The access terminal can be a mobile terminal or a desktop terminal device, and optionally, the access terminal can be provided with corresponding access management software for user interaction and management of the encrypted data storage device.

[0079] The quantum random number generator generates a random number sequence as an encryption key.

[0080] The storage medium includes a disk, a tape, a flash, a ROM, and other data storage media.

[0081] The authentication device is composed of a specific security chip and is used to save and verify user identity information. The authentication device can generate a public-private key pair and provide an encryption storage circuit to save data and other content through a built-in key and algorithm. The access control of the authentication device can adopt a key sharing mechanism, divide the key into multiple components, and pass the authentication when the key components meet the threshold condition.

[0082] The encryption bridge is composed of an encryption circuit and a chip, which provides an external interface externally and data storage management internally. The encryption bridge functions as follows:

[0083] The communication with the access terminal and the access management of the storage medium are realized; the authentication device verifies the user identity information, and allows the access terminal to access the storage medium according to the verification result.

[0084] The key provided by the quantum random number generator is received and saved, and the key cannot be accessed by external circuit or software.

[0085] The saved key is used to encrypt or decrypt the data flowing through the external interface.

[0086] After the key is reset or updated, the data saved in the storage medium cannot be decrypted, and the encrypted data storage device needs to be reinitialized for continuous use, and the saved data will be lost.

[0087] In order to solve the technical problems of the prior art that the self-encryption data storage device has deficiencies in security and convenience whether the data storage device is provided with a built-in key management or an external key management, the encryption data storage device in the embodiment of the present application further has the following design:

[0088] One end of the external interface is used to communicate with the external network gateway, and the other end of the external interface is in communication connection with the encryption bridge; the external interface is a bridge for the encryption data storage device system to communicate with the external network gateway. It has two endpoints, one end is connected with the external network gateway, and the other end is connected with the encryption bridge. This interface can be physical (such as USB, SATA, etc.) or virtual (such as through the network). Alternatively, the external interface can also communicate with the external network gateway through an access terminal (such as a computer or other device), wherein the communication connection includes wired communication connection and wireless communication connection.

[0089] The encryption bridge is used to obtain the gateway address and the gateway public key through the external interface, and establish a network connection with the external network gateway; the encryption bridge is an intermediate device connecting the external interface and the external network gateway, which is responsible for obtaining the address and public key of the gateway, and establishing a network connection with the external network gateway.

[0090] The quantum random number generator is used to generate a corresponding device public key Discpub and device private key Diskpri, and send the device public key Discpub to the external network gateway through the established network connection; the quantum random number generator uses quantum mechanics to generate real random numbers, which are used to generate a corresponding device public key Discpub and device private key Diskpri, and the external network gateway obtains the device public key Discpub, thereby realizing the decryption of the encrypted data of the device private key Diskpri.

[0091] The quantum random number generator is used to generate a first link identifier IDsession1 and a first session key KS1 using quantum random numbers;

[0092] The encryption bridge is also used to negotiate with the external network gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1; the first session link is established by negotiation between the encryption bridge and the external network gateway, and is encrypted using the first link identifier and the first session key, and is used for securely transmitting data between the encryption bridge and the external network gateway.

[0093] The encryption bridge is also used to obtain the external network signature Disksign through the first session link, wherein the external network signature Disksign is a signature of the data storage device by the external network gateway using the gateway private key; the external network signature is a signature of the data storage device by the external network gateway using its private key, and is used to verify the legitimacy and integrity of the data storage device.

[0094] The authentication device is used to secretly store registration information, which includes the gateway address, the gateway public key, the device private key Diskpri, and the external network signature Disksign.

[0095] It can be seen that the data storage device based on quantum random numbers in the external network in the embodiment of the application can realize the registration between the encrypted data storage device and the external network gateway, and the registration information such as the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign is secretly saved by the encrypted data storage device, thereby improving the security of the encrypted data storage device under the condition of the external network. In addition, based on the registration relationship established between the encrypted data storage device and the external network gateway, the encrypted data storage device can be extended for multi-person collaborative office, thereby improving the convenience of the encrypted data storage device.

[0096] In an optional embodiment, the quantum random number generator is further configured to generate a corresponding first key component K1 and a second key component K2.

[0097] The encrypted bridge is further configured to encrypt the first key component K1 using the gateway public key to obtain a first encrypted key component K1'; the encrypted bridge is further configured to obtain the accessible user identifier and the access password information corresponding to each accessible user identifier; at this time, the information saved by the authentication device is as shown in Figure 2 .

[0098] The authentication device is further configured to secretly save the initialization information, and the initialization information includes the second key component K2, the first encrypted key component K1', the accessible user identifier and the access password information corresponding to each accessible user identifier.

[0099] In the optional embodiment, since it is under the condition of the external network, the encrypted data storage device needs to save the accessible user identifier and the corresponding verification condition, that is, the password information. The optional user identifier can be an IP address, a user account, fingerprint biological information, etc. The optional password information is information for uniquely proving the legitimacy of the user identifier, which can be a digital password, an image password, a sound password, an operation password, etc. The first key component K1 and the second key component K2 are corresponding, and the key sharing algorithm or random number generation can be used to generate the first key component K1 and the second key component K2 with the same length.

[0100] It can be seen that the optional embodiment can realize the initialization of the user in the encrypted data storage device. For the application scenario of team collaboration, the user identifiers of all team member users can be determined as the accessible user identifiers, thereby improving the convenience of the use of the encrypted data storage device and making it suitable for the application scenario of team collaborative work. In addition, the key sharing mechanism is adopted to divide the key into multiple components, and the corresponding components are respectively saved by the encrypted data storage device and the external network gateway. Only when the key components meet the threshold condition, the authentication can pass, thereby further improving the security of the encrypted data storage device while ensuring the convenience of the use of the encrypted data storage device.

[0101] In yet another optional embodiment, the quantum random number generator is further configured to generate a second link identification IDsession2 and a second session key KS2 based on the access request of the current access user using the random number;

[0102] The encryption bridge is further configured to encrypt the second link identification IDsession2 using the second session key KS2 and sign using the device private key Diskpri to obtain a second encrypted link identification IDsession2';

[0103] The encryption bridge is further configured to encrypt the access request using the second session key KS2 and sign using the device private key Diskpri to obtain an encrypted access request;

[0104] The encryption bridge is further configured to encrypt the second session key KS2 using the gateway public key and sign using the device private key Diskpri to obtain a second encrypted session key KS2';

[0105] At this point, only the external network gateway can calculate the second encrypted link identification IDsession2', the encrypted access request, and the second encrypted session key KS2', wherein the second session key is encrypted by the device private key, and the second link identification IDsession2 and the access request are jointly encrypted by the second session key KS2 and the device private key Diskpri, and the security is higher.

[0106] The encryption bridge is further configured to send the second encrypted link identification IDsession2', the encrypted access request, and the second encrypted session key KS2' to the external network gateway through the external interface, so that the external network gateway calculates the second encrypted session key KS2' using the gateway public key to obtain the second session key KS2; and so that the external network gateway calculates the second encrypted link identification IDsession2' and the encrypted access request using the second session key KS2 to obtain the second link identification IDsession2 and the access request;

[0107] The encryption bridge is further configured to establish a second session link with the external network gateway when the external network gateway confirms that the device private key Diskpri signature corresponding to the second encrypted link identification IDsession2', the encrypted access request, and the second encrypted session key KS2' is correct and the access request is correct, wherein the identification of the second session link is the second encrypted link identification IDsession2 and the second session link is encrypted by the second session key KS2; wherein the second session link is used for accessing the data storage device under the external network condition.

[0108] It can be seen that in the optional embodiment, the session key and the link identifier can be dynamically generated according to the access application of the user, an independent security environment is provided for each session, dynamic session management is realized, and the convenience of the encrypted data storage device in team coordination is greatly improved. In addition, in the establishment process of the second session link, the second session key is encrypted by the device private key, the second link identifier IDsession2 and the access application are jointly encrypted by the second session key KS2 and the device private key Diskpri, therefore, the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' can only be calculated by the external network gateway, and the security of the encrypted data storage device is further improved.

[0109] In yet another optional embodiment, the authentication device is further configured to match the user identifier received from the access terminal with the accessible user identifier in the pre-stored initialization information, and match the password information received from the access terminal with the accessible password information corresponding to the accessible user identifier in the pre-stored initialization information.

[0110] The encrypted bridge is further configured to send the first encrypted key component K1' to the external network gateway when the authentication device determines that the user identifier matches the pre-stored accessible user identifier and the password information matches the pre-stored accessible password information corresponding to the accessible user identifier. This step is to verify whether the user currently attempting to access the encrypted data storage device is an authorized team member. Since in the external network environment, after determining that the user is a team member, the password information needs to be further verified.

[0111] The authentication device is further configured to determine whether the first decryption key component K1'' and the second key component K2 in the pre-stored initialization information match, wherein the first decryption key component K1'' is obtained by decrypting the first encrypted key component K1' using the gateway private key of the external network gateway. This step is a key link of key verification, which ensures that only users with correct key components can access the encrypted data storage device.

[0112] The encrypted bridge is further configured to allow the access terminal corresponding to the user identifier to access when the authentication device determines that the first decryption key component K1'' and the second key component K2 in the pre-stored initialization information match.

[0113] It can be seen that in the optional embodiment, the user information and the accessible user identifier are matched, and the key components are verified, thereby realizing accurate identity verification and access control.

[0114] Embodiment Two

[0115] As shown in Figure 3 , the authentication device is further configured to match the user identifier received from the access terminal with the accessible user identifier in the pre-stored initialization information, and match the password information received from the access terminal with the accessible password information corresponding to the accessible user identifier in the pre-stored initialization information. Figure 3is a flow chart of a data storage device encryption implementation method based on quantum random numbers in an external network according to the second embodiment of the present application. The method is applied to any encrypted data storage device, such as the encrypted data storage device described in the first embodiment. The method can be integrated in the encrypted data storage device, an access terminal, an external network gateway or a server, or can be integrated in some storage medium alone, and is implemented when the storage medium is executed by a processor. The method can include:

[0116] In step 201, the encrypted data storage device acquires the gateway address and the gateway public key, and establishes a network connection with the external network gateway. The network connection includes wired connection and wireless connection.

[0117] In step 202, the encrypted data storage device generates a corresponding device public key Discpub and a device private key Diskpri, and sends the device public key Discpub to the external network gateway through the established network connection. The external network gateway obtains the device public key Discpub, thereby realizing the decryption of the encrypted data of the device private key Diskpri.

[0118] In step 203, the encrypted data storage device generates a first link identifier IDsession1 and a first session key KS1 using random numbers, and negotiates with the external network gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1. The first session link is established by negotiation between the encrypted data storage device and the external network gateway, and is encrypted using the first link identifier and the first session key, and is used for securely transmitting data between the encrypted data storage device and the external network gateway.

[0119] In step 204, the encrypted data storage device acquires the external network signature Disksign through the first session link, wherein the external network signature Disksign is the signature of the encrypted data storage device by the external network gateway using the gateway private key. The external network signature is the signature of the data storage device by the external network gateway using its private key, and is used to verify the legitimacy and integrity of the data storage device.

[0120] In step 205, the encrypted data storage device secretly saves the registration information, so that the encrypted data storage device can encrypt the transmitted data under the condition of the external network, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign.

[0121] It can be seen that the method for realizing the encryption of the data storage device based on the quantum random number in the external network in the embodiment of the application can realize the registration between the encrypted data storage device and the gateway of the external network, and the gateway address, the gateway public key, the device private key Diskpri and the registration information such as the external network signature Disksign are secretly stored by the encrypted data storage device, thereby improving the security of the encrypted data storage device under the condition of the external network. In addition, based on the registration relationship established between the encrypted data storage device and the gateway of the external network, the encrypted data storage device can be expanded for multi-person collaborative office, thereby improving the convenience of the encrypted data storage device.

[0122] In an optional embodiment, as shown in the timing diagram of FIG. 8, the method can further include: Figure 4

[0123] The encrypted data storage device generates the corresponding first key component K1 and second key component K2, and encrypts the first key component K1 using the gateway public key to obtain the first encrypted key component K1';

[0124] The encrypted data storage device acquires the accessible user identification and the access password information corresponding to each accessible user identification;

[0125] The encrypted data storage device secretly stores the initialization information, so that the encrypted data storage device can realize the management of the access user under the condition of the external network, wherein the initialization information includes the second key component K2, the first encrypted key component K1', the accessible user identification and the access password information corresponding to each accessible user identification.

[0126] In the optional embodiment, since it is under the condition of the external network, the encrypted data storage device needs to store the accessible user identification and the corresponding verification condition, that is, the password information. The optional user identification can be an IP address, a user account, fingerprint biological information, etc. The optional password information is information for uniquely proving the legality of the user identification, which can be a digital password, an image password, a sound password, an operation password, etc. The first key component K1 and the second key component K2 are corresponding, and the key sharing algorithm or random number generation can be used to generate the first key component K1 and the second key component K2 with the same length.

[0127] ​It can be seen that the optional embodiment can realize the initialization of the user in the encrypted data storage device. For the application scenario of team collaboration, the user identifiers of all team member users can be determined as accessible user identifiers, thereby improving the convenience of using the encrypted data storage device and making it suitable for the application scenario of team collaboration. In addition, by using the key sharing mechanism, the key is divided into multiple components, and the corresponding components are respectively saved by the encrypted data storage device and the external network gateway. Only when the key components meet the threshold condition, the authentication can pass, thereby further improving the security of the encrypted data storage device while ensuring the convenience of using the encrypted data storage device.

[0128] In yet another optional embodiment, the method can further include:

[0129] In response to the access application of the current access user, the encrypted data storage device generates a second link identifier IDsession2 and a second session key KS2 using a random number;

[0130] The encrypted data storage device encrypts the second link identifier IDsession2 using the second session key KS2 and signs using the device private key Diskpri to obtain a second encrypted link identifier IDsession2';

[0131] The encrypted data storage device encrypts the access application using the second session key KS2 and signs using the device private key Diskpri to obtain an encrypted access application;

[0132] The encrypted data storage device encrypts the second session key KS2 using the gateway public key and signs using the device private key Diskpri to obtain a second encrypted session key KS2';

[0133] Among them, the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' can only be calculated by the external network gateway. The second session key is encrypted by the device private key, and the second link identifier IDsession2 and the access application are jointly encrypted by the second session key KS2 and the device private key Diskpri, which is more secure.

[0134] The encrypted data storage device sends the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' to the external network gateway, so that the external network gateway uses the gateway public key to calculate the second encrypted session key KS2' to obtain the second session key KS2; and the external network gateway uses the second session key KS2 to calculate the second encrypted link identifier IDsession2' and the encrypted access application to obtain the second link identifier IDsession2 and the access application;

[0135] When the external network gateway confirms that the signature of the device private key Diskpri corresponding to the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' is correct and the access application is correct, a second session link is established between the encrypted data storage device and the external network gateway. The identifier of the second session link is the second encrypted link identifier IDsession2 and the second session link is encrypted by the second session key KS2; wherein, the second session link is used to realize access to the encrypted data storage device under external network conditions.

[0136] As can be seen, this optional embodiment can dynamically generate session keys and link identifiers based on the user's access request, providing an independent security environment for each session, enabling dynamic session management, and greatly improving the convenience of the encrypted data storage device during team coordination. In addition, during the establishment of the second session link, the second session key is encrypted by the device private key, and the second link identifier IDsession2 and the access request are jointly encrypted by the second session key KS2 and the device private key Diskpri. Therefore, only the external network gateway can decipher the second encrypted link identifier IDsession2', the encrypted access request, and the second encrypted session key KS2', further improving the security of the encrypted data storage device.

[0137] In another optional embodiment, Figure 4 As shown in the timing diagram, the method may further include:

[0138] The encrypted data storage device receives the user identification and password information sent by the access terminal, and matches the user identification with the accessible user identification in the pre-stored initialization information. If the user identification successfully matches the accessible user identification, it determines whether the password information matches the accessible password information corresponding to the accessible user identification.

[0139] If the password information successfully matches the accessible password information corresponding to the accessible user identifier, the encrypted data storage device sends the first encryption key component K1 ′ to the external network gateway;

[0140] The encrypted data storage device obtains the first decryption key component K1″ sent by the external network gateway. The first decryption key component K1″ is obtained after the external network gateway decrypts the first encryption key component K1′ using the gateway private key;

[0141] When the encrypted data storage device determines that the first decryption key component K1″ matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows access by the access terminal corresponding to the user identifier.

[0142] It can be seen that in the optional embodiment, accurate identity authentication and access control can be realized by matching the user information and the accessible user identifier and verifying the key component.

[0143] Embodiment three

[0144] As Figure 5 shown, Figure 5 is a flow chart of another method for implementing encryption of a data storage device based on quantum random numbers in an external network, according to an embodiment of the present application. The method is applied to an external network gateway. The method can be integrated in an encrypted data storage device, an access terminal, an external network gateway, or a server, or can be integrated in some storage medium alone, and when the storage medium is executed by a processor, the method is implemented. The method can include:

[0145] Step 301, the external network gateway sends a gateway address and a gateway public key to an encrypted data storage device, and establishes a network connection with the encrypted data storage device;

[0146] Step 302, the external network gateway receives a device public key Discpub sent by the encrypted data storage device through the established network connection. The device public key Discpub corresponds to a device private key Diskpri, and the device public key Discpub and the device private key Diskpri are generated by the encrypted data storage device;

[0147] Step 303, the external network gateway and the encrypted data storage device negotiate to establish a first session link identified as a first link identifier IDsession1 and encrypted by a first session key KS1, wherein the first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using random numbers;

[0148] Step 304, the external network gateway signs the encrypted data storage device using a gateway private key to obtain an external network signature Disksign. The external network gateway sends the external network signature Disksign to the encrypted data storage device using the first session link. The encrypted data storage device secretly saves registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri, and the external network signature Disksign.

[0149] It can be seen that the data storage device encryption implementation method based on quantum random numbers in the external network in the embodiment of the application can realize the registration and registration between the encrypted data storage device and the external network gateway, and the registration information such as the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign is secretly stored by the encrypted data storage device, thereby improving the security of the encrypted data storage device under the condition of the external network. In addition, based on the registration relationship established between the encrypted data storage device and the external network gateway, the encrypted data storage device can be expanded for multi-person collaborative office, thereby improving the convenience of the encrypted data storage device.

[0150] In an optional embodiment, as shown in the timing diagram of Figure 4 The method can further include:

[0151] In response to the access application of the current access user, the external network gateway receives the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' sent by the encrypted data storage device;

[0152] The external network gateway uses the gateway public key to solve the second encrypted session key KS2', to obtain the second session key KS2, and makes the external network gateway use the second session key KS2 to solve the second encrypted link identifier IDsession2' and the encrypted access application, to obtain the second link identifier IDsession2 and the access application;

[0153] The external network gateway confirms whether the device private key Diskpri signature corresponding to the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' is correct, and the external network gateway confirms whether the access application is correct;

[0154] When the external network gateway confirms that the device private key Diskpri signature corresponding to the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' is correct and the access application is correct, a second session link between the external network gateway and the encrypted data storage device is established, the identifier of the second session link is the second encrypted link identifier IDsession2 and the second session link is encrypted by the second session key KS2. The second session link is used for accessing the encrypted data storage device under the condition of the external network.

[0155] and the second encrypted link identifier IDsession2' is obtained by the encrypted data storage device encrypting the second link identifier IDsession2 using the second session key KS2 and signing using the device private key Diskpri; the encrypted access application is obtained by the encrypted data storage device encrypting the access application using the second session key KS2 and signing using the device private key Diskpri; the second encrypted session key KS2' is obtained by the encrypted data storage device encrypting the second session key KS2 using the gateway public key and signing using the device private key Diskpri; and the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using random numbers.

[0156] It can be seen that, in this optional embodiment, the session key and the link identifier can be dynamically generated according to the access application of the user, an independent secure environment is provided for each session, dynamic session management can be realized, and the convenience of the encrypted data storage device in team coordination is greatly improved. In addition, in the establishment process of the second session link, the second session key is encrypted by the device private key, the second link identifier IDsession2 and the access application are jointly encrypted by the second session key KS2 and the device private key Diskpri, therefore, the second encrypted link identifier IDsession2', the encrypted access application and the second encrypted session key KS2' can only be calculated by the external network gateway, and the security of the encrypted data storage device is further improved.

[0157] In yet another optional embodiment, as shown in the timing diagram of Figure 4 The method can further include:

[0158] When the encrypted data storage device judges that the user identifier received from the access terminal matches the pre-stored accessible user identifier successfully, and the password information received from the access terminal matches the accessible password information corresponding to the pre-stored accessible user identifier successfully, the external network gateway receives the first encrypted key component K1' sent by the encrypted data storage device;

[0159] The external network gateway decrypts the first encrypted key component K1' using the gateway private key to obtain the first decrypted key component K1", and the external network gateway sends the first decrypted key component K1" to the encrypted key, so that the encrypted data storage device allows the access terminal corresponding to the user identifier to access the encrypted data storage device when judging that the first decrypted key component K1" and the second key component K2 in the pre-stored initialization information match.

[0160] and the first encrypted key component K1' is obtained by the encrypted data storage device encrypting the first key component K1 using the gateway public key, and the first key component K1 and the second key component K2 correspond to each other and are generated by the encrypted data storage device.

[0161] It can be seen that in the optional embodiment, the accurate identity authentication and access control can be realized by matching the user information and the accessible user identifier and verifying the key component.

[0162] The apparatus embodiments described above are only illustrative, wherein the modules illustrated as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, i.e., can be located in one place or distributed to multiple network modules. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0163] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage, a magnetic tape storage, or any other computer readable medium that can be used to carry or store data.

[0164] It should be noted that the data storage device based on quantum random number in external network and the encryption implementation method disclosed by the embodiment of the present application are only the preferred embodiments of the present application, and are used to illustrate the technical solutions of the present application, but not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents. The modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for implementing encryption of a data storage device based on quantum random numbers in an external network, characterized in that: The method is applied to an encrypted data storage device, and the method comprises: The encrypted data storage device obtains the gateway address and gateway public key, and establishes a network connection with the external network gateway; The encrypted data storage device generates a corresponding device public key Discpub and a device private key Diskpri, and sends the device public key Discpub to the external network gateway via the established network connection; The encrypted data storage device generates a first link identifier IDsession1 and a first session key KS1 using quantum random numbers, and negotiates with the external network gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1; The encrypted data storage device obtains the external network signature Disksign through the first session link, wherein the external network signature Disksign is a signature of the encrypted data storage device by the external network gateway using the gateway private key; The encrypted data storage device secretly stores registration information so that the encrypted data storage device can encrypt the transmitted data under external network conditions, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign; The encrypted data storage device generates a corresponding first key component K1 and a second key component K2, and encrypts the first key component K1 using the gateway public key to obtain a first encrypted key component K1'; The encrypted data storage device obtains the accessible user identifier and the access password information corresponding to each of the accessible user identifiers; The encrypted data storage device secretly stores initialization information so that the encrypted data storage device can manage access users under external network conditions, wherein the initialization information includes the second key component K2, the first encryption key component K1', the accessible user identifiers and access password information corresponding to each accessible user identifier; The encrypted data storage device receives the user identification and password information sent by the access terminal, and matches the user identification with the accessible user identification in the pre-stored initialization information, and if the user identification successfully matches the accessible user identification, determines whether the password information matches the accessible password information corresponding to the accessible user identification; If the password information successfully matches the accessible password information corresponding to the accessible user identifier, the encrypted data storage device sends the first encryption key component K1' to the external network gateway; The encrypted data storage device obtains the first decryption key component K1″ sent by the external network gateway. The first decryption key component K1″ is obtained by the external network gateway decrypting the first encryption key component K1′ using the gateway private key; When the encrypted data storage device determines that the first decryption key component K1″ matches the second key component K2 in the pre-stored initialization information, the encrypted data storage device allows access by the access terminal corresponding to the user identifier.

2. The method for implementing encryption of a data storage device based on quantum random numbers in an external network according to claim 1, characterized in that: The method further comprises: In response to an access request from the current access user, the encrypted data storage device generates a second link identifier IDsession2 and a second session key KS2 using quantum random numbers; The encrypted data storage device encrypts the second link identifier IDsession2 using the second session key KS2 and signs it using the device private key Diskpri to obtain a second encrypted link identifier IDsession2'; The encrypted data storage device encrypts the access request using the second session key KS2 and signs the access request using the device private key Diskpri to obtain an encrypted access request; The encrypted data storage device encrypts the second session key KS2 using the gateway public key and signs it using the device private key Diskpri to obtain a second encrypted session key KS2'; The encrypted data storage device sends the second encrypted link identifier IDsession2', the encrypted access request, and the second encrypted session key KS2' to the external network gateway, so that the external network gateway uses the gateway public key to resolve the second encrypted session key KS2' to obtain the second session key KS2; and the external network gateway uses the second session key KS2 to resolve the second encrypted link identifier IDsession2' and the encrypted access request to obtain the second link identifier IDsession2 and the access request; When the external network gateway confirms that the second encrypted link identifier IDsession2', the encrypted access application and the device private key Diskpri signature corresponding to the second encrypted session key KS2' are correct and the access application is correct, a second session link is established between the encrypted data storage device and the external network gateway. The identifier of the second session link is the second encrypted link identifier IDsession2 and the second session link is encrypted by the second session key KS2; wherein, the second session link is used to realize access to the encrypted data storage device under external network conditions.

3. A method for implementing encryption of a data storage device based on quantum random numbers in an external network, characterized in that: The method is applied to an external network gateway, and the method includes: The external network gateway sends the gateway address and the gateway public key to the encrypted data storage device and establishes a network connection with the encrypted data storage device; The external network gateway receives a device public key Discpub sent by the encrypted data storage device through the established network connection, wherein the device public key Discpub corresponds to a device private key Diskpri, and the device public key Discpub and the device private key Diskpri are generated by the encrypted data storage device; The external network gateway negotiates with the encrypted data storage device to establish a first session link identified by a first link identifier IDsession1 and encrypted by a first session key KS1, wherein the first link identifier IDsession1 and the first session key KS1 are generated by the encrypted data storage device using quantum random numbers; The external network gateway signs the encrypted data storage device using the gateway private key to obtain the external network signature Disksign; the external network gateway sends the external network signature Disksign to the encrypted data storage device using the first session link, so that the encrypted data storage device secretly stores registration information, wherein the registration information includes the gateway address, the gateway public key, the device private key Diskpri, and the external network signature Disksign; When the encrypted data storage device determines that the user identification received from the access terminal successfully matches the pre-stored accessible user identification, and the password information received from the access terminal successfully matches the pre-stored accessible password information corresponding to the accessible user identification, the external network gateway receives the first encryption key component K1′ sent by the encrypted data storage device; The external network gateway decrypts the first encryption key component K1′ using the gateway private key to obtain a first decryption key component K1″. The external network gateway sends the first decryption key component K1″ to the encryption key, so that the encrypted data storage device allows the access terminal corresponding to the user identifier to access the encrypted data storage device when the first decryption key component K1″ is determined to match the second key component K2 in the pre-stored initialization information; Furthermore, the first encryption key component K1' is obtained by the encrypted data storage device encrypting the first key component K1 using the gateway public key. The first key component K1 corresponds to the second key component K2 and is generated by the encrypted data storage device.

4. The method for implementing encryption of a data storage device based on quantum random numbers in an external network according to claim 3, characterized in that: The method further comprises: In response to the access request of the current access user, the external network gateway receives the second encrypted link identifier IDsession2', the encrypted access request and the second encrypted session key KS2' sent by the encrypted data storage device; The external network gateway uses the gateway public key to resolve the second encrypted session key KS2' to obtain the second session key KS2; and the external network gateway uses the second session key KS2 to resolve the second encrypted link identifier IDsession2' and the encrypted access request to obtain the second link identifier IDsession2 and the access request; The external network gateway confirms whether the second encrypted link identifier IDsession2', the encrypted access request and the signature of the device private key Diskpri corresponding to the second encrypted session key KS2' are correct, and the external network gateway confirms whether the access request is correct; When the external network gateway confirms that the second encrypted link identifier IDsession2', the encrypted access request, and the signature of the device private key Diskpri corresponding to the second encrypted session key KS2' are correct and the access request is correct, a second session link is established between the external network gateway and the encrypted data storage device, where the identifier of the second session link is the second encrypted link identifier IDsession2 and the second session link is encrypted by the second session key KS2; wherein the second session link is used to implement access to the encrypted data storage device under external network conditions; In addition, the second encrypted link identifier IDsession2' is obtained after the encrypted data storage device uses the second session key KS2 to encrypt the second link identifier IDsession2 and signs it with the device private key Diskpri; the encrypted access application is obtained after the encrypted data storage device uses the second session key KS2 to encrypt the access application and signs it with the device private key Diskpri; the second encrypted session key KS2' is obtained after the encrypted data storage device uses the gateway public key to encrypt the second session key KS2 and signs it with the device private key Diskpri; the second link identifier IDsession2 and the second session key KS2 are generated by the encrypted data storage device using quantum random numbers.

5. A data storage device based on quantum random numbers in an external network, characterized in that: The data storage device includes a storage medium, an encryption bridge, an authentication device, a quantum random number generator, and an external interface, wherein: One end of the external interface is used for communication connection with the external network gateway, and the other end of the external interface is used for communication connection with the encryption bridge; The encryption bridge is used to obtain the gateway address and gateway public key through the external interface and establish a network connection with the external network gateway; The quantum random number generator is used to generate a corresponding device public key Discpub and device private key Diskpri, and send the device public key Discpub to the external network gateway through the established network connection; The quantum random number generator is used to generate a first link identifier IDsession1 and a first session key KS1 using quantum random numbers; The encryption bridge is further configured to negotiate with the external network gateway to establish a first session link identified by the first link identifier IDsession1 and encrypted by the first session key KS1; The encryption bridge is further configured to obtain an external network signature Disksign through the first session link, wherein the external network signature Disksign is a signature of the data storage device by the external network gateway using a gateway private key; The authentication device is used to secretly store registration information, the registration information including the gateway address, the gateway public key, the device private key Diskpri and the external network signature Disksign; The quantum random number generator is also used to generate corresponding first key component K1 and second key component K2; The encryption bridge is further configured to encrypt the first key component K1 using the gateway public key to obtain a first encryption key component K1'; the encryption bridge is further configured to obtain an accessible user identifier and access password information corresponding to each accessible user identifier; The authentication device is further configured to secretly store initialization information, the initialization information including the second key component K2, the first encryption key component K1', the accessible user identifiers and access password information corresponding to each accessible user identifier; The authentication device is further configured to match the user identification received from the access terminal with the accessible user identification in the pre-stored initialization information, and to match the password information received from the access terminal with the accessible password information corresponding to the pre-stored accessible user identification; The encryption bridge is further configured to send the first encryption key component K1' to the external network gateway when the authentication device determines that the user identifier successfully matches the pre-stored accessible user identifier and the password information successfully matches the pre-stored accessible password information corresponding to the accessible user identifier; The authentication device is further configured to determine whether a first decryption key component K1″ matches the second key component K2 in the pre-stored initialization information, wherein the first decryption key component K1″ is obtained by the external network gateway decrypting the first encryption key component K1′ using the gateway private key; The encryption bridge is further configured to allow access by the access terminal corresponding to the user identifier when the authentication device determines that the first decryption key component K1″ matches the second key component K2 in the pre-stored initialization information.

6. The data storage device based on quantum random numbers in the external network according to claim 5, characterized in that: The quantum random number generator is further used to generate a second link identifier IDsession2 and a second session key KS2 using the quantum random number according to the access application of the current access user; The encryption bridge is further configured to encrypt the second link identifier IDsession2 using the second session key KS2 and sign the second link identifier IDsession2 using the device private key Diskpri to obtain a second encrypted link identifier IDsession2'; The encryption bridge is further configured to encrypt the access request using the second session key KS2 and sign the access request using the device private key Diskpri to obtain an encrypted access request; The encryption bridge is further configured to encrypt the second session key KS2 using the gateway public key and sign the second session key KS2 using the device private key Diskpri to obtain a second encrypted session key KS2'; The encryption bridge is further configured to use an external interface to send the second encryption link identifier IDsession2', the encryption access request, and the second encryption session key KS2' to the external network gateway, so that the external network gateway uses the gateway public key to resolve the second encryption session key KS2' to obtain the second session key KS2; and to enable the external network gateway to use the second session key KS2 to resolve the second encryption link identifier IDsession2' and the encryption access request to obtain the second link identifier IDsession2 and the access request; The encryption bridge is also used to establish a second session link with the external network gateway when the external network gateway confirms that the second encryption link identifier IDsession2', the encryption access application and the device private key Diskpri signature corresponding to the second encryption session key KS2' are correct and the access application is correct. The identifier of the second session link is the second encryption link identifier IDsession2 and the second session link is encrypted by the second session key KS2; wherein, the second session link is used to realize access to the data storage device under external network conditions.

Images