Wireless intelligent switch using encrypted data

Abstract

The invention discloses a wireless intelligent switch using encrypted data. The wireless intelligent switch comprises a secret key generation unit, a secret key storage unit, a data transmission unit and a secret key updating unit, the key generation unit is used for generating a unique key by adopting a quantum random number generator when the switch is started, and a unique interaction relationship is established between the unique key and the switch; the secret key storage unit is used for distributing and storing the unique secret key in a plurality of trusted terminal devices of which the switches are interconnected; the data transmission unit is used for sending an instruction to the switch through the terminal equipment, encrypting the instruction by using a quantum encryption algorithm, and adding a hash value of a unique key at the same time; and the secret key updating unit is used for generating a new secret key corresponding to the unique secret key within a preset time, replacing the unique secret key and recording a unique secret key replacing event at the same time. The method is used for solving the technical problems that the existing key generation, transmission or storage link is invaded by hackers, and the communication data of the whole system is easily intercepted, tampered and even counterfeited to control equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent switches, and in particular to a wireless intelligent switch used with encrypted data. Background Art

[0002] Smart switches use electronic components and programming to achieve intelligent circuit control. They support remote control, timing, voice control, and scene interaction. Compared to traditional switches, they offer advantages in energy efficiency and environmental protection, ease of operation, and the ability to interact with other smart home devices. With the widespread adoption of smart homes, the smart switch market is growing rapidly. In the future, they are expected to develop towards higher levels of integration, personalization, and security, becoming a core component of smart living.

[0003] Currently, most wireless smart switches use encryption to improve security. However, encryption-based key distribution relies on pre-set keys or central servers. Once the key generation, transmission, or storage links are hacked, the communication data of the entire system may be intercepted, tampered with, or even forged to control the identity of the device. Therefore, this type of centralized architecture itself is also easy to become an attack target and it is difficult to meet the needs of high-security scenarios. Summary of the Invention

[0004] The purpose of the present invention is to provide a wireless intelligent switch for use with encrypted data to solve the technical problem that the existing key generation, transmission or storage links are hacked, the communication data of the entire system is easily intercepted, tampered with, and even the identity control device is forged.

[0005] The technical solution of the present invention is achieved as follows:

[0006] A wireless intelligent switch for use with encrypted data, comprising a key generation unit, a key storage unit, a data transmission unit, and a key update unit;

[0007] The key generation unit is used to generate a unique key using a quantum random number generator when the switch is activated, and the unique key establishes a unique interactive relationship with the switch;

[0008] The key storage unit is used to distribute and store the unique key in a plurality of trusted terminal devices interconnected by the switch;

[0009] The data transmission unit is used to send instructions to the switch through the terminal device, encrypt the instructions using a quantum encryption algorithm, and append a hash value of the unique key;

[0010] The key updating unit is configured to generate a new key corresponding to the unique key within a preset time, replace the unique key, and record the event of replacing the unique key.

[0011] A further technical solution is that the key generation unit includes:

[0012] A startup module, configured to activate the quantum random number generator when the switch is powered on or reset;

[0013] A transition module, configured to generate an unpredictable random number sequence using the quantum random number generator as basic data;

[0014] A generating module, configured to convert the random number sequence into the unique key that meets encryption requirements;

[0015] The binding module is used to bind the unique key with the hardware identification of the switch to establish a unique interactive relationship.

[0016] A further technical solution is that the startup module specifically executes the following steps:

[0017] Step S11: When the switch detects a power-on or reset signal, the built-in quantum random number generator hardware module is awakened;

[0018] Step S12: The hardware module generates an initial random signal using quantum physics phenomena and completes a self-test;

[0019] Step S13: converting the random number sequence in the initial random signal into a binary key of fixed length, and verifying its uniqueness;

[0020] Step S14: Bind the key to the hardware identifier of the switch and write the key into a protected storage area.

[0021] A further technical solution is that the transition module specifically executes the following steps:

[0022] Step S21: After starting the quantum random number generator, dynamically calibrate the quantum signal source to eliminate environmental interference;

[0023] Step S22: monitoring the quantum polarization direction, and converting the specified result of the polarization direction into a binary bit stream;

[0024] Step S23: Divide the continuously generated binary bit stream into segments of fixed length, and add a timestamp or device identifier as metadata to each segment;

[0025] Step S24: perform entropy detection on the metadata, remove low-entropy segments, and retain high-entropy segments as basic data for the unique key.

[0026] A further technical solution is that the key storage unit includes:

[0027] an identification module, configured to split the unique key into multiple segments according to a fixed rule and attach a unique identification to each segment;

[0028] The device receiving module is used to verify the trusted identity of the target device through the preset device fingerprint or signature, and the receiving end confirms the successful storage;

[0029] a storage module, configured to asynchronously send the unique identifier to the plurality of target devices and store the unique identifier redundantly in each of the target devices;

[0030] The key restoration module sets an independent access permission for the target device storing the unique identifier, allowing the unique key to be restored in combination under the switch unless condition.

[0031] A further technical solution is that the key recovery module specifically performs the following steps:

[0032] Step S31: Bind the unique identifier of the target device to the physical fingerprint and register it in the access control list of the switch;

[0033] Step S32: configuring independent access rights for each target device and setting a trigger condition for restoring the unique key;

[0034] Step S33: When the switch detects a preset physical event, it verifies the fingerprint of the target device and temporarily activates its access rights;

[0035] Step S34: After the permission is activated, the target device extracts the bound unique identifier from the local storage and performs a hash comparison;

[0036] Step S35: When all the target devices pass the verification and meet the triggering conditions, the switch starts the combination logic, integrates the unique identifications of the target devices in a preset order, and restores the complete unique key.

[0037] A further technical solution is that the data transmission unit includes:

[0038] an instruction generation module, configured to calculate a first hash value of the control instruction after the terminal device generates the control instruction, bind the first hash value with a second hash value of the unique key as path data, and append the data to the control instruction;

[0039] An encryption module, used for establishing a quantum encryption communication channel between the terminal device and the switch;

[0040] a transmission module, configured to encrypt the control instruction using a quantum encryption algorithm, generate a ciphertext packet, and send the packet to the switch via the quantum encryption communication channel;

[0041] The execution module is used for verifying whether the path data matches the second hash value stored locally after the switch receives the ciphertext, and decrypting and executing the control instruction if they are consistent.

[0042] A further technical solution is that the encryption module specifically executes the following steps:

[0043] Step S41: The terminal device sends a low-intensity quantum signal to the switch to detect whether the switch has quantum communication capability.

[0044] Step S42: The terminal device exchanges a device fingerprint based on a quantum state with the switch;

[0045] Step S43: Synchronously generate a pair of temporary keys through the quantum random number generator, and synchronously generate a consistent shared key through the device fingerprint comparison;

[0046] Step S44: After the terminal device confirms the synchronization of the shared key with the switch, it generates the quantum encryption communication mode and locks the non-encrypted communication interface.

[0047] A further technical solution is that the specific execution steps of step S41 include:

[0048] Step S411: The terminal device transmits a low-intensity single-photon pulse to the switch, and detects whether the single-photon pulse can reach the switch and return a reflected single-photon pulse;

[0049] Step S142: After receiving the single photon pulse, the switch generates a corresponding quantum state response signal using a built-in quantum detector and returns the signal to the terminal device;

[0050] Step S143: The terminal device compares the reflected single-photon pulse with the quantum state response signal of the received feedback signal to verify whether the quantum communication capability is normal.

[0051] A further technical solution is that the key updating unit specifically performs the following steps:

[0052] Step S51: trigger the new key generation process within a preset time and prepare the storage space required to replace the old key;

[0053] Step S52: Generate the new key using the quantum random number generator, and bind the new key to the identifier of the original unique key to form a mapping relationship;

[0054] Step S53: writing the new key into the storage location of the original unique key, and verifying whether the replaced new key can be used normally for communication or encryption functions;

[0055] Step S54: Record the unique key replacement event in a log, wherein the event includes a timestamp, the original unique key identifier, the new key identifier, and an operation result.

[0056] The beneficial effects of the present invention are:

[0057] The present invention uses a quantum random number generator to generate a unique key. Based on the unpredictability of quantum physics, it avoids the risk of mathematical loopholes being cracked and ensures that the unique key has the characteristics of being unreplicable and unpredictable from the source. The key is then distributed and stored in multiple trusted terminal devices rather than centrally stored. Even if a single device is compromised, the attacker cannot obtain the complete key, thereby blocking the attack path. The instruction is then encrypted using a quantum encryption algorithm, and the hash value of the unique key is attached. This not only ensures the confidentiality of the data, but also verifies the integrity of the instruction in real time, preventing middlemen from tampering with or forging identities to send malicious instructions. Finally, the key is automatically replaced within a preset period and the update event is recorded. Even if the old key is accidentally leaked, it will become invalid in a short time, avoiding long-term exposure risks. At the same time, the event record provides a traceable basis for subsequent security audits. Therefore, a full-link security system has been built from unique key generation to transmission, storage, and update, which effectively resists threats such as hacker intrusion, data interception, tampering, and identity forgery, and provides dual protection of the physical and logical layers for the communication security of wireless smart devices, thereby solving the technical problems of existing key generation, transmission or storage links being invaded by hackers, and the communication data of the entire system being easily intercepted, tampered with, and even forged to control identity devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A system block diagram of a wireless intelligent switch for use with encrypted data provided by the present invention;

[0059] Figure 2 A system block diagram of a key generation unit for a wireless intelligent switch used for encrypted data provided by the present invention;

[0060] Figure 3 A flowchart of specific execution steps of a startup module of a wireless intelligent switch for use with encrypted data provided by the present invention;

[0061] Figure 4 A flowchart of specific execution steps of a transition module of a wireless intelligent switch for use with encrypted data provided by the present invention;

[0062] Figure 5 A system block diagram of a key storage unit of a wireless intelligent switch used for encrypted data provided by the present invention;

[0063] Figure 6A flowchart of specific execution steps of a key recovery module of a wireless intelligent switch used for encrypted data provided by the present invention;

[0064] Figure 7 A system block diagram of a data transmission unit of a wireless intelligent switch for use with encrypted data provided by the present invention;

[0065] Figure 8 A flowchart of specific execution steps of an encryption module of a wireless intelligent switch used for encrypting data provided by the present invention;

[0066] Figure 9 This is a flowchart of specific execution steps of a key update unit of a wireless intelligent switch used for application encryption data provided by the present invention. DETAILED DESCRIPTION

[0067] In order to better understand the technical content of the present invention, specific embodiments are provided below, and the present invention is further described in conjunction with the accompanying drawings.

[0068] See also Figures 1 to 9 The present invention provides a wireless intelligent switch for application encryption data, comprising a key generation unit, a key storage unit, a data transmission unit, and a key update unit; the key generation unit is used to generate a unique key using a quantum random number generator when the switch is started, and the unique key establishes a unique interactive relationship with the switch; the key storage unit is used to distribute and store the unique key in multiple trusted terminal devices interconnected by the switch; the data transmission unit is used to send instructions to the switch through the terminal device, encrypt the instructions using a quantum encryption algorithm, and append a hash value of the unique key; the key update unit is used to generate a new key corresponding to the unique key within a preset time, replace the unique key, and record the event of replacing the unique key.

[0069] In embodiments of the present invention, the trusted terminal device may be a smartphone, smart tablet, or smart home appliance. The preset time period may be 24 hours. A quantum random number generator is a hardware device based on the principles of quantum mechanics. It generates true random numbers by measuring the uncertainty of quantum states and observing interference, as opposed to pseudo-random number generators. A unique key may be an encryption key generated by converting a random number sequence and binding it to a hardware identifier. It is unique and non-replicable, and is used to ensure the security of device communications or storage.

[0070] Specifically, the present invention uses a quantum random number generator to generate a unique key. Based on the unpredictability of quantum physics, it avoids the risk of mathematical loopholes being cracked and ensures that the unique key has the characteristics of being unreplicable and unpredictable from the source. The key is then distributed and stored in multiple trusted terminal devices rather than centrally stored. Even if a single device is compromised, the attacker cannot obtain the complete key, thereby blocking the attack path. The instruction is then encrypted using a quantum encryption algorithm, and the hash value of the unique key is attached. This not only ensures the confidentiality of the data, but also verifies the integrity of the instruction in real time, preventing the middleman from tampering with or forging an identity to send malicious instructions. Finally, the key is automatically replaced within a preset period and the update event is recorded. Even if the old key is accidentally leaked, it will become invalid in a short time, avoiding long-term exposure risks. At the same time, the event record provides a traceable basis for subsequent security audits. Therefore, a full-link security system has been built from unique key generation to transmission, storage, and update, which effectively resists threats such as hacker intrusion, data interception, tampering, and identity forgery, and provides dual protection of the physical and logical layers for the communication security of wireless smart devices, thereby solving the technical problems of existing key generation, transmission or storage links being invaded by hackers, and the communication data of the entire system being easily intercepted, tampered with, and even forged to control identity devices.

[0071] Preferably, the key generation unit includes: a startup module, used to activate the quantum random number generator when the switch is powered on or reset; a transition module, used to use the quantum random number generator to generate an unpredictable random number sequence as basic data; a generation module, used to convert the random number sequence into a unique key that meets encryption requirements; and a binding module, used to bind the unique key to the hardware identifier of the switch to establish a unique interactive relationship.

[0072] It should be noted that unpredictable random number sequences, such as those generated by a quantum random number generator, possess statistically high entropy. Their output cannot be inferred through algorithms or historical data, making them a reliable basis for encryption key generation. The hardware identifier can be one or more unique physical characteristics of the switch, including the serial number, MAC address, and unique code of the TPM chip. These characteristics are used to establish a binding relationship with the unique key, ensuring the authenticity of the switch device.

[0073] In this embodiment of the present invention, when the switch is powered on or reset, the startup module is triggered, activating the quantum random number generator (QRNG). This module triggers the QRNG initialization process by detecting changes in the switch's voltage threshold or reset signal state, ensuring that the switch enters the secure key generation phase each time it is started. After the startup module is activated, the transition module uses the QRNG to generate an unpredictable random number sequence. This random number sequence, based on the unpredictability of quantum states and photon polarization measurements, directly captures the output of quantum events through hardware circuitry, forming an irregular and non-repeatable raw data stream. This process further enhances randomness through physical isolation and hash functions, ensuring that the entropy of the random number sequence meets encryption standards. The random number sequence output by the transition module is fed into the generation module, which converts it into a unique key that meets specific encryption requirements using a preset AES key derivation function. The generation module adjusts the unique key length and format to 128 or 256 bits based on device authentication and data transmission encryption, ensuring that the generated key meets the requirements of the AES international standard. The unique key output by the generation module is bound to the switch's serial number, MAC address, or the RoT identifier in the TPM chip through the binding module. The binding process is implemented through the TPM secure storage area write protection mechanism, ensuring that the association between the unique key and the hardware identifier cannot be tampered with. After the binding is completed, the switch forms a mapping relationship between the unique hardware identifier and the unique key, which can be used for subsequent trusted authentication or encryption operations.

[0074] Preferably, the startup module specifically executes the steps including:

[0075] Step S11: When the switch detects a power-on or reset signal, the built-in quantum random number generator hardware module is awakened;

[0076] Step S12: The hardware module generates an initial random signal using quantum physics phenomena and completes a self-test;

[0077] Step S13: convert the random number sequence in the initial random signal into a binary key of fixed length and verify its uniqueness;

[0078] Step S14: Bind the unique key to the hardware identification of the switch and write it into a protected storage area.

[0079] In this embodiment of the present invention, when the switch detects a power-on or reset signal, the built-in quantum random number generator hardware module is awakened. This awakening process activates the quantum random number generator by detecting a rising edge in the voltage threshold or a state change triggered by a reset signal, ensuring that the switch enters the secure key generation process each time it is powered on or reset. The hardware module utilizes quantum physics phenomena such as photon polarization measurement and quantum state superposition collapse to generate an initial random signal and complete a self-test. The unpredictability and observation interference characteristics of quantum physics phenomena ensure the high entropy value of the random signal. The self-test process ensures that the generated initial random signal meets encryption standards by testing the stability of the quantum event acquisition circuit, verifying the statistical distribution of the random signal, and verifying the temperature and noise interference operating status of the hardware module. The random number sequence in the initial random signal is converted into a fixed-length unique binary key, and its uniqueness is verified. This conversion process uses the cryptographically secure SHA-256 hash algorithm to compress the high-entropy random number sequence into a key of a preset length of 128 or 256 bits. Uniqueness is verified by detecting the hash collision probability of the unique key, evaluating whether its entropy meets the encryption requirement of ≥128 bits, and comparing it with the device's historical records to ensure that the generated unique key is irreproducible and unique within the current device lifecycle. The generated unique key is bound to the switch's hardware identifier and written to a protected storage area. The binding process uses a cryptographic hash algorithm to combine the unique key and hardware identifier to generate binding data. This data is then written to the switch's non-volatile memory through a hardware-level secure storage mechanism to prevent tampering or unauthorized access to the unique key.

[0080] Preferably, the transition module specifically performs the following steps:

[0081] Step S21: After starting the quantum random number generator, dynamically calibrate the quantum signal source to eliminate environmental interference;

[0082] Step S22: monitoring the quantum polarization direction and converting the specified result of the polarization direction into a binary bit stream;

[0083] Step S23: Divide the continuously generated binary bit stream into segments of fixed length, and add a timestamp or device identifier as metadata to each segment;

[0084] Step S24: perform entropy detection on the metadata, remove low-entropy segments, and retain high-entropy segments as basic data for the unique key.

[0085] It should be noted that entropy testing can be a process of evaluating the randomness strength of data using Shannon entropy and minimum entropy, used to select high-entropy segments as key-based data. Metadata can be timestamps and device identification information attached to binary data segments, used for data traceability and verification.

[0086] In an embodiment of the present invention, after the quantum random number generator is activated, the quantum signal source is dynamically calibrated to eliminate environmental interference. Dynamic calibration involves real-time monitoring of the quantum signal source's operating environment, including temperature, electromagnetic noise, and optical path stability. A feedback control algorithm is then used to adjust the quantum signal source's polarization correction parameters, compensating for the effects of environmental changes on the accuracy of quantum event acquisition. For example, in photon polarization measurements, the calibration process may involve adjusting the polarizer angle or waveplate phase delay to ensure the stability of the quantum signal's polarization state within the measurement basis, thereby improving the reliability of random number generation. The quantum polarization direction is monitored and the resulting polarization direction is converted into a binary bit stream. This measurement of the quantum polarization direction is based on the unpredictable random collapse of the photon polarization state. A polarization-analyzing polarization beam splitter is used to perform a horizontal / vertical basis-selective measurement of the quantum signal. The measurement results are converted into a binary bit stream according to a preset rule, with horizontal polarization corresponding to 0 and vertical polarization corresponding to 1, forming the original random data sequence. This process ensures that the choice of measurement basis matches the superposition characteristics of the quantum state to maximize the randomness of the output. The continuously generated binary bit stream is then segmented into fixed-length segments, with each segment appended with a timestamp or device identifier as metadata. The segmentation process cuts the original binary data into independent data blocks by setting a fixed byte count of 64 bytes per segment. Metadata is added by inserting a unique UTC timestamp identifier before each data segment for subsequent data traceability and verification. Finally, the metadata is subjected to entropy testing, removing low-entropy segments and retaining high-entropy segments as the basis for the unique key. Entropy testing evaluates the randomness strength of each binary data segment by calculating the Shannon entropy or minimum entropy. Low-entropy segments with a value of 0.9 bits / bit are marked and removed. The remaining high-entropy data is further compressed using a hash function to generate unique key base data that meets encryption requirements.

[0087] Preferably, the key storage unit includes: an identification module, which is used to split the unique key into multiple fragments according to a fixed rule and attach a unique identifier to each fragment; a device receiving module, which is used to verify the trusted identity of the target device through a preset device fingerprint or signature, and the receiving end confirms that the storage is successful; a storage module, which is used to asynchronously send the unique identifier to multiple target devices and redundantly store it in each target device; a key recovery module, which sets independent access rights for the target device storing the unique identifier, allowing the unique key to be restored in combination under switch conditions.

[0088] In this implementation, the generated unique key is split into multiple fragments according to a fixed rule, and each fragment is uniquely identified. The splitting rule can be based on fixed-length segments, ensuring that the data volume and storage location of each fragment are unpredictable. This unique identification is implemented using cryptographic hash functions or digital signature technology. The identification information includes the fragment index, generation timestamp, or device fingerprint, which is used for subsequent fragment verification and combined restoration. The trusted identity of the target device is verified using a preset device fingerprint or digital signature, and the receiving end confirms successful storage. The device fingerprint is a combination of the device's hardware serial number, MAC address, and unique encoding of the TPM chip. The digital signature verifies the legitimacy of the target device using a preset public key certificate. After verification, the target device receives the encrypted key fragment and sends the storage result back to the sending end via an encrypted confirmation message. The uniquely identified key fragments are asynchronously sent to multiple target devices and redundantly stored on each target device. Asynchronous transmission is implemented using a distributed communication protocol that supports breakpoint resumption and retransmission mechanisms, ensuring reliable fragment transmission in diverse network environments. Redundant storage is achieved using multiple replica writes or erasure coding technology. Each target device independently stores the complete fragment, and data tampering is prevented through hardware-level encryption in the TPM secure storage area. The key recovery module sets independent access permissions for target devices storing unique identifiers, allowing for the combined recovery of unique keys under unconditional switch triggering. Access permissions are implemented through role-based access control or attribute-based encryption, allowing authorized devices to request key fragments only when pre-defined conditions, such as hardware event triggering or timestamp verification, are met. Unconditional triggering can be activated by a physical button press or power state change. Once triggered, key fragments are exchanged between devices over a secure channel and combined using an aggregation algorithm to recover the full key.

[0089] Preferably, the key recovery module specifically performs the following steps:

[0090] Step S31: Bind the unique identifier of the target device to the physical fingerprint and register it in the access control list of the switch;

[0091] Step S32: Configure independent access rights for each target device and set trigger conditions for restoring the unique key;

[0092] Step S33: When the switch detects a preset physical event, it verifies the fingerprint of the target device and temporarily activates its access rights;

[0093] Step S34: After the permission is activated, the target device extracts the bound unique identifier from the local storage and performs a hash comparison;

[0094] Step S35: When all target devices pass the verification and meet the triggering conditions, the switch starts the combination logic, integrates the unique identifications of each target device in a preset order, and restores the complete unique key.

[0095] In this embodiment of the present invention, the unique identifier of a target device is bound to a physical fingerprint and registered in the switch's access control list. The physical fingerprint is a collection of hardware features of the device. The unique identifier and fingerprint are bound using a cryptographic hash function or digital signature technology to generate binding data. This binding data is transmitted to the switch via a secure communication protocol and written into the access control list. The access control list, stored in a tree structure or hash table, contains mappings between device fingerprints, unique identifiers, access rights, and trigger conditions, ensuring that the switch can quickly retrieve authorization information for the target device. Next, independent access rights are configured for each target device, and trigger conditions for restoring the unique key are set. Access rights are implemented through role-based access control, for example, allowing only specific devices to request key fragments if a physical button press, temperature threshold, or timestamp is met. Trigger conditions are configured using a rules engine or state machine, supporting multiple combinations of conditions, such as "Device A must complete verification within 10 seconds" and "Device B must be in low-power mode," ensuring controllable and secure key recovery. When the switch detects a pre-defined physical event, it verifies the target device's fingerprint and temporarily activates its access rights. Physical events are triggered by the accelerometer, initiating the fingerprint verification process. The verification process compares the fingerprint reported by the device with the binding data in the access control list or verifies the fingerprint's legitimacy using asymmetric encryption. Upon successful verification, the switch temporarily activates access rights for the target device, setting the validity period to 10 seconds and automatically expiring upon expiration to prevent abuse. After activation, the target device retrieves the bound unique identifier from local storage and performs a hash comparison. The local storage uses EEPROM to store the unique identifier in encrypted form. Upon retrieval, the original data is encrypted and decrypted using AES counter mode. The hash comparison verifies data integrity by calculating the hash value of the unique identifier and comparing it with the pre-stored hash value in the access control list. If the comparison fails, the target device refuses to respond to the key request and logs the exception to the security audit area. When all target devices pass verification and the trigger conditions are met, the switch activates the combination logic, combining the unique identifiers of each target device in a pre-set order to recover the complete unique key. This combination logic is implemented using a distributed consensus algorithm to ensure that key fragments are aggregated in a fixed order. For example, at least k valid key fragments (k out of n total fragments) must be collected and the original key recovered using Lagrange interpolation. The restored key is temporarily cached by the hardware encryption engine and immediately used for encryption operations or destroyed to prevent key leakage.

[0096] Preferably, the data transmission unit includes: an instruction generation module, which is used to calculate the first hash value of the control instruction after the terminal device generates the control instruction, bind the first hash value and the second hash value of the unique key as path data, and attach them to the control instruction; an encryption module, which is used to establish a quantum encryption communication channel between the terminal device and the switch; a transmission module, which is used to encrypt the control instruction using a quantum encryption algorithm, generate a ciphertext package, and then send it to the switch through the quantum encryption communication channel; an execution module, which is used to verify whether the path data matches the locally stored second hash value after the switch receives the ciphertext, and decrypt and execute the control instruction if they are consistent.

[0097] In this embodiment of the present invention, when a terminal device generates a control instruction, it calculates a first hash value for the instruction and binds this first hash value to a second hash value of a unique key (previously generated and stored using a quantum random number generator) as path data, which is then appended to the control instruction. The path data is generated using a cryptographic hash function to ensure that the binding between the control instruction and the unique key cannot be tampered with. The terminal device establishes a quantum cryptographic communication channel with the switch. This channel is implemented based on the quantum key distribution protocol. A single-photon source and a photodetector exchange polarization states to generate a shared symmetric key. This key is secured by the non-cloning property of the quantum channel. Key agreement is completed by synchronizing ground state selection information over a TCP / IP channel. After the communication channel is established, both parties use the shared key for subsequent data encryption and decryption operations. The control instruction with the path data appended is encrypted using a quantum cryptography algorithm to generate a ciphertext packet. The encryption process involves symmetric encryption of the control instruction's plaintext and the path data, and the addition of an authentication tag to ensure data integrity and tamper resistance. The ciphertext packet is sent to the switch via the established quantum cryptographic communication channel. Transmission utilizes segmented transmission and the TCP protocol to ensure data reliability. After receiving the ciphertext packet, the switch first verifies whether the first hash value in the path data matches the second hash value of the locally stored unique key. This verification process compares the hash values byte by byte for consistency. If they match, the control instruction and the bound unique key are valid. After verification, the switch decrypts the ciphertext packet using the shared key and extracts the original control instruction. The decrypted instruction triggers the switch to start and switch state through logical analysis. If the path data verification fails, the switch discards the ciphertext packet and logs the exception to the security audit area.

[0098] Preferably, the encryption module specifically executes the steps including:

[0099] Step S41: The terminal device sends a low-intensity quantum signal to the switch to detect whether the switch has quantum communication capability.

[0100] Step S42: The terminal device exchanges a device fingerprint based on a quantum state with the switch;

[0101] Step S43: Synchronously generate a pair of temporary keys through a quantum random number generator, and synchronously generate a consistent shared key through device fingerprint comparison;

[0102] Step S44: After the terminal device confirms the shared key synchronization with the switch, it generates a quantum encryption communication mode and locks the non-encrypted communication interface.

[0103] In this embodiment of the present invention, a terminal device sends a low-intensity quantum signal to a switch to mutually detect whether they have quantum communication capability. The low-intensity quantum signal is generated by a single-photon source laser, namely, a single-photon pulse with a wavelength of 1550nm. The polarization state of the photons encodes the unique terminal device code. The signal is transmitted to the switch via optical fiber or a free-space channel, where the switch detects the quantum state characteristics of the signal using a single-photon detector. If both parties can correctly decode the other's quantum state information, quantum communication capability is determined; otherwise, the switch falls back to classical communication mode. This process prevents intermediaries from forging the capability detection signal by leveraging the non-cloning property of quantum states. The terminal device and the switch exchange device fingerprints based on quantum states. Device fingerprints are generated using quantum state encoding, for example, using the BB84 protocol's four-state encoding (horizontal / vertical, +45° / -45° polarization states) or six-state encoding (horizontal / vertical, +45° / -45°, left-handed / right-handed polarization states). The terminal device's fingerprint characteristics are mapped to a sequence of quantum bits. Both parties generate their own device fingerprint quantum states and exchange them over the quantum channel. The receiving end extracts the fingerprint information through ground state selection and measurement. If the fingerprint information of both parties passes the quantum state fidelity test, the device's identity is verified. This process leverages the non-replicability of quantum states to ensure tamper-proof fingerprint data. A pair of temporary keys are synchronously generated using a quantum random number generator, and a consistent shared key is generated through device fingerprint comparison. The quantum random number generator generates a true random number sequence based on the timing jitter of the photodetector, which is used to generate temporary keys A and B, respectively. The consistency of the temporary keys is verified by device fingerprint comparison. For example, the fingerprint information is hashed with the temporary key and the hash value is transmitted over the quantum channel for comparison. If the comparison is consistent, a shared key is generated using the quantum key distribution protocol. This process leverages the characteristics of quantum state entanglement to ensure the synchronization and anti-eavesdropping of the shared key. After the terminal device confirms the synchronization of the shared key with the switch, it initiates quantum encryption communication mode and locks the non-encrypted communication interface. During the confirmation process, a hash digest of the shared key is transmitted over the classical channel, and both parties compare the hash values for consistency. If they match, quantum encryption communication mode is enabled, using the shared key to encrypt subsequent data. Simultaneously, hardware logic circuits lock the non-encrypted interface, shutting down Ethernet or serial communication to prevent unauthorized access. This process ensures that the mode switch is irreversible through a secure boot chip, guaranteeing complete isolation of the communication link.

[0104] Preferably, the specific steps of step S41 include:

[0105] Step S411: The terminal device transmits a low-intensity single-photon pulse to the switch, and detects whether the single-photon pulse can reach the switch and return a reflected single-photon pulse;

[0106] Step S142: After receiving the single photon pulse, the switch generates a corresponding quantum state response signal using the built-in quantum detector and returns it to the terminal device;

[0107] Step S143: The terminal device compares the quantum state response signal of the reflected single-photon pulse with the received feedback signal to verify whether the quantum communication capability is normal.

[0108] In this implementation, a terminal device transmits a low-intensity single-photon pulse to a switch, detects whether the pulse reaches the switch, and returns a reflected single-photon pulse. The low-intensity single-photon pulse is generated by a weakly coherent laser, with an average photon count controlled to approximately 0.1 to reduce the probability of multiphotons and avoid null pulses that reduce communication efficiency. The transmitted single-photon pulse is transmitted to the switch via an optical fiber or free-space channel. The switch then transmits some photons back to the terminal device via a photodetector. The terminal device uses the single-photon detector to detect the presence of the reflected signal and its timing jitter within 10 picoseconds. If a valid reflected pulse is detected, the channel is deemed capable of basic quantum communication. After receiving the single-photon pulse, the switch generates a corresponding quantum state response signal using its built-in quantum detector and returns it to the terminal device. After receiving the single-photon pulse, the switch's built-in quantum detector generates a corresponding quantum state response signal using a basis state selection strategy, randomly selecting horizontal / vertical or +45° / -45° polarization state measurement basis to generate the quantum state response signal. For example, the switch can adjust the polarization reversal of its response signal based on the polarization state of the received single photon and transmit the response signal back to the terminal device via the quantum channel. This process leverages the non-cloning nature of quantum states to prevent intermediaries from forging response signals, ensuring the reliability of communication capability verification. The terminal device compares the quantum state response signals of the reflected single-photon pulse with the received feedback signal to verify the integrity of the quantum communication link. The terminal device verifies the integrity of the communication link by calculating the quantum state coincidence between the reflected pulse and the response signal. For example, if the switch response signal is horizontally polarized, the terminal device measures whether the reflected pulse is in the corresponding polarization state. If the fidelity exceeds a preset threshold of 99%, the quantum communication link is deemed to be functioning properly. Otherwise, the communication link is deemed to be eavesdropped or the device is malfunctioning. This process leverages the non-cloning nature of quantum states and the randomness of the ground state to achieve dynamic verification of communication capability.

[0109] Preferably, the key updating unit specifically performs the following steps:

[0110] Step S51: trigger the new key generation process within a preset time and prepare the storage space required to replace the old key;

[0111] Step S52: Generate a new key using a quantum random number generator, and bind the new key to the identifier of the original unique key to form a mapping relationship;

[0112] Step S53: Write the new key to the storage location of the original unique key, and verify whether the replaced new key can be used for communication or encryption functions normally;

[0113] Step S54: Record the unique key replacement event in the log, where the event includes a timestamp, the original unique key identifier, the new key identifier, and the operation result.

[0114] It should be noted that the timestamp includes the time format (2025-05-30T18:08:50Z), accurate to milliseconds; the original unique key identifier includes a 128-bit identifier; the new key identifier: a 256-bit key fingerprint;

[0115] The operation result includes a binary flag (0 = failure, 1 = success) and "quantum communication verification passed." The log is synchronized to the remote audit server through the secure audit interface and digitally signed to prevent log forgery.

[0116] In an embodiment of the present invention, a new key generation process is triggered within a preset time, and the storage space required to replace the old key is prepared. The preset time is triggered by the system clock, for example, every 72 hours or after the key has been accessed more than 100,000 times. Preparing the storage space involves reserving an unused key slot in the encryption storage unit (reserving a free AES-256 key storage address) and marking the slot as "pending for writing" using a memory mapping table. A new key is generated using a quantum random number generator (QRG) and bound to the identifier of the original unique key to form a mapping relationship. The QRG generates a true random number sequence based on quantum vacuum fluctuations and generates a 256-bit key using the SHA-256 algorithm. The generated new key is associated with the original unique key identifier via a hash table, for example, storing the original unique key identifier as the key and the new key as the value. This binding relationship is protected by a cryptographic hash function to prevent tampering of the mapping data. This process is performed by a TPM chip, ensuring the isolation and security of the generation and binding operations. The new key is written to the storage location of the original unique key, and the replacement key is verified for proper communication or encryption functions. Write operations are performed using atomic replace instructions. For example, in the TPM chip, the contents of the original unique key slot are replaced with the new key and the binding table is updated. The verification process includes: ① performing encryption / decryption tests using the new key (such as AES counter mode encryption test data packet); ② sending a test message and receiving a response via a quantum cryptographic communication channel, specifically sending a low-intensity single-photon pulse and verifying the quantum state response signal. If the test succeeds, the new key is confirmed to be usable; if it fails, the old key is rolled back and the exception is logged. This process uses a hardware watchdog timer to monitor operation timeouts to prevent inconsistent key states due to device failures. Unique key replacement events are recorded in a log, which includes a timestamp, the original unique key identifier, the new key identifier, and the operation result. Logging is implemented using a tamper-proof storage mechanism.

[0117] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A wireless intelligent switch for use with encrypted data, characterized in that: It includes a key generation unit, a key storage unit, a data transmission unit and a key update unit; The key generation unit is used to generate a unique key using a quantum random number generator when the switch is activated, and the unique key establishes a unique interactive relationship with the switch; The key storage unit is used to distribute and store the unique key in a plurality of trusted terminal devices interconnected by the switch; The data transmission unit is used to send instructions to the switch through the terminal device, encrypt the instructions using a quantum encryption algorithm, and append a hash value of the unique key; The key updating unit is configured to generate a new key corresponding to the unique key within a preset time, replace the unique key, and record the event of replacing the unique key.

2. The wireless intelligent switch for use with encrypted data according to claim 1, characterized in that: The key generation unit includes: A startup module, configured to activate the quantum random number generator when the switch is powered on or reset; A transition module, configured to generate an unpredictable random number sequence using the quantum random number generator as basic data; A generating module, configured to convert the random number sequence into the unique key that meets encryption requirements; The binding module is used to bind the unique key with the hardware identification of the switch to establish a unique interactive relationship.

3. The wireless intelligent switch for use with encrypted data according to claim 2, characterized in that: The specific execution steps of the startup module include: Step S11: When the switch detects a power-on or reset signal, the built-in quantum random number generator hardware module is awakened; Step S12: The hardware module generates an initial random signal using quantum physics phenomena and completes a self-test; Step S13: converting the random number sequence in the initial random signal into a binary key of fixed length, and verifying its uniqueness; Step S14: Bind the unique key to the hardware identification of the switch and write it into a protected storage area.

4. The wireless intelligent switch for use with encrypted data according to claim 3, characterized in that: The specific execution steps of the transition module include: Step S21: After starting the quantum random number generator, dynamically calibrate the quantum signal source to eliminate environmental interference; Step S22: monitoring the quantum polarization direction, and converting the specified result of the polarization direction into a binary bit stream; Step S23: Divide the continuously generated binary bit stream into segments of fixed length, and add a timestamp or device identifier as metadata to each segment; Step S24: perform entropy detection on the metadata, remove low-entropy segments, and retain high-entropy segments as basic data for the unique key.

5. The wireless intelligent switch for use with encrypted data according to claim 1, characterized in that: The key storage unit includes: an identification module, configured to split the unique key into multiple segments according to a fixed rule and attach a unique identification to each segment; The device receiving module is used to verify the trusted identity of the target device through the preset device fingerprint or signature, and the receiving end confirms the successful storage; a storage module, configured to asynchronously send the unique identifier to the plurality of target devices and store the unique identifier redundantly in each of the target devices; The key restoration module sets an independent access permission for the target device storing the unique identifier, allowing the unique key to be restored in combination under the switch unless condition.

6. The wireless intelligent switch for use with encrypted data according to claim 1, characterized in that: The key recovery module specifically performs the following steps: Step S31: Bind the unique identifier of the target device to the physical fingerprint and register it in the access control list of the switch; Step S32: configuring independent access rights for each target device and setting a trigger condition for restoring the unique key; Step S33: When the switch detects a preset physical event, it verifies the fingerprint of the target device and temporarily activates its access rights; Step S34: After the permission is activated, the target device extracts the bound unique identifier from the local storage and performs a hash comparison; Step S35: When all the target devices pass the verification and meet the triggering conditions, the switch starts the combination logic, integrates the unique identifications of the target devices in a preset order, and restores the complete unique key.

7. The wireless intelligent switch for use with encrypted data according to claim 1, characterized in that: The data transmission unit includes: an instruction generation module, configured to calculate a first hash value of the control instruction after the terminal device generates the control instruction, bind the first hash value with a second hash value of the unique key as path data, and append the data to the control instruction; An encryption module, used for establishing a quantum encryption communication channel between the terminal device and the switch; a transmission module, configured to encrypt the control instruction using a quantum encryption algorithm, generate a ciphertext packet, and send the packet to the switch via the quantum encryption communication channel; The execution module is used for verifying whether the path data matches the second locally stored hash value after the switch receives the ciphertext, and decrypting and executing the control instruction if they are consistent.

8. The wireless intelligent switch for use with encrypted data according to claim 7, characterized in that: The encryption module specifically performs the following steps: Step S41: The terminal device sends a low-intensity quantum signal to the switch to detect whether the switch has quantum communication capability. Step S42: The terminal device exchanges a device fingerprint based on a quantum state with the switch; Step S43: Synchronously generate a pair of temporary keys through the quantum random number generator, and synchronously generate a consistent shared key through the device fingerprint comparison; Step S44: After the terminal device confirms the synchronization of the shared key with the switch, it generates the quantum encryption communication mode and locks the non-encrypted communication interface.

9. The wireless intelligent switch for use with encrypted data according to claim 8, characterized in that: The specific steps of step S41 include: Step S411: The terminal device transmits a low-intensity single-photon pulse to the switch, and detects whether the single-photon pulse can reach the switch and return a reflected single-photon pulse; Step S142: After receiving the single photon pulse, the switch generates a corresponding quantum state response signal using a built-in quantum detector and returns the signal to the terminal device; Step S143: The terminal device compares the reflected single-photon pulse with the quantum state response signal of the received feedback signal to verify whether the quantum communication capability is normal.

10. The wireless intelligent switch for use with encrypted data according to claim 1, characterized in that: The key updating unit specifically performs the following steps: Step S51: trigger the new key generation process within a preset time and prepare the storage space required to replace the old key; Step S52: Generate the new key using the quantum random number generator, and bind the new key to the identifier of the original unique key to form a mapping relationship; Step S53: writing the new key into the storage location of the original unique key, and verifying whether the replaced new key can be used normally for communication or encryption functions; Step S54: Record the unique key replacement event in a log, wherein the event includes a timestamp, the original unique key identifier, the new key identifier, and an operation result.

Images