Data transmission method, electronic equipment and readable storage medium

Abstract

The invention discloses a data transmission method, electronic equipment and a readable storage medium, and the method comprises the steps: transmitting a first message to a server through a pre-established communication tunnel, the first message being used for requesting to query a second quantum key matched with a first quantum key in a second storage medium, the first quantum key is acquired by the client from a first storage medium; a second message fed back by the server for the first message is received, the second message comprises a consistency judgment result, and the consistency judgment result is used for indicating whether a second quantum key exists or not; under the condition that the consistency judgment result is that the main key exists, determining that the main key is a first quantum key; generating a master key according to the handshake key under the condition that the consistency judgment result is that the handshake key does not exist; and performing encrypted data transmission with the server through the target session key.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a data transmission method, an electronic device, and a readable storage medium. Background Art

[0002] Quantum Key Distribution (QKD) leverages the properties of quantum mechanics to ensure secure communications. It enables communicating parties to generate and share a random, secure key to encrypt and decrypt messages. Compared to traditional public-key cryptography, QKD is more secure and unbreakable. If eavesdropped, both communicating parties can detect and replace the key. However, the current Secure Sockets Layer (SSL) protocol and browsers do not yet fully support quantum keys, and the inability to use quantum keys will affect service availability. Summary of the Invention

[0003] The embodiments of the present application provide a data transmission method, an electronic device, and a readable storage medium, which can solve the problem of how to ensure the availability of services when quantum keys cannot be used.

[0004] In order to solve the above technical problems, this application is implemented as follows:

[0005] In a first aspect, a data transmission method is provided, which is applied to a client, comprising: sending a first message to a server through a pre-established communication tunnel, wherein the first message is used to request a query for a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium; receiving a second message fed back by the server in response to the first message, wherein the second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether the second quantum key exists; if the consistency judgment result is yes, determining that the master key is the first quantum key; if the consistency judgment result is no, generating the master key according to a handshake key, wherein the handshake key is generated based on a first shared key, the first shared key is generated based on the first message and the second message using a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client, and the second message includes the target post-quantum algorithm; and performing encrypted data transmission with the server using a target session key, wherein the target session key is generated based on the master key.

[0006] In a second aspect, a data transmission method is provided, which is applied to a server, comprising: receiving a first message sent by a client through a pre-established communication tunnel, wherein the first message is used to request a query for a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium; performing a consistency judgment on the first quantum key and each quantum key in the second storage medium to obtain a consistency judgment result; feeding back a second message to the client in response to the first message, wherein the second message includes the consistency judgment result, and the consistency judgment result is used to indicate whether the second quantum key exists; if the consistency judgment result is yes, determining that the master key is the first quantum key or the second quantum key; if the consistency judgment result is no, generating the master key according to a handshake key, wherein the handshake key is generated based on a second shared key, the second shared key is generated based on the first message and the second message by using a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, and the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client; and performing encrypted data transmission with the client using a target session key, wherein the target session key is generated based on the master key.

[0007] In a third aspect, an electronic device is provided, comprising a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0008] In a fourth aspect, a readable storage medium is provided, in which at least one computer program is stored. The computer program is loaded and executed by a processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0009] In a fifth aspect, a computer program product is provided, which includes at least one computer program, and the computer program is loaded and executed by a processor to implement the steps of the method described in the first aspect above, or to implement the steps of the method described in the second aspect above.

[0010] In the present application, a first message is sent to a server through a pre-established communication tunnel to request a consistency judgment of a quantum key, wherein the first message is used to request a query of a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium, and then a second message is received from the server in response to the first message, wherein the second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether there is a second quantum key; if the consistency judgment result is that it exists, the master key is determined to be the first quantum key; if the consistency judgment result is that it does not exist, the master key is generated according to the handshake key, wherein the handshake key is generated based on a first shared key, and the first shared key is generated according to the target post-quantum algorithm based on the first message and the second message, and the first message includes at least one post-quantum key supported by the client. Key algorithm, the target post-quantum algorithm is determined by the server from the post-quantum key algorithms supported by at least one client, and the second message includes the target post-quantum algorithm; encrypted data is transmitted with the server through the target session key, wherein the target session key is generated based on the master key, and the traditional browser is adapted through the encrypted tunnel agent, and when the storage media corresponding to the communicating parties can transmit quantum keys and the key storage capacity can meet the requirements of the SSL protocol, the quantum key is used to replace the key of the SSL protocol in the encrypted tunnel, so that the encrypted tunnel communication has higher security; at the same time, when the communicating parties cannot obtain the quantum key or the key storage capacity cannot meet the requirements or the quantum keys held by both parties are inconsistent, the post-quantum cryptographic algorithm, as the key negotiation algorithm of the SSL protocol in the encrypted tunnel, can also ensure the anti-quantum attack performance of the encrypted tunnel communication when the quantum key is not used, thereby ensuring the availability of the service. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0012] Figure 1 A schematic diagram of a data transmission method according to an exemplary embodiment of the present application is shown;

[0013] Figure 2 A schematic diagram of deploying an encryption tunnel agent provided by an exemplary embodiment of the present application is shown;

[0014] Figure 3 Another deployment diagram of an encryption tunnel agent provided by an exemplary embodiment of the present application is shown;

[0015] Figure 4 A flowchart of another data transmission method provided by an exemplary embodiment of the present application is shown;

[0016] Figure 5 A schematic structural diagram of a data transmission system provided by an exemplary embodiment of the present application is shown;

[0017] Figure 6 is a specific application diagram of a data transmission system according to an exemplary embodiment of the present application;

[0018] Figure 7 A schematic structural diagram of an electronic device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0019] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0020] Figure 1 A flow chart of a data transmission method in an embodiment of the present application is shown, which can be executed by a client. Figure 1 As shown, the method may include the following steps.

[0021] S110: Send a first message to the server through the pre-established communication tunnel.

[0022] The first message is used to request a query for a second quantum key matching the first quantum key in the second storage medium, and the first quantum key is obtained by the client from the first storage medium.

[0023] It is understandable that before sending the first message to the server through the pre-established communication tunnel, it may also include: requesting the first quantum key from the first storage medium. The quantum key distribution network generates the target quantum key and its corresponding serial number (key reading identifier) ​​through the quantum key agreement protocol (BB84 / B92 / TF-QKD), and stores them in the first storage medium (for use by the client) and the second storage medium (for use by the server) respectively. The client and the server obtain and confirm the pre-issued target quantum key through key agreement in order to carry out secure communication and data exchange. This method can ensure the security and integrity of the key, avoid key leakage or tampering, and thus ensure the security of communication. Among them, the first storage medium and the second storage medium can be physical media for storing keys, which can be hardware devices (such as chips, smart cards, USB-KEY storage devices) or software storage (such as databases, file systems). The first storage medium can interact with the client to assign the first quantum key to the client, and the second storage medium can interact with the server to assign the second quantum key to the server. In addition, the client can be a browser and the server can be a web server. The client may be a client that is unable to perform Transport Layer Security (TLS) or SSL communication, and the server may be a server that is unable to perform TLS or SSL communication.

[0024] S120: Receive a second message fed back by the server in response to the first message.

[0025] The second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether the second quantum key exists.

[0026] It can be understood that by sending a first message to the server to request consistency judgment of the quantum key, the server determines the consistency judgment result based on the first message sent by the client, and feeds back the consistency judgment result to the client.

[0027] S130: If the consistency judgment result is yes, determine that the master key is the first quantum key.

[0028] With the continuous development of quantum computing, the security of traditional SSL protocols is being challenged. However, the quantum keys generated by QKD networks are more secure than current traditional public key cryptography. Quantum secure communication is based on the principles of quantum mechanics and is carried out through a quantum key distribution network. QKD is the process by which two communicating parties negotiate and generate a shared key based on the QKD protocol. Because quantum information is unclonable—it cannot be copied or measured without destroying its state—eavesdropping is immediately detectable, and the generated key is theoretically unconditionally secure. Therefore, quantum keys can be applied to SSL protocols and encrypted tunnel communications, making them resistant to quantum attacks.

[0029] S140: When the consistency judgment result is non-existent, generate the master key according to the handshake key.

[0030] The handshake key is generated based on a first shared key, the first shared key is generated based on the first message and the second message through a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client, and the second message includes the target post-quantum algorithm.

[0031] For the above S130 and S140, it can be understood that if the consistency judgment result is existence, it means that there is a second quantum key matching the first quantum key in the second storage medium, and the quantum key can be used for encrypted communication, then the master key can be determined to be the first quantum key or the second quantum key; if the consistency judgment result is non-existence, it means that there is no second quantum key matching the first quantum key in the second storage medium, that is, the quantum key cannot be used for encrypted communication, then the first shared key can be generated according to the first message and the second message, and then the handshake key handshake_key is generated using the first shared key as the key material, and then the master key is determined to be the handshake key. It should be noted that the generation of the first shared key is based on the target post-quantum cryptographic algorithm. Among them, the post-quantum key algorithm supported by the client refers to the post-quantum key algorithm supported by the client for generating keys, such as FRODO and KYBER; the target post-quantum key algorithm refers to the algorithm for generating keys determined by the server from the post-quantum key algorithm supported by the client. In other words, the server selects one of the post-quantum cryptographic algorithms supported by at least one client as the target post-quantum cryptographic algorithm. This information is communicated to the client via a second message, indicating that the client can generate the first shared key based on the target post-quantum cryptographic algorithm. Post-quantum cryptographic algorithms primarily implement encryption through mathematical properties such as lattice structures, coding theory, and polynomials. The difficulty of solving mathematical problems ensures algorithmic security, thus providing some resistance to quantum computer attacks. Therefore, post-quantum algorithms can also be applied to SSL protocols and encrypted tunnel communications, making them resistant to quantum attacks.

[0032] S150: Encrypt data transmission with the server using the target session key.

[0033] The target session key is generated based on the master key.

[0034] It is understandable that the master key is determined based on the quantum key or the handshake key generated based on post-quantum cryptography, which is itself secure. However, in order to use it in traditional communication systems, for example, clients and servers that cannot perform TLS or SSL communication themselves, the quantum key needs to be converted into a classical session key for encryption and decryption operations. This can fully utilize the security of quantum keys or post-quantum algorithms and apply them to traditional encrypted communications, thereby achieving a higher level of communication security.

[0035] In another implementation, when the consistency determination result is yes, it can be determined that the target session key is the first quantum key.

[0036] In the present application, a first message is sent to a server through a pre-established communication tunnel to request a consistency judgment of a quantum key, wherein the first message is used to request a query of a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium, and then a second message is received from the server in response to the first message, wherein the second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether there is a second quantum key; if the consistency judgment result is that it exists, the master key is determined to be the first quantum key; if the consistency judgment result is that it does not exist, the master key is generated according to the handshake key, wherein the handshake key is generated based on a first shared key, and the first shared key is generated according to the target post-quantum algorithm based on the first message and the second message, and the first message includes at least one post-quantum key supported by the client. Key algorithm, the target post-quantum algorithm is determined by the server from the post-quantum key algorithms supported by at least one client, and the second message includes the target post-quantum algorithm; encrypted data is transmitted with the server through the target session key, wherein the target session key is generated based on the master key, and the traditional browser is adapted through the encrypted tunnel agent, and when the storage media corresponding to the communicating parties can transmit quantum keys and the key storage capacity can meet the requirements of the SSL protocol, the quantum key is used to replace the key of the SSL protocol in the encrypted tunnel, so that the encrypted tunnel communication has higher security; at the same time, when the communicating parties cannot obtain the quantum key or the key storage capacity cannot meet the requirements or the quantum keys held by both parties are inconsistent, the post-quantum cryptographic algorithm, as the key negotiation algorithm of the SSL protocol in the encrypted tunnel, can also ensure the anti-quantum attack performance of the encrypted tunnel communication when the quantum key is not used, thereby ensuring the availability of the service.

[0037] In one implementation, the first message further includes a first random number corresponding to the first quantum key, at least one protocol version supported by the client, a first public key, a current session identifier, and at least one compression method supported by the client.

[0038] Regarding the first random number corresponding to the first quantum key, it can be understood that, in order to better protect quantum key information during communication, the quantum key can be converted into a random number to ensure the confidentiality of data transmission. The protocol version supported by the client refers to the security protocol supported by the client for encrypted internet communications during communication with the server, for example, TLS 1.3. The first public key can be a key_share. The client can generate the first public key in advance and send it to the server during the handshake process, so that the server can select the appropriate key exchange algorithm based on the first public key provided by the client, thereby improving handshake efficiency and security. The current session identifier is used by the server to identify and track the current session. The session identifier can be a unique identifier, such as a session ID, used to identify and distinguish different sessions throughout the session. By carrying the session identifier, the server can accurately associate the client's first message with a specific session, thereby ensuring the consistency and accuracy of communication. The compression method supported by the client refers to the method used to compress the key. Key compression can reduce key length, improve encryption efficiency, and maintain encryption security. Optionally, the first message may also include a cipher suite.

[0039] Furthermore, in one implementation, the second message also includes a target protocol version, a second public key, the current session identifier, and a target compression method, wherein at least one protocol version supported by the client includes the target protocol version, and at least one compression method supported by the client includes the target compression method. The target protocol version refers to the security protocol used to encrypt Internet communications during communication, as determined by the server from the protocol versions supported by the client; the second public key may be key_share, which the server may have generated in advance; and the target compression method refers to the method used to compress the key, as determined by the server from the compression methods supported by the client.

[0040] In one implementation, before encrypting data with the server using the target session key, the method further includes the following steps:

[0041] Step 1: Encrypt the first message and the second message using the master key to obtain first encrypted data.

[0042] Step 2: Send a third message to the server through the communication tunnel, wherein the third message is used to request a consistency check between the first encrypted data and the second encrypted data generated by the server.

[0043] Step 3: Receive a fourth message fed back by the server in response to the third message, wherein the fourth message is used to indicate a consistency check result between the first encrypted data and the second encrypted data.

[0044] Regarding steps 1 to 3 above, it can be understood that the client encrypts the handshake phase data, namely the first message and the second message, using the master key master_key to obtain the first encrypted information, and then calculates the MAC value of the first encrypted information to obtain the first encrypted data. Similarly, the server uses its own master key master_key to calculate the MAC value, namely the second encrypted data, and compares it with the client to perform a consistency check with the client's master_key to check whether the master keys on both ends are consistent.

[0045] Step 4: When the consistency check result is consistent, generate the target session key based on the master key.

[0046] It is understandable that after the consistency, the target session key can be generated through the master key master_key for subsequent SSL encrypted communication.

[0047] In this implementation, the communicating parties can verify each other's keys during the key negotiation process, ensuring that the keys they use are consistent. This avoids security issues caused by inconsistent keys during subsequent communications and ensures communication security.

[0048] In one implementation, before sending the first message to the server through the pre-established communication tunnel, the method further includes: establishing the communication tunnel based on the encryption tunnel client component installed on the client and the encryption tunnel server component installed on the server.

[0049] It is understandable that since traditional SSL protocols, browsers, and servers cannot yet support quantum keys and post-quantum cryptographic algorithms well, an encrypted tunnel proxy can be used to provide an SSL-based secure encrypted connection that supports quantum keys and post-quantum cryptographic algorithms, thereby adapting to traditional browsers and servers and achieving secure communications that are resistant to quantum computing. Among them, an encrypted tunnel proxy refers to building a secure tunnel between the client and the server, during which the data passing through will be encrypted using the SSL protocol. By monitoring the corresponding port of the client, the client's data packet (such as HTTP request) is forwarded to the server, and the returned information is fed back to the client. Figure 2 As shown in FIG, a deployment diagram of an encryption tunnel agent, in another implementation, as Figure 3 As shown in the figure, the server-side web application and the encrypted tunnel server are integrated. This allows quantum key encryption communication or the use of PQC to negotiate keys to resist quantum computing attacks without changing the browser, even if the current browser does not support quantum keys and PQC algorithms.

[0050] Figure 4 A flow chart of a data transmission method in an embodiment of the present application is shown, which can be executed by a server. Figure 4 As shown, the method may include the following steps.

[0051] S410: Receive a first message sent by a client through a pre-established communication tunnel.

[0052] The first message is used to request a query for a second quantum key matching the first quantum key in the second storage medium, and the first quantum key is obtained by the client from the first storage medium.

[0053] in, Figure 4 The embodiment shown is Figure 1 Corresponding to the embodiment shown, regarding the first storage medium and the second storage medium, reference can be made to Figure 1 The detailed description of the illustrated embodiments will not be repeated here.

[0054] S420: Perform consistency determination on the first quantum key and each quantum key in the second storage medium to obtain a consistency determination result.

[0055] It is understandable that before receiving the first message sent by the client through the pre-established communication tunnel, it may also include: sending a quantum key extraction request to the second storage medium, traversing the key pool in the second storage medium according to the first quantum key received from the client to find a set of corresponding quantum keys and perform consistency judgment.

[0056] In one implementation, performing consistency determination on the first quantum key and each quantum key in the second storage medium to obtain a consistency determination result may include: determining that the consistency determination result is "yes" if the second quantum key consistent with the first quantum key exists in the second storage medium; and determining that the consistency determination result is "no" if the second quantum key consistent with the first quantum key does not exist in the second storage medium. It is understood that if the second quantum key exists in the key pool in the second storage medium, the consistency determination result is "yes", and if the second quantum key does not exist in the key pool in the second storage medium, the consistency determination result is "no".

[0057] S430: Feedback a second message to the client in response to the first message.

[0058] The second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether the second quantum key exists.

[0059] It is understandable that after the server determines the consistency determination result, it feeds back a second message to the client to inform the client of the consistency determination result.

[0060] S440: If the consistency judgment result is yes, determine that the master key is the first quantum key or the second quantum key.

[0061] It should be noted that if the consistency judgment result is existence, it means that the first quantum key and the second quantum key are consistent, and the server can determine that the master key is the first quantum key or the second quantum key.

[0062] S450: When the consistency judgment result is non-existent, generate the master key according to the handshake key.

[0063] The handshake key is generated based on a second shared key, the second shared key is generated based on the first message and the second message through a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, and the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client.

[0064] For the above S440 and S450, it can be understood that if the consistency judgment result is existence, it means that there is a second quantum key matching the first quantum key in the second storage medium, and the quantum key can be used for encrypted communication. Then the master key can be determined to be the first quantum key or the second quantum key; if the consistency judgment result is non-existent, it means that there is no second quantum key matching the first quantum key in the second storage medium, that is, the quantum key cannot be used for encrypted communication. Then, a second shared key can be generated based on the first message and the second message, and then the handshake key handshake_key is generated using the second shared key as the key material, and then the master key is determined to be the handshake key. It should be noted that the generation of the second shared key is based on the target post-quantum cryptographic algorithm, wherein the post-quantum key algorithm supported by the client refers to the post-quantum key algorithm supported by the client for generating keys, such as FRODO and KYBER; the target post-quantum key algorithm refers to the algorithm for generating keys determined by the server from the post-quantum key algorithms supported by the client. That is, the server selects one of the post-quantum key algorithms supported by at least one client as the target post-quantum key algorithm, and can be based on the target post-quantum cryptographic algorithm when generating the second shared key.

[0065] S460: Encrypt data transmission with the client using the target session key.

[0066] The target session key is generated based on the master key.

[0067] It is understandable that the master key is determined based on the quantum key or the handshake key generated based on post-quantum cryptography, which is itself secure. However, in order to use it in traditional communication systems, for example, clients and servers that cannot perform TLS or SSL communication themselves, the quantum key needs to be converted into a classical key for encryption and decryption operations. This can fully utilize the security of the quantum key and apply it to traditional encrypted communications, thereby achieving a higher level of communication security.

[0068] In the present application, a first message sent by a client is first received through a pre-established communication tunnel, wherein the first message is used to request a query on a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium. Then, the first quantum key is judged for consistency with each quantum key in the second storage medium to obtain a consistency judgment result, and then a second message is fed back to the client for the first message, wherein the second message includes a consistency judgment result, and the consistency judgment result is used to indicate whether the second quantum key exists; if the consistency judgment result is that the second quantum key exists, the master key is determined to be the first quantum key or the second quantum key; if the consistency judgment result is that the master key does not exist, the master key is generated according to the handshake key, wherein the handshake key is generated based on the second shared key, and the second shared key is generated based on the first message and the second message through the target post-quantum algorithm. The first message includes at least one post-quantum key algorithm supported by the client. The target post-quantum algorithm is determined by the server from the post-quantum key algorithm supported by at least one client. Finally, the target session key is used to encrypt data transmission with the client, wherein the target session key is generated based on the master key, and the existing browser is adapted through the encrypted tunnel agent. When the storage media corresponding to the communicating parties can transmit quantum keys and the key storage capacity can meet the requirements of the SSL protocol, the quantum key is used to replace the key of the SSL protocol in the encrypted tunnel, so that the encrypted tunnel communication has higher security. When the communicating parties cannot obtain the quantum key or the key storage capacity cannot meet the requirements or the quantum keys held by both parties are inconsistent, the post-quantum cryptographic algorithm, as the key negotiation algorithm of the SSL protocol in the encrypted tunnel, can also ensure the anti-quantum attack performance of the encrypted tunnel communication when the quantum key is not used, thereby ensuring the availability of the service.

[0069] In one implementation, the first message further includes a first random number corresponding to the first quantum key, at least one protocol version supported by the client, a first public key, a current session identifier, and at least one compression method supported by the client.

[0070] Furthermore, in one implementation, the second message also includes a target protocol version, a second public key, the current session identifier, the target post-quantum key algorithm, and a target compression method, wherein at least one protocol version supported by the client includes the target protocol version, and at least one compression method supported by the client includes the target compression method.

[0071] For the first and second messages above, please refer to Figure 1 The detailed description of the illustrated embodiments will not be repeated here.

[0072] In one implementation, before encrypting data with the client using the target session key, the method may further include the following steps:

[0073] Step 1: Encrypt the first message and the second message using the master key to obtain second encrypted data.

[0074] Step 2: Receive a third message sent by the client through the communication tunnel, wherein the third message is used to request a consistency check between the first encrypted data generated by the client and the second encrypted data.

[0075] Step 3: Based on the consistency check result of the first encrypted data and the second encrypted data, a fourth message is fed back to the client, wherein the fourth message is used to indicate the consistency check result of the first encrypted data and the second encrypted data.

[0076] Step 4: When the consistency check result is consistent, generate the target session key based on the master key.

[0077] For steps 1 to 4 above, please refer to Figure 1 The relevant descriptions in the illustrated embodiments will not be repeated here.

[0078] In one implementation, before receiving the first message sent by the client through the pre-established communication tunnel, the method further includes: establishing the communication tunnel based on an encryption tunnel client component installed on the client and an encryption tunnel server component installed on the server.

[0079] For this implementation, please refer to Figure 1 The relevant descriptions in the illustrated embodiments will not be repeated here.

[0080] Based on the above embodiments, the present application also provides a data transmission system, such as Figure 5As shown, a schematic diagram of a data transmission system provided by an embodiment of the present application, the data transmission system includes a client, a web server, a quantum key distribution network, a first quantum key distribution device, and a second quantum key distribution device, wherein the quantum key distribution network is used to generate a quantum key and its corresponding serial number (key reading identifier) ​​through a quantum key agreement protocol (BB84 / B92 / TF-QKD), relay and store it in a key pool of a quantum key distribution device, the first quantum key distribution device and the second quantum key distribution device are used to store the quantum key and its corresponding serial number (key reading identifier), interact with the terminal and distribute the quantum key. In addition, the client may include an application and an encrypted tunnel client, the application may be a server, and the web server may include an application server and an encrypted tunnel service.

[0081] Below is Figure 6 For example, Figure 5 An application scenario of the data transmission system shown is described.

[0082] S610: The browser sets up an encrypted tunnel proxy.

[0083] The web server is running normally, the client has installed the encrypted tunnel client, and the browser has set up the encrypted tunnel proxy.

[0084] S620: Establish an encrypted tunnel.

[0085] A virtual tunnel is established, and the communicating parties establish a virtual communication tunnel according to the encrypted tunnel proxy communication method.

[0086] S630: Request quantum key and make consistency judgment.

[0087] Request quantum keys and perform consistency judgment. The communicating parties send quantum key distribution requests to the key pool of the quantum key distribution device to obtain quantum keys for SSL communication.

[0088] The above S630 may include the following steps:

[0089] S631: The client sends a quantum key distribution request to the key pool of the quantum key distribution device, and the key pool sends the quantum key and the corresponding key reading identifier to the client.

[0090] S632: The client sends a Client Hello message to the server, which includes the client quantum key information (ClientRandom), the protocol version supported by itself (such as TLS1.3), the client's (Client) key_share, the session ID, the supported post-quantum key exchange algorithm (such as FRODO, KYBER) or encryption suite, the compression method list and optional extension fields, etc.

[0091] S633: The server sends a quantum key extraction request to the key pool of the quantum key distribution device, traverses the key pool according to the quantum key information received from the client to find a set of corresponding quantum keys and performs consistency judgment.

[0092] S634: The server sends a Server Hello message to the client, which includes a server random number (ServerRandom), a flag indicating whether quantum keys are used in subsequent communications, the protocol version it supports (for example, TLS1.3), a session ID, a list of compression methods, confirmation of the post-quantum key exchange algorithm to be used, the server's (Server) key_share, the server certificate, and optional extension fields.

[0093] S640: Post-quantum key negotiation.

[0094] The client and server each negotiate a shared key based on PQC using the relevant parameters of the Client Hello and Server Hello messages. The shared key is used as key material to generate a handshake key handshake_key, which is used for encryption and decryption of subsequent sessions during the handshake phase.

[0095] S650: Generate a master key.

[0096] After both parties send the handshake end message, the master key master_key is generated using handshake_key as the key material. The client parses the mark returned by the S630 server to indicate whether the quantum key is used. If the quantum key is used, the master key is replaced by the quantum key; if the quantum key is not used, the master key master_key negotiated by the post-quantum algorithm is continued to be used, which can achieve resistance to quantum computing attacks.

[0097] S660: Generate a session key.

[0098] The client encrypts the handshake data using the master key, calculates the MAC value, and sends it to the server. Similarly, the server uses its own master key to calculate the MAC value and compares it with the client's master key to verify consistency with the client's master key. If the master keys on both sides are consistent, the master key is used to generate the relevant session key for subsequent SSL encrypted communication.

[0099] S670: Encrypted data transmission.

[0100] The browser starts encrypting data transmission through the encrypted tunnel client using the session key.

[0101] This embodiment enables quantum key encrypted communication and the use of PQC to negotiate keys to resist quantum computing attacks, even when current browsers do not support quantum keys and the PQC algorithm, without changing the browser. Furthermore, in situations where quantum keys are unavailable, encrypted tunnel communication is protected against quantum attacks. Furthermore, when quantum keys are unavailable to both communicating parties or key storage capacity is insufficient, post-quantum cryptographic algorithms can be used to provide additional protection against quantum computing attacks.

[0102] like Figure 7 As shown, the embodiment of the present application further provides an electronic device 700, including a processor 701 and a memory 702, wherein the memory 702 stores a program or instruction that can be run on the processor 701, and when the program or instruction is executed by the processor 701, the above Figure 1 、 Figure 4 and Figure 6 The various steps of the illustrated embodiments can achieve the same technical effects, and will not be described again here to avoid repetition.

[0103] The embodiment of the present application also provides a readable storage medium on which a program or instruction is stored, and when the program or instruction is executed by the processor, the above Figure 1 、 Figure 4 and Figure 6 The various processes of the illustrated embodiments can achieve the same technical effects, and will not be described again here to avoid repetition.

[0104] The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. In some examples, the readable storage medium may be a non-transitory readable storage medium.

[0105] The embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the above Figure 1 、 Figure 4 and Figure 6 The various processes of the illustrated embodiments can achieve the same technical effects, and will not be described again here to avoid repetition.

[0106] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0107] The embodiment of the present application further provides a computer program / program product, which is stored in a storage medium and is executed by at least one processor to implement the above Figure 1 、 Figure 4 and Figure 6 The various processes of the illustrated embodiments can achieve the same technical effects, and will not be described again here to avoid repetition.

[0108] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0109] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of a computer software product plus a necessary general-purpose hardware platform, or of course, by hardware. The computer software product is stored in a storage medium (such as ROM, RAM, magnetic disk, optical disk, etc.) and includes a number of instructions for enabling a terminal or network-side device to execute the methods described in each embodiment of the present application.

[0110] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms of implementation methods without departing from the purpose of this application and the scope of protection of the claims. These implementation methods are all within the protection of this application.

Claims

1. A data transmission method, characterized in that: Applied to a client, the method includes: Sending a first message to the server through a pre-established communication tunnel, wherein the first message is used to request a query for a second quantum key matching the first quantum key in a second storage medium, where the first quantum key is obtained by the client from the first storage medium; receiving a second message fed back by the server in response to the first message, wherein the second message includes a consistency determination result, and the consistency determination result is used to indicate whether the second quantum key exists; If the consistency judgment result is yes, determining the master key to be the first quantum key; If the consistency judgment result is non-existent, generating the master key according to the handshake key, wherein the handshake key is generated based on a first shared key, the first shared key is generated according to the first message and the second message by using a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client, and the second message includes the target post-quantum algorithm; Encrypted data is transmitted with the server via a target session key, wherein the target session key is generated based on the master key.

2. The method according to claim 1, characterized in that The first message also includes a first random number corresponding to the first quantum key, at least one protocol version supported by the client, a first public key, a current session identifier, and at least one compression method supported by the client.

3. The method according to claim 2, characterized in that The second message also includes a target protocol version, a second public key, the current session identifier and a target compression method, wherein at least one protocol version supported by the client includes the target protocol version, and at least one compression method supported by the client includes the target compression method.

4. The method according to claim 1, wherein Before transmitting encrypted data with the server using the target session key, the method further includes: Encrypt the first message and the second message using the master key to obtain first encrypted data; Sending a third message to the server through the communication tunnel, wherein the third message is used to request a consistency check between the first encrypted data and the second encrypted data generated by the server; receiving a fourth message fed back by the server in response to the third message, wherein the fourth message is used to indicate a consistency check result between the first encrypted data and the second encrypted data; When the consistency check result is consistent, the target session key is generated according to the master key.

5. The method according to any one of claims 1 to 4, characterized in that Before sending the first message to the server through the pre-established communication tunnel, the method further includes: The communication tunnel is established based on the encryption tunnel client component installed on the client and the encryption tunnel server component installed on the server.

6. A data transmission method, characterized in that: Applied to the server, the method includes: Receiving a first message sent by a client through a pre-established communication tunnel, wherein the first message is used to request a query for a second quantum key matching the first quantum key in a second storage medium, and the first quantum key is obtained by the client from the first storage medium; Performing consistency determination on the first quantum key and each quantum key in the second storage medium to obtain a consistency determination result; Feedback a second message to the client in response to the first message, wherein the second message includes a consistency determination result, and the consistency determination result is used to indicate whether the second quantum key exists; If the consistency judgment result is yes, determining that the master key is the first quantum key or the second quantum key; If the consistency judgment result is not present, generating the master key according to the handshake key, wherein the handshake key is generated based on the second shared key, the second shared key is generated based on the first message and the second message by using a target post-quantum algorithm, the first message includes at least one post-quantum key algorithm supported by the client, and the target post-quantum algorithm is determined by the server from at least one post-quantum key algorithm supported by the client; Encrypted data is transmitted with the client via a target session key, wherein the target session key is generated based on the master key.

7. The method according to claim 6, characterized in that The performing consistency determination on the first quantum key and each quantum key in the second storage medium to obtain a consistency determination result includes: When the second quantum key that is consistent with the first quantum key exists in the second storage medium, determining that the consistency judgment result is existence; When the second quantum key that is consistent with the first quantum key does not exist in the second storage medium, the consistency judgment result is determined to be non-existent.

8. The method according to claim 6, characterized in that The first message also includes a first random number corresponding to the first quantum key, at least one protocol version supported by the client, a first public key, a current session identifier, and at least one compression method supported by the client.

9. The method according to claim 8, characterized in that The second message also includes a target protocol version, a second public key, the current session identifier, the target post-quantum key algorithm and a target compression method, wherein at least one protocol version supported by the client includes the target protocol version, and at least one compression method supported by the client includes the target compression method.

10. The method according to claim 6, characterized in that Before performing encrypted data transmission with the client using the target session key, the method further includes: Encrypting the first message and the second message using the master key to obtain second encrypted data; receiving, through the communication tunnel, a third message sent by the client, wherein the third message is used to request a consistency check between the first encrypted data generated by the client and the second encrypted data; Based on the consistency check result of the first encrypted data and the second encrypted data, feeding back a fourth message to the client, wherein the fourth message is used to indicate the consistency check result of the first encrypted data and the second encrypted data; When the consistency check result is consistent, the target session key is generated according to the master key.

11. The method according to any one of claims 6 to 10, characterized in that: Before receiving the first message sent by the client through the pre-established communication tunnel, the method further includes: The communication tunnel is established based on the encryption tunnel client component installed on the client and the encryption tunnel server component installed on the server.

12. An electronic device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the data transmission method according to any one of claims 1 to 11.

13. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the data transmission method according to any one of claims 1 to 11 are implemented.

Images