Key expansion method and device, and storage medium

Abstract

The invention discloses a key expansion method and device and a storage medium, and the method comprises the steps: a terminal detects whether there is a source key file for expansion locally, and if not, executes a key downloading process; if yes, selecting a to-be-expanded source key file; the terminal and the quantum key access gateway negotiate the expansion proportion of the source key file; and the terminal and the quantum key access gateway carry out expansion operation on the source key file according to the expansion proportion, and finally an expanded key file is obtained and stored. According to the invention, the key expansion is directly carried out through the terminal and the quantum key access gateway, a key center does not need to be requested to download the key, the network service bandwidth is not occupied, and the transmission performance of the whole network is effectively improved; the randomness test of the key can still be kept after the key of the terminal and the quantum key access gateway is expanded, and the obtained expanded key is still a true random number, so that the key resource can be effectively saved, and meanwhile, the utilization rate of the key resource is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of key technology, and in particular to a key expansion method, device and storage medium. Background Art

[0002] With the advancement of technology, data transmission over the internet has become widespread, but this has also brought with it data security issues. To ensure secure data transmission, most data is encrypted. Data encryption involves processing plaintext files or data using an encryption algorithm, rendering them unreadable code, commonly known as ciphertext. The use of encryption algorithms also consumes significant amounts of the corresponding keys. True random numbers should be used as keys. Because they are random, unpredictable, and non-reproducible, they enhance the unpredictability of the encryption process, making it more difficult to crack.

[0003] Currently, due to the high consumption of keys, terminals and quantum key access gateways continuously request key downloads from the key center. This results in a high number of key download handshakes, and key downloads occupy network bandwidth. Limited by download speeds, the amount of keys downloaded or being downloaded may not keep up with the speed of key usage, resulting in delayed key usage. Therefore, it is necessary to reduce the number of key downloads, increase the amount of local keys, and improve the key usage experience without changing the existing network architecture and hardware device performance.

[0004] At the same time, after the key is added, the key randomness test must also be passed. This is the most important correlation test in the test items. Failure means that the added key is not a true random number, which means that the added key cannot be used as an input parameter in the encryption algorithm.

[0005] To sum up, how to solve the problem of excessive key downloads between existing terminals and quantum key access gateways, which causes key downloads to occupy network service bandwidth and delay key usage, and how to solve the problem of supplementary keys always meeting the randomness test of the keys, are technical issues that the industry is currently paying attention to. Summary of the Invention

[0006] Purpose of the Invention: The purpose of the present invention is to provide a key expansion method, device, and storage medium that solves the existing problem of excessive key downloads between terminals and quantum key access gateways, which causes key downloads to occupy network service bandwidth and delay key usage. It also solves the problem of supplemented keys always meeting the key randomness test. The present invention directly expands the key between the terminal and the quantum key access gateway, eliminating the need to request key downloads from the key center, does not occupy network service bandwidth, and eliminates the key usage delay problem. At the same time, the key randomness test can still be maintained after key expansion, and the expanded key is still a true random number.

[0007] Technical solution: The present invention provides a key expansion method, wherein the participants of the method include a terminal and a quantum key access gateway, and the method includes the following steps:

[0008] (1) The terminal detects whether there is a source key file for expansion locally. If not, the key download process is executed; if so, the source key file file-source to be expanded is selected;

[0009] (2) The terminal negotiates with the quantum key access gateway the expansion ratio rate-res of the source key file file-source;

[0010] (3) The terminal and the quantum key access gateway perform an expansion operation on the source key file file-source according to the expansion ratio rate-res, and finally obtain the expanded key file and store it.

[0011] Furthermore, the parameters involved in the expansion ratio rate-res include: the terminal's key file storage space, the disk space required for the terminal to perform the expansion operation, the disk space required for the quantum key access gateway to perform the expansion operation, the key space limit for each terminal when the quantum key access gateway is fully loaded with terminals, and the network management center's proportional expansion limit for terminals.

[0012] Furthermore, the specific process of negotiating the expansion ratio rate-res of the source key file file-source is as follows:

[0013] 1) The terminal determines the initial expansion ratio rate1 based on the local key file storage space and the disk space required to perform the expansion operation;

[0014] 2) The terminal sends a key expansion request to the quantum key access gateway, which includes the initial expansion ratio rate1 and the key file index corresponding to the source key file file-source;

[0015] 3) The quantum key access gateway verifies the initial expansion ratio rate1 based on the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal. If the above restrictions are met at the same time, the initial expansion ratio rate1 is recorded as the expansion ratio rate-res and fed back to the terminal as a response to the expansion request; otherwise, the initial expansion ratio rate1 is updated according to the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal, and the updated expansion ratio rate2 is calculated. The expansion ratio rate2 is recorded as the expansion ratio rate-res and fed back to the terminal as a response to the expansion request.

[0016] Furthermore, before recording the expansion ratio rate2 as the expansion ratio rate-res, the quantum key access gateway also includes confirming whether the expansion ratio rate2 is an exponential power of 2. If so, the expansion ratio rate2 is directly recorded as the expansion ratio rate-res; if not, the expansion ratio rate2 is updated to the exponential power of 2 that is closest to the original expansion ratio rate2, and the exponential power is the new expansion ratio rate2, and the new expansion ratio rate2 is recorded as the expansion ratio rate-res.

[0017] Furthermore, the specific process steps of performing the expansion operation of the source key file file-source according to the expansion ratio rate-res are as follows:

[0018] A: Let the size of the source key file file-source be X, and then split the source key file file-source of size X into two files file-A and file-B of size X / 2.

[0019] B: Divide file-A and file-B into 2*rate-res sub-files;

[0020] C: Select the first sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the first expanded key file file-ex-1; select the second sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the second expanded key file file-ex-2; and so on, until the last sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the last expanded key file file-ex-2*rate-res;

[0021] Finally, the first expanded key file file-ex-1, the second expanded key file file-ex-2, and finally the last expanded key file file-ex-2*rate-res are concatenated in sequence to obtain a complete expanded key file and store it.

[0022] Furthermore, the step A may be:

[0023] A1: Let the size of the source key file file-source be X. Then, let the second half of the source key file file-source (size X) be file-A, and the first half be file-B.

[0024] Furthermore, the step C may be:

[0025] C1: Select each subfile in file-A and each subfile in file-B and perform an XOR operation to obtain multiple XOR intermediate subfile sets; arbitrarily select 2*rate-res intermediate subfiles from the intermediate subfile set using the method of sampling without replacement and concatenate them into the first expanded key file; then arbitrarily select 2*rate-res intermediate subfiles from the remaining intermediate subfile set using the method of sampling without replacement and concatenate them into the second expanded key file; and so on, to obtain multiple expanded key files;

[0026] Finally, multiple expanded key files are concatenated in sequence to obtain a complete expanded key file and store it.

[0027] The present invention also includes a computer device, which includes at least a processor and a memory, wherein the processor is configured to implement the key expansion method as claimed in any one of the above claims when executing a computer program stored in the memory.

[0028] The present invention further includes a computer-readable storage medium storing a computer program, wherein the computer program implements the key expansion method according to any one of the above claims when executed by a processor.

[0029] The beneficial effects of the present invention are as follows: in the present invention, since data encryption transmission is performed between the terminal and the quantum key access gateway, key expansion is performed directly through the terminal and the quantum key access gateway, without requesting to download the key from the key center, and does not occupy the network service bandwidth, effectively improving the transmission performance of the entire network; key expansion between the terminal and the quantum key access gateway does not require multiple expansion handshakes, the key expansion speed is fast, and the randomness test of the key can still be maintained after the key expansion, and the obtained expanded key is still a true random number, which can effectively save key resources and greatly improve the utilization rate of key resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 Schematic diagram of the key expansion method flow of the present invention;

[0031] Figure 2 This is a schematic diagram of the expansion ratio negotiated between the terminal and the quantum key access gateway of the present invention;

[0032] Figure 3 Schematic diagram of key expansion for the terminal and quantum key access gateway of the present invention;

[0033] Figure 4 Schematic diagram of key expansion for a terminal and quantum key access gateway according to embodiment 2 of the present invention. DETAILED DESCRIPTION

[0034] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0035] Example 1

[0036] As described in the background, existing terminals and quantum key access gateways consume a large amount of keys during data encryption and transmission. This causes them to continuously request key downloads from the key center. This results in a high number of handshakes for key downloads, and key downloads occupy network service bandwidth. Limited by download speeds, the amount of keys downloaded or being downloaded may not keep up with the speed of key usage, causing delays in key usage. Furthermore, after adding keys, the key's randomness test must also pass. This is the most important correlation test among the test items. Failure to pass this test means that the added key is not a truly random number, which means that the added key cannot be used as an input parameter in the encryption algorithm. Therefore, how to solve these problems is a major issue currently faced.

[0037] like Figure 1 In view of this, the present invention proposes a key expansion method, in which the participants include a terminal and a quantum key access gateway, and the method includes the following steps:

[0038] (1) The terminal detects whether there is a local source key file for expansion. If not, the terminal executes the key download process; if so, the terminal selects the source key file to be expanded (file-source); the key download process here refers to the process of going to the key center to execute key download when there is no local source key file for expansion. Since this embodiment describes key expansion, the key download process at the key center is not described in detail; after the key download process, both the terminal and the quantum key access gateway have the source key file (file-source);

[0039] (2) Figure 2 As shown, the terminal and the quantum key access gateway negotiate the expansion ratio rate-res of the source key file file-source; the parameters involved in the expansion ratio rate-res include: the terminal's key file storage space, that is, the space of the key pool, the disk space required by the terminal to perform the expansion operation, the disk space required by the quantum key access gateway to perform the expansion operation, the key space limit for each terminal when the quantum key access gateway is fully loaded with terminals, and the network management center's proportional expansion limit for terminals.

[0040] Specifically, the process of negotiating the expansion ratio rate-res of the source key file file-source is as follows:

[0041] 1) The terminal determines the initial expansion ratio, rate1, based on the local key file storage space (i.e., the space of its own key pool) and the disk space required to perform the expansion operation. For example, rate1 = 32, where 32 is an empirical value. The calculation process is as follows: Based on the measured minimum required source key file size of 1-2KB, the key after expansion still retains randomness. The terminal's disk and key management slots have a maximum of 256 slots, and 8 source key files are downloaded at a time. Therefore, reserving a ratio of 1:32 for expansion at a time effectively and reasonably leaves available resources after deducting the space occupied by other terminal resources. The minimum unit of 1MB (larger than 1-2KB) is 1MB, so if there are subsequent functional expansions, the expansion function can still be used.

[0042] 2) The terminal sends a key expansion request to the quantum key access gateway. The request includes the initial expansion ratio rate1 and the key file index corresponding to the source key file file-source. The key file index corresponding to the source key file file-source is used so that the quantum key access gateway can find the source file locally and subsequently perform the same expansion operation as the terminal.

[0043] 3) The quantum key access gateway verifies the initial expansion ratio rate1 based on the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal. If the above restrictions are met at the same time, the initial expansion ratio rate1 is recorded as the expansion ratio rate-res and fed back to the terminal as a response to the expansion request; otherwise, if any of the restrictions are not met, the initial expansion ratio rate1 is updated based on the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal, generally reducing the expansion ratio, and calculating the updated expansion ratio rate2, recording the expansion ratio rate2 as the expansion ratio rate-res and feeding back to the terminal as a response to the expansion request.

[0044] For example, 1. Due to pre-allocated space, the quantum key access gateway calculates that when fully loaded, it can only expand its terminal at a ratio of 1:64. 2. After checking the local disk, it finds that it is occupied by other resources (such as logs and files), and logically calculates that the maximum expansion ratio of the required disk space is 1:16. 3. The network management center specifies a maximum expansion ratio of 1:32 for the terminal. Based on these restrictions and the initial expansion ratio rate1 requested by the terminal, the initial expansion ratio rate1 is updated to obtain the minimum reasonable value of 1:16. 16 is the updated expansion ratio rate2.

[0045] To further explain, before recording the expansion ratio rate2 as the expansion ratio rate-res, the quantum key access gateway also includes confirming whether the expansion ratio rate2 is an exponential power of 2. If so, the expansion ratio rate2 is directly recorded as the expansion ratio rate-res; if not, the expansion ratio rate2 is updated to the exponential power of 2 closest to the original expansion ratio rate2, and the exponential power is the new expansion ratio rate2, and the new expansion ratio rate2 is recorded as the expansion ratio rate-res.

[0046] For example, if the expansion ratio rate2 = 34, the expansion ratio rate2 = 34 is updated to the nearest power of 2 smaller than the original expansion ratio of 34, namely 32. This power of 32 becomes the new expansion ratio rate2, and the new expansion ratio rate2 is recorded as expansion ratio rate-res. The power of 2 maximizes the computing power of the device and improves its performance. At this point, the quantum key access gateway records the new expansion ratio rate2 as expansion ratio rate-res and feeds it back to the terminal as a response to the expansion request.

[0047] (3) The terminal and the quantum key access gateway perform an expansion operation on the source key file file-source according to the expansion ratio rate-res, and finally obtain the expanded key file and store it. The specific process steps of performing the expansion operation on the source key file file-source according to the expansion ratio rate-res are as follows:

[0048] A: Let the size of the source key file file-source be X, and then divide the source key file file-source of size X into two files file-A and file-B of size X / 2. Of course, the order of file-A and file-B can be reversed. For example, let the size of the source key file file-source be X, and then divide the second half of the source key file file-source of size X into file-A and the first half into file-B.

[0049] B: Divide file-A and file-B into 2*rate-res sub-files; Figure 3 As shown, for example, if rate-res=2, file-A is divided into 4 sub-files A1, A2, A3 and A4; file-B is divided into 4 sub-files B1, B2, B3 and B4;

[0050] C: Select the first sub-file in file-A and perform XOR operation with each sub-file in file-B in turn to obtain a new key file combination, that is, the expanded first key file file-ex-1; select the second sub-file in file-A and perform XOR operation with each sub-file in file-B in turn to obtain the expanded second key file file-ex-2; and so on, until the last sub-file in file-A is XORed with each sub-file in file-B in turn to obtain the expanded last key file file-ex-2*rate-res;

[0051] Finally, the first expanded key file file-ex-1, the second expanded key file file-ex-2, and finally the last expanded key file file-ex-2*rate-res are concatenated in sequence to obtain a complete expanded key file and store it.

[0052] In the present invention, since data encryption is transmitted between the terminal and the quantum key access gateway, key expansion is performed directly through the terminal and the quantum key access gateway, without the need to request key downloading from the key center, and does not occupy network service bandwidth, effectively improving the transmission performance of the entire network; key expansion between the terminal and the quantum key access gateway does not require multiple expansion handshakes, the key expansion speed is fast, and the randomness test of the key can still be maintained after the key expansion, and the obtained expanded key is still a true random number, which can effectively save key resources and greatly improve the utilization rate of key resources.

[0053] An embodiment of the present invention further provides a computer device, which includes at least a processor and a memory, wherein the memory stores a computer program, and the processor is configured to implement the steps of the key expansion method of the embodiment of the present invention when executing the computer program stored in the memory.

[0054] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the key expansion method of the embodiment of the present invention are implemented.

[0055] Example 2

[0056] This embodiment is basically the same as embodiment 1, except that:

[0057] like Figure 4 As shown, in this embodiment, the specific process of performing the expansion operation of the source key file file-source according to the expansion ratio rate-res is as follows:

[0058] Alternatively, each subfile in file-A and each subfile in file-B may be selected to perform an XOR operation to obtain multiple XORed intermediate subfile sets; 2*rate-res intermediate subfiles are randomly selected from the intermediate subfile set using a sampling method without replacement and are concatenated into a first expanded key file, and the intermediate subfiles that have been taken out are not put back into the intermediate subfile set; then, 2*rate-res intermediate subfiles are randomly selected from the remaining intermediate subfile set using a sampling method without replacement and are concatenated into a second expanded key file, and the intermediate subfiles that have been taken out are not put back into the intermediate subfile set; and so on, multiple expanded key files are obtained;

[0059] Finally, multiple expanded key files are concatenated in sequence to obtain a complete expanded key file and store it.

[0060] In summary, the present invention directly expands keys between the terminal and the quantum key access gateway, eliminating the need to request key downloads from the key center, occupies no network service bandwidth, and eliminates the problem of key usage delays. Furthermore, the randomness test of the key can still be maintained after key expansion, and the expanded key obtained is still a truly random number.

Claims

1. A key expansion method, characterized in that: Participants in the method include a terminal and a quantum key access gateway, and the method includes the following steps: (1) The terminal detects whether there is a source key file for expansion locally. If not, the key download process is executed; if so, the source key file file-source to be expanded is selected; (2) The terminal negotiates with the quantum key access gateway the expansion ratio rate-res of the source key file file-source; (3) The terminal and the quantum key access gateway perform an expansion operation on the source key file file-source according to the expansion ratio rate-res, and finally obtain the expanded key file and store it.

2. A key expansion method according to claim 1, characterized in that: The parameters involved in the expansion ratio rate-res include: the terminal's key file storage space, the disk space required for the terminal to perform the expansion operation, the disk space required for the quantum key access gateway to perform the expansion operation, the key space limit for each terminal when the quantum key access gateway is fully loaded with terminals, and the network management center's proportional expansion limit for terminals.

3. A key expansion method according to claim 2, characterized in that: The specific process of negotiating the expansion ratio rate-res of the source key file file-source is as follows: 1) The terminal determines the initial expansion ratio rate1 based on the local key file storage space and the disk space required to perform the expansion operation; 2) The terminal sends a key expansion request to the quantum key access gateway, which includes the initial expansion ratio rate1 and the key file index corresponding to the source key file file-source; 3) The quantum key access gateway verifies the initial expansion ratio rate1 based on the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal. If the above restrictions are met at the same time, the initial expansion ratio rate1 is recorded as the expansion ratio rate-res and fed back to the terminal as a response to the expansion request; otherwise, the initial expansion ratio rate1 is updated according to the disk space required for the local expansion operation, the key space limit for each terminal when the terminal is fully loaded, and the proportional expansion limit of the network management center for the terminal, and the updated expansion ratio rate2 is calculated. The expansion ratio rate2 is recorded as the expansion ratio rate-res and fed back to the terminal as a response to the expansion request.

4. A key expansion method according to claim 3, characterized in that: Before recording the expansion ratio rate2 as the expansion ratio rate-res, the quantum key access gateway further includes confirming whether the expansion ratio rate2 is an exponential power of 2. If so, the expansion ratio rate2 is directly recorded as the expansion ratio rate-res; if not, the expansion ratio rate2 is updated to the exponential power of 2 closest to the original expansion ratio rate2, and the exponential power is the new expansion ratio rate2, and the new expansion ratio rate2 is recorded as the expansion ratio rate-res.

5. A key expansion method according to claim 1, characterized in that: The specific process steps of performing the expansion operation of the source key file file-source according to the expansion ratio rate-res are as follows: A: Let the size of the source key file file-source be X, and then split the source key file file-source of size X into two files file-A and file-B of size X / 2. B: Divide file-A and file-B into 2*rate-res sub-files; C: Select the first sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the first expanded key file file-ex-1; select the second sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the second expanded key file file-ex-2; and so on, until the last sub-file in file-A and perform XOR operation with each sub-file in file-B in turn, thus obtaining the last expanded key file file-ex-2*rate-res; Finally, the first expanded key file file-ex-1, the second expanded key file file-ex-2, and finally the last expanded key file file-ex-2*rate-res are concatenated in sequence to obtain a complete expanded key file and store it.

6. A key expansion method according to claim 5, characterized in that: The step A may be: A1: Let the size of the source key file file-source be X. Then, let the second half of the source key file file-source (size X) be file-A, and the first half be file-B.

7. A key expansion method according to claim 5, characterized in that: The step C may be: C1: Select each subfile in file-A and each subfile in file-B and perform an XOR operation to obtain multiple XOR intermediate subfile sets; arbitrarily select 2*rate-res intermediate subfiles from the intermediate subfile set using the method of sampling without replacement and concatenate them into the first expanded key file; then arbitrarily select 2*rate-res intermediate subfiles from the remaining intermediate subfile set using the method of sampling without replacement and concatenate them into the second expanded key file; and so on, to obtain multiple expanded key files; Finally, multiple expanded key files are concatenated in sequence to obtain a complete expanded key file and store it.

8. A computer device, characterized in that: The computer device comprises at least a processor and a memory, and the processor is configured to implement the key expansion method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

9. A computer-readable storage medium, characterized in that: The device stores a computer program, which, when executed by a processor, implements the key expansion method according to any one of claims 1 to 7.

Images