Key negotiation method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a key negotiation method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a corresponding first driving signal through a first network node to be connected; generating a first response signal and auxiliary data based on the first driving signal, and transmitting the auxiliary data to a second network node to be connected, so that the second network node to be connected generates a second shared key according to the auxiliary data and a second driving signal; and performing key generation and confidentiality enhancement according to the first response signal to generate a first shared key. According to the method, based on the twinborn characteristic of the twinborn quantum tunneling device, a high-speed, safe and non-replicable key negotiation means is provided for the VPN, and a key negotiation technology based on a Diffie Hellman algorithm in the existing VPN technology is replaced, so that the key is safer and faster and has the non-replicable characteristic, and the anti-counterfeiting capability of the VPN is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a key negotiation method, apparatus, computer device, and storage medium. Background Art

[0002] With the development of the internet and communication networks, ensuring the security and privacy of data transmission has become a crucial requirement. Virtual Private Networks (VPNs), as a key technology, allow users to establish secure point-to-point connections over public networks such as the internet, enabling the secure transmission of private data. One of its core technologies is tunneling, which encapsulates original network packets to create a logically dedicated channel, or "tunnel," between sender and receiver, protecting data from eavesdropping and tampering.

[0003] Common tunneling protocols include PPTP, L2TP, and IPSec. IPSec is more widely used in enterprise networks due to its Layer 3 (network layer) operating characteristics, providing strong security features such as encryption, authentication, and key management.

[0004] Within the IPSec framework, the Internet Key Exchange version 2 (IKEv2) protocol is a key component for automatically negotiating and establishing security associations (SAs), the encryption and authentication rules between two nodes. IKEv2 uses the Diffie-Hellman (DH) key exchange algorithm for secure key negotiation, enabling the establishment of a shared secret key even in the presence of network eavesdropping. The security of the DH algorithm relies on the computational complexity of the discrete logarithm problem. However, due to its lack of built-in authentication mechanisms, DH itself is vulnerable to man-in-the-middle attacks. Summary of the Invention

[0005] The embodiments of the present application provide a key negotiation method, apparatus, computer device, and storage medium, which aim to solve the technical problem of improving the speed and security of key negotiation.

[0006] A first aspect of an embodiment of the present application provides a key agreement method, which is applied to a first network node to establish a connection, and includes:

[0007] Obtaining a first driving signal corresponding to the first network node to be connected to;

[0008] generating a first response signal and auxiliary data based on the first driving signal, and transmitting the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key according to the auxiliary data and the second driving signal;

[0009] Key generation and confidentiality enhancement are performed according to the first response signal to generate a first shared key.

[0010] In an optional embodiment of the present application, the first network node to be connected is configured with a first twin quantum tunneling device, and the step of generating a first response signal and auxiliary data based on the first driving signal includes:

[0011] Inputting the first driving signal into the first twin quantum tunneling device to obtain a first response signal;

[0012] Calculation is performed according to the first response signal to obtain the first response signal and the auxiliary data.

[0013] In an optional embodiment of the present application, after the step of enhancing the confidentiality of the first initial key according to the first response signal to generate a first shared key, the method further includes:

[0014] Determine the target key length based on the current scenario requirements;

[0015] Identifying whether the first shared key meets the target key length;

[0016] If the first shared key does not meet the target key length, return to the step of obtaining the first initial key and the first driving signal corresponding to the first network node to be connected and subsequent steps until the first shared key meets the target key length.

[0017] In an optional embodiment of the present application, at least one of the following is further included:

[0018] The first driving signal is distributed by a third-party node to the first network node to be connected to and the second network node to be connected to;

[0019] The first driving signal is determined by negotiation between the first network node to be connected to and the second network node to be connected to;

[0020] The first shared key is the same as the second shared key;

[0021] The key negotiation method is applied to virtual private network (VPN) technology.

[0022] A second aspect of an embodiment of the present application provides another key agreement method, which is applied to a second network node to establish a connection, and the method includes:

[0023] Obtaining a second driving signal corresponding to the second network node to be connected to;

[0024] receiving auxiliary data sent by the first network node to be connected to, and generating a target response signal according to the auxiliary data and the second driving signal;

[0025] Key reconstruction and confidentiality enhancement are performed according to the target response signal to generate a second shared key.

[0026] In an optional embodiment of the present application, the second network node to be connected is configured with a second twin quantum tunneling device, and the step of generating a target response signal according to the auxiliary data and the second driving signal includes:

[0027] inputting the second driving signal into the second twin quantum tunneling device to obtain a second response signal;

[0028] Information synchronization is performed on the second response signal according to the auxiliary data to obtain a target response signal.

[0029] In an optional embodiment of the present application, the auxiliary data includes difference information between the first twin quantum tunneling device and the second twin quantum tunneling device.

[0030] The step of performing information adjustment on the second response signal according to the auxiliary data to obtain a target response signal includes:

[0031] adjusting the second response signal according to difference information between the first twin quantum tunneling device and the second twin quantum tunneling device;

[0032] The adjusted second response signal is remeasured and adjusted until the second response signal is consistent with the first initial response signal of the first twin quantum tunneling device, and the second response signal consistent with the first initial response signal of the first twin quantum tunneling device is determined as the target response signal.

[0033] According to a third aspect of an embodiment of the present application, a key agreement device is provided, the device including a first network node to be connected to and a second network node to be connected to;

[0034] The first network node to be connected to includes:

[0035] A first acquisition module, configured to acquire a first driving signal corresponding to the first network node to be connected;

[0036] a sending module, configured to generate a first response signal and auxiliary data based on the first driving signal, and transmit the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key according to the auxiliary data and the second driving signal;

[0037] A first generating module, configured to perform key generation and confidentiality enhancement according to the first response signal to generate a first shared key;

[0038] The second network node to be connected to includes:

[0039] A second acquisition module, configured to acquire a second driving signal corresponding to the second network node to be connected;

[0040] a receiving module, configured to receive auxiliary data sent by the first network node to be connected, and generate a target response signal according to the auxiliary data and the second driving signal;

[0041] The second generating module is used to perform key reconstruction and confidentiality enhancement according to the target response signal to generate a second shared key.

[0042] According to a fourth aspect of an embodiment of the present application, a computer device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any of the above key negotiation methods when executing the computer program.

[0043] A fifth aspect of the embodiments of the present application provides a computer-readable storage medium on which a computer program is stored, characterized in that when the computer program is executed by a processor, the steps of the key negotiation method as described in any one of the above items are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0045] Figure 1 A flowchart of the key agreement method provided in the first embodiment of the present application;

[0046] Figure 2 A flowchart of a key agreement method provided in the second embodiment of the present application;

[0047] Figure 3 A flowchart of a key agreement method provided in the third embodiment of the present application;

[0048] Figure 4 A schematic diagram of a first simplified flow chart of a key agreement method provided in one embodiment of the present application;

[0049] Figure 5 A schematic diagram of the twin characteristics of a quantum tunneling device provided in one embodiment of the present application;

[0050] Figure 6A second schematic diagram of a simplified process of a key agreement method according to an embodiment of the present application;

[0051] Figure 7 A schematic diagram of the internal structure of a key agreement system module according to an embodiment of the present application;

[0052] Figure 8 A comparative diagram of the key agreement process provided in one embodiment of the present application;

[0053] Figure 9 A schematic diagram of the structure of a key agreement device provided in one embodiment of the present application;

[0054] Figure 10 A schematic diagram of the computer device structure provided for one embodiment of the present application. DETAILED DESCRIPTION

[0055] In the process of implementing this application, the inventors found that the current common tunnel protocols include PPTP, L2TP and IPSec, among which IPSec is more widely used in enterprise-level networks due to its third-layer (network layer) working characteristics, providing powerful security features such as encryption, authentication and key management.

[0056] Within the IPSec framework, the Internet Key Exchange version 2 (IKEv2) protocol is a key component for automatically negotiating and establishing security associations (SAs), the encryption and authentication rules between two nodes. IKEv2 uses the Diffie-Hellman (DH) key exchange algorithm for secure key negotiation, enabling the establishment of a shared secret key even in the presence of network eavesdropping. The security of the DH algorithm relies on the computational complexity of the discrete logarithm problem. However, due to its lack of built-in authentication mechanisms, DH itself is vulnerable to man-in-the-middle attacks.

[0057] In response to the above problems, embodiments of the present application provide a key negotiation method, apparatus, computer device, and storage medium, the method comprising: obtaining a corresponding first drive signal through a first network node to be connected; generating a first response signal and auxiliary data based on the first drive signal, and transmitting the auxiliary data to a second network node to be connected, so that the second network node to be connected generates a second shared key based on the auxiliary data and the second drive signal; performing key generation and confidentiality enhancement based on the first response signal to generate a first shared key. This method, based on the twin characteristics of twin quantum tunneling devices, provides a high-speed, secure, and non-copyable key negotiation method for VPNs, replacing the key negotiation technology based on the Diffie Hellman algorithm in existing VPN technology, making the key more secure, faster, and non-copyable, thereby improving the anti-counterfeiting capability of VPNs.

[0058] The solutions in the embodiments of the present application can be implemented using various computer languages, for example, C language commonly used in network devices and embedded systems.

[0059] In order to make the technical solutions and advantages of the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, and are not an exhaustive list of all the embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other unless they conflict.

[0060] See Figure 1 The following embodiment uses the aforementioned personal computer as the execution subject and applies the method provided in the first embodiment of this application to the first network connection node to be established, to specifically illustrate the key negotiation method. The key negotiation method provided in the first embodiment of this application includes the following steps S10 to S30:

[0061] Step S10: obtaining a first driving signal corresponding to the first network node to be connected;

[0062] It should be noted that this embodiment is applied to the first network node to be connected, wherein the first network node to be connected is the network node to which a VPN connection is to be established, which can be a computer host, router, gateway or other network device that needs to establish a VPN connection.

[0063] It should also be noted that a drive signal is an instruction used to activate or control a hardware component or software process. Under normal network configuration and security policies, it is part of starting or configuring network devices such as computers, routers, and gateways to establish a secure and legal network connection. Furthermore, the first drive signal can be distributed by a third-party node to the first network node to be connected and the second network node to be connected, or it can be transmitted from the second network node to the first network node to be connected.

[0064] Step S20: generating a first response signal and auxiliary data based on the first drive signal, and transmitting the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key according to the auxiliary data and the second drive signal;

[0065] It should be noted that in this embodiment, the first network node to be connected is configured with a first twin quantum tunneling device. Twin quantum tunneling devices are a pair of quantum tunneling devices with highly similar electrical properties, located in close proximity on the same wafer. This characteristic ensures that under identical conditions, the two devices exhibit nearly identical behavior.

[0066] In addition, it should be noted that the response signal refers to the output signal generated by the first network node to be connected (equipped with the first twin quantum tunneling device) according to the received first driving signal.

[0067] Auxiliary data is a data set prepared for the second network node to establish a connection, which contains necessary information to help it generate a key shared with the first node.

[0068] In an optional embodiment of the present application, the above step S20 may further include steps S21 to S22:

[0069] Step S21, inputting the first driving signal into the first twin quantum tunneling device to obtain a first response signal;

[0070] Specifically, when a first drive signal is applied to a first twin quantum tunneling device, the device generates a first response signal. This first response signal is the physical reaction of the first twin quantum tunneling device to the first drive signal and reflects the quantum tunneling effect. The first response signal is typically an analog signal and may need to be converted to a digital signal using an analog-to-digital converter (ADC) for subsequent processing.

[0071] Step S22: performing calculation according to the first response signal to obtain the auxiliary data.

[0072] Specifically, due to subtle differences between physical devices (even if they are twins), there may be slight differences between the first and second response signals. To ensure that both network nodes can generate the same shared key based on these response signals, the design of the assistance data needs to account for and compensate for these differences.

[0073] Therefore, after obtaining the first response signal, the first twin quantum tunneling device calculates the corresponding auxiliary data based on the first response signal, wherein the auxiliary data includes relevant information of the first response signal, which is used to help the second network node to be connected to make appropriate adjustments or calculations to ensure that it can generate a response signal that is highly matched with the first node and ultimately reach a consensus on the shared key. Specifically, the auxiliary data includes but is not limited to feature extraction of the first response signal, such as calculating its hash value, statistical characteristics (mean, variance, etc.) or other mathematical transformation results. These feature values ​​can be compared at both ends to verify consistency; in order to correct small errors caused by device differences, forward error correction coding (FEC) can be used. In this way, even if a small number of errors occur, they can be automatically corrected by the algorithm to ensure the consistency of the keys of both parties; synchronization parameters, such as clock frequency, phase information, etc., to ensure that the operations of both ends are synchronized, reduce differences caused by time asynchrony, and calibration parameters, etc.

[0074] After obtaining the corresponding auxiliary data, the first twin quantum tunneling device transmits the auxiliary data to the second network node to be connected. After receiving the auxiliary data from the first network node, the second network node uses its own twin quantum tunneling device, the received auxiliary data, and the second drive signal to reconstruct or generate a response signal that is identical to or highly correlated with that of the first network node. By comparing or processing the first response signal and the second response, the two parties can negotiate a common secret—the second shared key.

[0075] Through the above steps, by calculating the auxiliary data and sending it to the second network node to be connected, it is helpful to overcome the slight differences between physical devices and ensure that the two network nodes can successfully establish a shared key based on non-identical response signals while maintaining high security.

[0076] Step S30: Perform key generation and confidentiality enhancement according to the first response signal to generate a first shared key.

[0077] Specifically, the first response signal in the first twin quantum tunneling device is converted into a digital signal, and then the digital signal is processed to implement operations such as key generation or key reconstruction and confidentiality enhancement, and finally obtain the first shared key.

[0078] In addition, it should be noted that the first shared key is consistent with the second shared key generated by the second node to be connected to the network.

[0079] The above-described embodiment method utilizes twin quantum tunneling devices to dynamically generate shared keys, improving key security. Furthermore, the twin quantum tunneling devices must be operating normally to generate the correct key. If an attacker disrupts their operating environment, they will be unable to obtain the correct key, making the system intrusion-resistant. Furthermore, key negotiation is not achieved through an algorithm, but rather based on the randomness, non-replicability, and twin nature of the twin quantum tunneling devices. Therefore, the key is highly secure and resistant to attacks against the DH algorithm.

[0080] See Figure 2 The following embodiment uses the aforementioned personal computer as the execution subject and applies the method provided in the second embodiment of this application to the second network connection node to be established, to specifically illustrate the key negotiation method. The key negotiation method provided in the second embodiment of this application also includes the following steps S40-S60:

[0081] Step S40: obtaining a second driving signal corresponding to the second network node to be connected;

[0082] It should be noted that this embodiment is applied to the second network node to be connected, wherein the second network node to be connected is the network node to which a VPN connection is to be established, which can be a computer host, router, gateway or other network device that needs to establish a VPN connection.

[0083] Similarly, the second driving signal can be distributed to the first network node to be connected and the second network node to be connected via a third-party node, or can be transmitted from the first network node to be connected to the second network node to be connected.

[0084] Step S50: receiving auxiliary data sent by the first network node to be connected, and generating a target response signal according to the auxiliary data and the second driving signal;

[0085] It should be noted that the auxiliary data is data calculated by the twin quantum tunneling device in the first network connection node to be established based on the first response signal, and the auxiliary data includes difference information between the first twin quantum tunneling device and the second twin quantum tunneling device.

[0086] It should also be noted that the second network node to be connected is equipped with a second twin quantum tunneling device, which has highly similar electrical properties to the first twin quantum tunneling device. The target response signal is the same as the first response signal, obtained by the second twin quantum tunneling device performing information synchronization operations based on the auxiliary data.

[0087] In an optional embodiment of the present application, the above step S50 may further include steps S51 to S52:

[0088] Step S51, inputting the second driving signal into the second twin quantum tunneling device to obtain a second response signal;

[0089] Specifically, when the second drive signal acts on the second twin quantum tunneling device, the device generates a second response signal. A highly sensitive detector (such as an ammeter, voltmeter, etc.) is used to capture this second response signal. The second response signal is the physical reaction of the first twin quantum tunneling device to the second drive signal, which reflects the result of the quantum tunneling effect. The second response signal is usually an analog signal and may need to be converted into a digital signal by an analog-to-digital converter (ADC) for subsequent processing.

[0090] Step S52: performing information modulation on the second response signal according to the auxiliary data to obtain a target response signal.

[0091] Specifically, the researchers first analyzed the difference information provided in the auxiliary data to determine the specific differences between the first and second twin quantum tunneling devices. For example, they identified device parameters (such as threshold voltage and current density), environmental conditions (such as temperature and humidity), and any other factors that might affect device behavior.

[0092] Then, the second response signal is adjusted based on the analyzed differences. For example, if it is found that the two devices produce different output amplitudes under the same drive signal, the gain adjustment can be used to narrow the gap; if there is a phase difference, a phase compensation mechanism can be introduced.

[0093] The second response signal, after the initial adjustment, is then remeasured and evaluated for similarity to the first response signal. If significant differences remain after the initial adjustment, further fine-tuning is required. This process can be iterative, with repeated measurement, analysis, and adjustments until the second response signal is as consistent as possible with the first.

[0094] When the second response signal, after multiple adjustments, finally reaches a high degree of consistency with the first response signal, it is determined as the target response signal. This means that it has been successfully adjusted to a state consistent with the first initial response signal of the first twin quantum tunneling device and can be used in the next step of key generation or reconstruction.

[0095] Through the above steps, the second twin quantum tunneling device synchronizes the second response signal with the auxiliary data to obtain the same target signal as the first response signal, which not only improves the consistency and reliability of the key negotiation process, but also enhances the overall security of the system. Although there are inevitably slight differences in physical systems, resulting in a maximum difference of 5% in the random numbers shared secretly, the use of information synchronization technology can effectively eliminate these differences and ensure the consistency of the key. In response to the problem of insufficient entropy in the original digital sequence output by the device, confidentiality enhancement technology is used to extract high-entropy random numbers, thereby achieving unconditionally secure and exclusive physical random number (key) sharing.

[0096] Step S60: Perform key reconstruction and confidentiality enhancement according to the target response signal to generate a second shared key.

[0097] Specifically, since the target response signal is the same as or highly similar to the first response signal, after obtaining the target response signal, the target response signal is converted into a digital signal, and then the digital signal is processed to achieve key generation or key reconstruction and confidentiality enhancement operations, and finally a second shared key is obtained, and the second shared key is the same as the first shared key. Among them, confidentiality enhancement includes obfuscating the original signal through complex mathematical transformations (such as hash functions) to increase the difficulty of cracking, using the diffusion principle in cryptography to disperse information into a wider data set, so that changes in a single piece of information can affect multiple parts of the entire key, further improving security; or by regularly replacing the shared key to prevent the risks brought by long-term use of the same key. Each time it is updated, a new driving signal and the characteristics of the quantum tunneling device can be used to generate a brand new key.

[0098] Through the above-mentioned embodiment method, the physical characteristics of the quantum tunneling device are not clonable, that is, once prepared, its physical entity and its electrical characteristics cannot be copied. Even if a third party intercepts the driving signal, it cannot obtain the correct output signal (key) by forging or imitating the device, ensuring the security and unpredictability of the key. The output of the quantum tunneling device is based on a high-frequency oscillating physical noise source, which is highly random and unpredictable, so that even if an external party obtains the driving signal, it cannot infer the output signal by mathematical means. This method uses the twin phenomenon of quantum tunneling to realize exclusive random number sharing between the two places and establish a key synchronization mechanism for the communicating parties.

[0099] See Figure 3 The following embodiment uses the aforementioned personal computer as the execution subject and applies the method provided in the third embodiment of this application to the first node to be connected to the network to be established, specifically illustrating the key negotiation method. The key negotiation method provided in the third embodiment of this application also includes the following steps S201-S203:

[0100] Step S201, determining the target key length based on the current scenario requirements;

[0101] Step S202, identifying whether the first shared key meets the target key length;

[0102] Step S203: If the first shared key does not meet the target key length, return to the step of obtaining the first initial key and the first driving signal corresponding to the first network node to be connected and subsequent steps until the first shared key meets the target key length.

[0103] Specifically, the target key length required for the current scenario is determined based on the specific security requirements of the application, the provisions of the communication protocol, etc.

[0104] Then, after the first shared key is generated, the actual length of the first shared key and the target key length required by the current scenario are evaluated to determine whether the length of the first shared key meets the target key length required by the current scenario.

[0105] If the judgment result is that the length of the first shared key does not meet the target key length required by the current scenario, it is necessary to repeat the above steps S10 to S30, that is, return to execute to obtain the first drive signal corresponding to the first network node to be connected, then generate a first response signal and auxiliary data based on the first drive signal, and transmit the auxiliary data to the second network node to be connected. Finally, according to the first response signal, key generation and confidentiality enhancement are performed to generate a first shared key until the length of the generated first shared key meets the target key length.

[0106] Similarly, it is determined whether the length of the second shared key meets the target key length required by the current scenario. If not, the operation performed is the same as the operation of the first shared key described above.

[0107] For example, according to the requirements of the current scenario, the required target key length is 4096 bits, but it is detected that the length of the currently generated first shared key is only 1024 bits, which does not meet the target key length. Therefore, it is necessary to repeat the steps: obtain the first drive signal corresponding to the first network node to be connected, and then generate a first response signal and auxiliary data based on the first drive signal, and transmit the auxiliary data to the second network node to be connected, and finally, perform key generation and confidentiality enhancement based on the first response signal to generate a first shared key until the length of the first shared key meets the target key length of 4096 bits.

[0108] Through the above embodiment method, the key generation step is continuously executed in a loop until the required target key length is reached, thereby improving the flexibility and applicability of key agreement in different application scenarios.

[0109] For example, to help understand the implementation process of the key agreement method obtained by combining the above-mentioned embodiment 1 and embodiment 2, please refer to Figure 4 , Figure 4 A first schematic diagram of a key agreement method is provided, specifically:

[0110] The embodiment of the present application is applied to the first network connection node to be established (hereinafter referred to as node A) and the second network connection node to be established (hereinafter referred to as node B), and node A and node B are respectively configured with a corresponding first twin quantum tunneling device (hereinafter referred to as twin quantum tunneling device A) and a second twin quantum tunneling device (hereinafter referred to as twin quantum tunneling device B), wherein the twin quantum tunneling device has a twin characteristic, and the twin characteristic means that when two twin quantum tunneling devices (referring to a group of quantum tunneling devices located in closely adjacent positions on a wafer and having extremely similar electrical characteristics) receive the same excitation signal (input signal), they will generate similar response signals (output signals). Figure 5 As shown, Figure 5 Schematic diagram of the twin characteristics of quantum tunneling devices.

[0111] First, node A and node B simultaneously negotiate a driving signal C on a communication channel (which may be distributed by a third party or transmitted by one of node A and node B to the other).

[0112] Then, node A inputs the negotiation drive signal C into the twin quantum tunneling device A to obtain the first response signal RA, calculates the auxiliary data H based on the first response signal RA, and transmits the auxiliary data H to node B. At the same time, node A performs key generation or key reconstruction and confidentiality enhancement based on the first response signal RA to obtain the first shared key K.

[0113] At the same time, node B inputs the negotiation drive signal C into the twin quantum tunneling device B. When receiving the auxiliary data H transmitted by node A, the twin quantum tunneling device B performs information synchronization based on the negotiation drive signal C and the auxiliary data H, generating a target response signal RB, where the target response signal RB is completely consistent with the first response signal RA. Finally, node B performs key generation or key reconstruction and confidentiality enhancement based on the target response signal RB to obtain a second shared key K, which is also completely consistent with the first shared key K.

[0114] For example, to help understand the implementation process of the key agreement method obtained by combining the above-mentioned embodiment 1 and embodiment 2, please refer to Figure 6 , Figure 6 A second simplified flowchart of a key negotiation method is provided, specifically:

[0115] The above-mentioned key negotiation method is adopted in the virtual private network VPN technology.

[0116] Node A and Node B are two network nodes that will establish a VPN connection. Nodes can be computer hosts, routers, gateways, or other network devices that need to establish a VPN connection. Twin quantum tunneling modules A and B are circuit modules that contain paired (twin) quantum tunneling devices. The internal structure diagram of the module of the key agreement system is as follows: Figure 7 shown.

[0117] Depend on Figure 7 As can be seen, the input / output interface is used for connecting to and communicating data with the host computer; the digital-to-analog converter is used to convert the host's input data (digital signal) to the quantum tunneling device into the device's excitation signal (analog signal); and the analog-to-digital converter is used to convert the quantum tunneling device's response signal (analog signal) into a digital signal for data processing and ultimately returned to the host computer. The data control and processing unit is responsible for controlling the operation of the entire module and performing data processing, implementing functions such as key generation / reconstruction and confidentiality enhancement.

[0118] Please refer to Figure 8 , Figure 8 It is a comparative diagram of the key negotiation process. When the two nodes start to negotiate to establish a VPN tunnel, they first follow the steps in the first phase of the general IPSec negotiation process to negotiate the encryption algorithm, the digest algorithm and the key sharing method used by both parties. When it is necessary to negotiate the key strength DH group used, compared with the traditional DH algorithm for key negotiation, the embodiment of the present application uses a key negotiation protocol based on twin quantum tunneling devices, that is, each of the two nodes is configured with a corresponding twin quantum tunneling device, and the randomness, non-replicability and twin characteristics of the twin quantum tunneling device are used to obtain the same shared key. Then, according to the conventional process, continue to complete the next step process. After the above steps are completed, the IPSec phase one negotiation is completed, and the two parties can continue to negotiate the specific security connection parameters according to the conventional IPSec phase two negotiation. After that, the establishment of the VPN tunnel is completed.

[0119] The method in this embodiment is a key negotiation technology based on quantum tunneling devices. Compared with key negotiation technologies based on the Diffie-Hellman algorithm, the advantage of quantum tunneling devices is that they are physically unclonable, meaning that any pair of twin quantum tunneling devices is unique and cannot be forged. This avoids the Diffie-Hellman algorithm's inability to authenticate user identities. Furthermore, key negotiation based on quantum tunneling devices can achieve key negotiation rates exceeding Mbps, far exceeding the kbps-level key negotiation rates offered by existing Diffie-Hellman algorithms. High key negotiation rates are essential for data encryption algorithms such as one-time pads.

[0120] It should be understood that although the steps in the flowchart are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0121] See Figure 9 , an embodiment of the present application provides a key agreement device, including a first network node to be connected to and a second network node to be connected to;

[0122] The first network node to be connected to includes:

[0123] A first acquisition module 10 is configured to acquire a first driving signal corresponding to the first network node to be connected;

[0124] a sending module 20, configured to generate a first response signal and auxiliary data based on the first drive signal, and transmit the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key based on the auxiliary data and the second drive signal;

[0125] A first generating module 30 is configured to perform key generation and confidentiality enhancement according to the first response signal to generate a first shared key;

[0126] The second network node to be connected to includes:

[0127] A second acquisition module 40 is configured to acquire a second driving signal corresponding to the second network node to be connected;

[0128] a receiving module 50, configured to receive auxiliary data sent by the first network node to be connected, and generate a target response signal according to the auxiliary data and the second driving signal;

[0129] The second generating module 60 is configured to perform key reconstruction and confidentiality enhancement according to the target response signal to generate a second shared key.

[0130] See also Figure 10 , a schematic diagram of the computer device structure provided in the embodiment adopts the key negotiation method of the above embodiment.

[0131] The specific definitions of the key agreement device described above can be found in the definitions of the key agreement method above and will not be repeated here. Each module in the key agreement device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0132] In one embodiment, a computer device is provided, and the internal structure diagram of the computer device can be shown in Figure N. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a key negotiation method as described above is implemented. It includes: a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, any step in the key negotiation method as described above is implemented.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any step in the above key agreement method can be implemented.

[0134] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0135] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0138] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0139] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A key negotiation method, characterized in that: The method is applied to a first network node to which a connection is to be established, and the method includes: Obtaining a first driving signal corresponding to the first network node to be connected to; generating a first response signal and auxiliary data based on the first driving signal, and transmitting the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key according to the auxiliary data and the second driving signal; Key generation and confidentiality enhancement are performed according to the first response signal to generate a first shared key.

2. The method according to claim 1, wherein The first network node to be connected is configured with a first twin quantum tunneling device, and the step of generating a first response signal and auxiliary data based on the first driving signal includes: Inputting the first driving signal into the first twin quantum tunneling device to obtain a first response signal; Calculation is performed according to the first response signal to obtain the auxiliary data.

3. The method according to claim 1, wherein After the step of performing key generation and confidentiality enhancement according to the first response signal to generate a first shared key, the method further includes: Determine the target key length based on the current scenario requirements; Identifying whether the first shared key meets the target key length; If the first shared key does not meet the target key length, return to the step of obtaining the first driving signal corresponding to the first network node to be connected and subsequent steps until the first shared key meets the target key length.

4. The method according to claim 1, wherein Also include at least one of the following: The first driving signal is distributed by a third-party node to the first network node to be connected to and the second network node to be connected to; The first driving signal is determined by negotiation between the first network node to be connected to and the second network node to be connected to; The first shared key is the same as the second shared key.

5. A key negotiation method, characterized in that: The method is applied to a second network node to which a connection is to be established, and the method includes: Obtaining a second driving signal corresponding to the second network node to be connected to; receiving auxiliary data sent by the first network node to be connected to, and generating a target response signal according to the auxiliary data and the second driving signal; Key reconstruction and confidentiality enhancement are performed according to the target response signal to generate a second shared key.

6. The method according to claim 5, wherein The second network node to be connected is configured with a second twin quantum tunneling device, and the step of generating a target response signal according to the auxiliary data and the second driving signal includes: inputting the second driving signal into the second twin quantum tunneling device to obtain a second response signal; Information synchronization is performed on the second response signal according to the auxiliary data to obtain a target response signal.

7. The method according to claim 6, wherein The auxiliary data includes difference information between the first twin quantum tunneling device and the second twin quantum tunneling device, The step of performing information adjustment on the second response signal according to the auxiliary data to obtain a target response signal includes: adjusting the second response signal according to difference information between the first twin quantum tunneling device and the second twin quantum tunneling device; The adjusted second response signal is remeasured and adjusted until the second response signal is consistent with the first initial response signal of the first twin quantum tunneling device, and the second response signal consistent with the first initial response signal of the first twin quantum tunneling device is determined as the target response signal.

8. A key agreement device, characterized in that: The apparatus includes a first network node to which a connection is to be established and a second network node to which a connection is to be established; The first network node to be connected to includes: A first acquisition module, configured to acquire a first driving signal corresponding to the first network node to be connected; a sending module, configured to generate a first response signal and auxiliary data based on the first driving signal, and transmit the auxiliary data to a second network node to be connected to, so that the second network node to be connected to generates a second shared key according to the auxiliary data; A first generating module, configured to perform key generation and confidentiality enhancement according to the first response signal to generate a first shared key; The second network node to be connected to includes: A second acquisition module, configured to acquire a second driving signal corresponding to the second network node to be connected; a receiving module, configured to receive auxiliary data sent by the first network node to be connected, and generate a target response signal according to the auxiliary data and the second driving signal; The second generating module is used to perform key reconstruction and confidentiality enhancement according to the target response signal to generate a second shared key.

9. A key agreement device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the key agreement method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the key agreement method according to any one of claims 1 to 7 are implemented.

Images