Communication method, electronic equipment and storage medium

Abstract

The invention discloses a communication method, electronic equipment and a storage medium, belongs to the technical field of communication security, and is used for improving the communication security. The method comprises the following steps: obtaining a quantum key and a key identifier of the quantum key; sending the quantum key and the hash value of the key identifier to a server; receiving a first message sent by the server, and generating a session key according to the quantum key and the first message; and obtaining the session key, and carrying out communication data encryption communication with a server.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of communication security, and particularly relates to a communication method, an electronic device and a storage medium. BACKGROUND

[0002] The secure socket layer (SSL) protocol uses data encryption, identity authentication and message integrity verification mechanism to provide security and data integrity protection for the transmission of Internet communication data, and has been widely applied.

[0003] Public key cryptography and asymmetric encryption algorithm is a technology for ensuring the security of digital communication on open networks, and is regarded as the basis of Internet Protocol Security. The basic structure of security protocols such as SSL / TLS protocol and IPSec protocol is similar, that is, first, identity authentication and shared key exchange are performed using asymmetric encryption algorithm, and then communication data is encrypted based on the shared key using symmetric encryption algorithm. However, since Shor algorithm can break the discrete logarithm and prime factorization problem, the security of traditional public key algorithm is challenged, resulting in potential attack threats to the key used in the existing SSL protocol. With the continuous development of quantum computers in recent years, the existing public key cryptography system cannot continue to guarantee the security of communication. SUMMARY

[0004] The embodiments of the application provide a communication method, an electronic device and a storage medium, which can solve the problem that the existing public key cryptography system cannot guarantee the security of communication.

[0005] In a first aspect, the embodiments of the application provide a communication method applied to a client, which comprises: obtaining a quantum key and a key identifier of the quantum key; sending a hash value of the quantum key and the key identifier to a server; receiving a first message sent by the server, generating a first session key according to the quantum key and the first message; obtaining the session key, and performing encrypted communication of communication data with the server.

[0006] In a second aspect, the embodiments of the application provide a communication method applied to a server, which comprises: receiving a quantum key and a hash value of a key identifier of the quantum key sent by a client; obtaining the quantum key according to the hash value; receiving a second message sent by the client, generating a session key according to the second message and the quantum key; obtaining the session key, and performing encrypted communication of communication data with the client.

[0007] In a third aspect, an embodiment of the present application provides a communication device applied to a client, the device comprising: a first obtaining module configured to obtain a quantum key and a key identifier of the quantum key; a sending module configured to send a hash value of the quantum key and the key identifier to a server; a first generating module configured to receive a first message sent by the server and generate a session key according to the quantum key and the first message; and a first communication module configured to obtain the session key and perform encrypted communication with the server.

[0008] In a fourth aspect, an embodiment of the present application provides a communication device applied to a server, the device comprising: a receiving module configured to receive a quantum key and a hash value of a key identifier of the quantum key sent by a client; a second obtaining module configured to obtain the quantum key according to the hash value; a second generating module configured to receive a second message sent by the client and generate a session key according to the second message and the quantum key; and a second communication module configured to obtain the session key and perform encrypted communication with the client.

[0009] In a fifth aspect, an embodiment of the present application provides an electronic device, which comprises a processor, a memory, and a program or instructions stored in the memory and executable in the processor, and the program or instructions are executed by the processor to implement the steps of the method according to the first aspect or the steps of the method according to the second aspect.

[0010] In a sixth aspect, an embodiment of the present application provides a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to implement the steps of the method according to the first aspect or the steps of the method according to the second aspect.

[0011] In the embodiment of the present application, the quantum key and the key identifier of the quantum key are obtained, the hash value of the quantum key and the key identifier is sent to the server, the first message sent by the server is received, the session key is generated according to the quantum key and the first message, the session key is obtained, and the encrypted communication with the server is performed, so that the quantum key is applied to the communication between the client and the server, the communication between the client and the server has the anti-quantum attack performance, the communication data security is improved, the data security is ensured, and the security vulnerability problem is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 FIG. 1 is a flowchart of a communication method according to an embodiment of the present application;

[0013] Figure 2 FIG. 1 is a flowchart of a communication method according to an embodiment of the present application;

[0014] Figure 3 is a flowchart of another communication method provided by an embodiment of the present application;

[0015] Figure 4 is a flowchart of another communication method provided by an embodiment of the present application;

[0016] Figure 5 is a service flowchart provided by an embodiment of the present application;

[0017] Figure 6 is a structural diagram of a communication device provided by an embodiment of the present application;

[0018] Figure 7 is a structural diagram of a communication device provided by an embodiment of the present application;

[0019] Figure 8 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0021] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually a class, and are not limited to the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the front and rear associated objects are in an "or" relationship.

[0022] The communication method, electronic device and storage medium provided by the embodiments of the present application will be described in detail below with reference to the drawings and specific embodiments and their application scenarios.

[0023] Figure 1 An embodiment of the present application provides a communication method, which can be applied to a client. In other words, the method can be executed by software or hardware installed on the client, and the method comprises the following steps:

[0024] Step 102: Obtain a quantum key and a key identifier of the quantum key.

[0025] With the development of quantum computing, the security of traditional SSL protocol is challenged, and the quantum key generated by quantum key distribution (QKD) network negotiation is more secure than the current traditional public key cryptography. Quantum secure communication is based on the principle of quantum mechanics and is carried out through a quantum key distribution network. QKD is the process of generating shared keys between two communicating parties based on QKD protocol negotiation. Since quantum is not reproducible, i.e. it cannot be copied or measured without destroying its state, eavesdropping will be immediately detected, and the generated key is theoretically unconditionally secure. Therefore, quantum key can be applied to SSL protocol and encrypted tunnel communication, making it resistant to quantum attacks.

[0026] The main application scenario of the embodiments of the present application is secure communication between systems, such as SSL VPN or HTTPS interface, which can also be applied to secure communication between web applications and servers, such as client accessing a website deployed on an Nginx server through a Chrome browser, both of which use SSL protocol for encrypted secure communication and apply quantum key as session key material for both parties.

[0027] Figure 2 An SSL communication networking diagram provided by the embodiments of the present application is shown, Figure 2 As shown, the networking of SSL communication includes a client of SSL communication, a server of SSL communication, a quantum key distribution network and a quantum key distribution device. The client and the server support SSL protocol. The quantum key distribution network is used to generate quantum keys and their corresponding key identifiers (key reading identifiers) through quantum key negotiation protocol (BB84 / B92 / TF-QKD), and relay and store the quantum keys and their corresponding key identifiers to the key pool of the quantum key distribution device. The quantum key distribution device is used to store quantum keys and their corresponding key identifiers, and to interact with terminal devices or servers and distribute quantum keys.

[0028] The quantum key distribution network generates quantum keys and their corresponding key identifiers through quantum key negotiation protocol (BB84 / B92 / TF-QKD) and stores them in the key pool of the quantum key distribution device, wherein the key identifier is the unique identifier of the quantum key. After generating and storing the quantum key, the client performs SSL handshake process with the server and negotiates the session key. First, the client sends a quantum key distribution request to the key pool of the quantum key distribution device to obtain the quantum key and the key identifier of the quantum key. The key pool sends the quantum key and the corresponding key identifier to the client, and then the client sends a series of information to the server.

[0029] Step 104: Send the quantum key and the hash value of the key identifier to the server.

[0030] Specifically, after obtaining the quantum key, the client uses a hash algorithm to calculate the hash value of the quantum key and the key identifier and fills it in the client random number field (32 bytes) as the client random number Random1.

[0031] The client sends a Client Hello message to the server, which contains the client random number Random1, the protocol version supported by the client (for example, TLSv1.2), the session ID, the cipher suite list, the compression method list, and optional extension fields. The client sends the hash value of the quantum key and key identifier to the server by sending the Client Hello message to the server, so that the server can obtain the quantum key based on the hash value.

[0032] After receiving the Client Hello message sent by the client, the server will send a quantum key extraction request to the key pool of the key distribution device, and obtain the quantum key that matches the client by traversing the key pool. Then the server sends a series of information to the client. Specifically, the server sends a quantum key extraction request to the key pool of the quantum key distribution device, searches the key pool to find a set of quantum keys and key identifiers. The set of quantum keys and key identifiers uses the same hash function whose hash value is equal to the client's random number to perform quantum key consistency verification, that is, the hash value of the quantum key and key identifier obtained by the server is equal to the hash value of the client's quantum key and key identifier.

[0033] After obtaining the quantum key and key identifier, the server generates a server random number Random2. If the server retrieves the key pool and obtains a quantum key and corresponding key identifier that meets the requirements, the last bit of the server random number Random2 is set to 1 as an identifier of whether the communicating parties use quantum keys; otherwise, the last bit of Random2 is set to 0, indicating that quantum keys will not be used in subsequent communications. The server sends a Server Hello message to the client. The ServerHello message includes the server random number Random2, the protocol version number (such as TLSv1.2) to be used, the session ID, the encryption suite selected by the server, the compression method, and optional extension fields. The client can receive the Server Hello message and determine whether to use quantum keys to communicate with the server based on the server random number Random2 in the Server Hello message.

[0034] Step 106: Receive a first message sent by the server, and generate a session key based on the quantum key and the first message.

[0035] Specifically, the server can send a first message to the client, and the client can generate a session key according to the quantum key and the first message after receiving the first message.

[0036] In an implementation, the first message includes a server random number, a base point of a first elliptic curve of the server, and a public key of the first elliptic curve, and the generating the session key according to the quantum key and the first message includes: obtaining a shared key according to the public key of the first elliptic curve, a private key of a second elliptic curve of the client, and the base point of the first elliptic curve, the first elliptic curve being used for key exchange; calculating a master key according to the server random number, a client random number, and the shared key, the server random number being generated by the server according to the quantum key, the client random number being generated by the client according to the quantum key; replacing the quantum key with the master key, and generating the session key according to the replaced master key.

[0037] Specifically, the server selects a first elliptic curve used for key exchange, generates a random number as a private key of the first elliptic curve of the server and stores the random number locally, and calculates a public key of the first elliptic curve of the server according to a base point G of the first elliptic curve and the private key of the server. The server sends a first message to the client, the first message can be a server key exchange (Server Key Exchange) message, and the first message includes the base point of the first elliptic curve of the server and the public key of the first elliptic curve.

[0038] The client receives the first message sent by the server, and if the client determines to use the quantum key according to the Server Hello message sent by the server, the client and the server replace the master key with the quantum key, and then obtain the session key; if the quantum key is not used, the client and the server generate the session key according to the selected key exchange algorithm. Specifically, the client generates a random number as the second elliptic curve private key of the client, and generates the public key of the second elliptic curve of the client according to the message sent by the server. The client uses the public key of the first elliptic curve, the private key of the second elliptic curve and the base point G of the first elliptic curve to calculate the ECDHE shared key K. The client can calculate the master key according to the server random number Random2, the client random number Random1 and the ECDHE shared key K. The client can determine whether to use the quantum key according to the value of the last bit of the received server random number Random2. If the last bit of the server random number Random2 is 1, the obtained quantum key can replace the master key, and the replaced master key is the quantum key described above. Then, the replaced master key is processed by the PRF function to generate the session key. If the last bit of the server random number Random2 is 0, the master key is not replaced.

[0039] Step 108: Obtain the session key and perform data encryption communication with the server.

[0040] Specifically, after obtaining the session key, the client can send a ChangeCipher Spec message to the server to inform the server that the subsequent communication will use the session key for symmetric encryption communication, and the communication data between the client and the server is encrypted by the generated session key and then sent to the server. Similarly, the server also encrypts the communication data between the client and the server by the generated session key and then sends it to the client. Both SSL communication parties obtain a consistent session key that can be used for cryptographic applications, and use the session key to encrypt the communication data for transmission, realizing the anti-quantum attack performance of the SSL protocol.

[0041] The communication method provided in the embodiments of the present application comprises the following steps: obtaining a quantum key and a key identifier of the quantum key; sending the quantum key and a hash value of the key identifier to a server, so that the server obtains the quantum key according to the hash value; receiving a first message sent by the server, and generating a session key according to the quantum key and the first message; sending a second message to the server, so that the server generates the session key according to the second message and the quantum key; and performing encrypted communication on communication data between the client and the server by using the session key. The quantum key is applied to the communication between the client and the server, so that the communication between the client and the server has the anti-quantum attack performance, the communication data security is improved, the data security is ensured, and the security loophole problem is avoided. The quantum key is efficiently, safely and stably applied to the SSL protocol by using the handshake process of the SSL protocol, so that the SSL protocol has the anti-quantum attack performance. Only the quantum key and the hash value of the key identifier are transmitted between the two communication parties, instead of the key itself, and no other key-related information is transmitted, so as to ensure the security of the session key. The embodiments of the present application support a plurality of commercial cryptographic algorithms in the key exchange and encrypted communication process, and the combination of the quantum key and the commercial cryptographic algorithm is realized.

[0042] In an implementation manner, after the receiving the first message sent by the server and generating the first session key according to the quantum key and the first message, the method further comprises: generating a second elliptic curve private key of the client; generating a second elliptic curve public key of the client according to the first message and the second elliptic curve private key; and sending the second elliptic curve public key as a second message to the server.

[0043] Specifically, the client can generate a random number as the second elliptic curve private key of the client, and generate the second elliptic curve public key according to the first message sent by the server and the second elliptic curve private key. The client can send the second message to the server, and the second message can be a client key exchange (Client Key Exchange) message, which can comprise the second elliptic curve public key of the client. In this way, the server can generate the session key according to the second elliptic curve public key carried in the second message and the quantum key.

[0044] In an implementation manner, after the generating the session key according to the quantum key and the first message, the method further comprises:

[0045] digesting a message sent during the handshake with the server to obtain a first digest message; encrypting the first digest message by using the session key to obtain a first encrypted digest message; and sending the first encrypted digest message to the server, wherein the first encrypted digest message carries the check information.

[0046] Specifically, the client can send an Encrypted Handshake Message message to the server, use a digest algorithm to digest the messages sent during the client-server handshake to obtain a first digest message. The client can encrypt the first digest message using the generated session key to obtain a first encrypted digest message, and send the first encrypted digest message to the server. The first encrypted digest message carries verification information, and is used to verify the consistency of the session key of the client and the server. After receiving the first encrypted digest message, the server can verify the session key according to the first encrypted digest message, thereby ensuring the consistency of the session key.

[0047] In an implementation manner, after obtaining the first digest message, the method further includes: receiving a second encrypted digest message sent by the server, decrypting the second encrypted digest message according to the session key to obtain a second digest message; and performing session key verification by comparing the first digest message and the second digest message.

[0048] Specifically, the client can receive a second encrypted digest message sent by the server. Since the second encrypted digest message carries verification information, after receiving the second encrypted digest message, the client can decrypt the second encrypted digest message according to the obtainable session key to obtain a second digest message, and perform session key verification by comparing the first digest message and the second digest message. If the first digest message and the second digest message are consistent, the client sends a notification to the server to perform communication between the client and the server. If the first digest message and the second digest message are inconsistent, the client sends error information to the server and re-performs handshake and quantum key distribution with the server. The embodiment of the application supports consistency verification of quantum keys used by the two communication parties, so as to solve the problem of inconsistent key materials of the two communication parties.

[0049] In an implementation manner, the first message includes certificate information of the server, and before generating the session key according to the quantum key and the first message, the method further includes: verifying the certificate information of the server by a certificate public key.

[0050] Specifically, the first message received by the client further includes certificate information of the server. The client can verify the certificate information of the server, verify the signature of the certificate information by a certificate public key, and select whether to continue communication if the certificate of the server is not issued by a trusted agency, or the domain name in the certificate is inconsistent with the actual domain name, or the certificate has expired. In this way, the certificate information of the server can be verified to ensure the credibility of the server, avoid data leakage, and improve the security of data.

[0051] Figure 3 Another communication method provided by one embodiment of the present application is shown, which can be applied to a server. In other words, the method can be executed by software or hardware installed on the server, and the method comprises the following steps:

[0052] Step 302: receiving a quantum key and a hash value of a key identification of the quantum key sent by a client.

[0053] Specifically, after obtaining the quantum key, the client calculates a hash value of the quantum key and the key identification using a hash algorithm and fills in a client random number field (32 bytes) as a client random number Random1.

[0054] The client sends a client hello (Client Hello) message to the server, which contains the client random number Random1, a protocol version (for example, TLSv1.2) supported by the client itself, a session ID, a cipher suite list, a compression method list, and an optional extension field, etc. The client sends the quantum key and the hash value of the key identification to the server by sending the Client Hello message to the server. The server receives the quantum key and the hash value of the key identification sent by the client.

[0055] Step 304: obtaining the quantum key according to the hash value.

[0056] Specifically, after receiving the Client Hello message sent by the client, the server sends a quantum key extraction request to the key pool of the quantum key distribution device, obtains the quantum key matched with the client according to the obtained hash value, and then sends a series of information to the client.

[0057] In one implementation mode, the step of obtaining the quantum key according to the hash value comprises the step of: obtaining the quantum key matched with the hash value from the quantum key pool.

[0058] Specifically, the server sends a quantum key extraction request to the key pool of the quantum key distribution device, searches the key pool for a group of quantum keys and key identifications, and performs consistency verification on the quantum keys using the same hash function, that is, the hash value of the quantum key and the key identification obtained by the server is equal to the hash value of the quantum key and the key identification of the client. In this way, the server can obtain the quantum key matched with the quantum key of the client.

[0059] Step 306: receiving a second message sent by the client, and generating a session key according to the second message and the quantum key.

[0060] Specifically, the server can receive the second message sent by the client, and generate the session key according to the second message and the quantum key.

[0061] In an implementation, the second message includes a second elliptic curve public key of the client, and the generating the session key according to the second message and the quantum key includes: obtaining a shared key according to the second elliptic curve public key, the first elliptic curve private key and a first elliptic curve base point; calculating a master key according to the server random number, a client random number and the shared key, the client random number being generated by the client according to the quantum key; replacing the master key with the quantum key, and generating the session key according to the replaced master key.

[0062] Specifically, the second message includes a second elliptic curve public key of the client, and the server calculates an ECDHE shared key K using the second elliptic curve public key of the client, the first elliptic curve private key of the server and the first elliptic curve base point G, and obtains a master key according to three key materials of the client random number Random1, the server random number Random2 and the ECDHE shared key K, the client random number being generated by the client according to the quantum key. If the quantum key is used, the server can replace the obtained quantum key with the master key, and the replaced master key is the quantum key. Then, the server processes the replaced master key by using a PRF function to generate the session key. If the quantum key is not used, the server does not replace the master key.

[0063] Step 308: obtaining the session key, and performing data encryption communication with the client.

[0064] Specifically, the server can obtain the generated session key to perform data encryption communication with the client, that is, the server sends the encrypted communication data to the client. Both the SSL communication parties obtain a consistent session key that can be used for cryptographic applications, and use the session key to encrypt the communication data for transmission, so that the SSL protocol has the anti-quantum attack performance.

[0065] The communication method provided in the embodiments of the present application receives a quantum key and a hash value of a key identifier of the quantum key sent by a client; acquires the quantum key according to the hash value; sends a first message to the client, so that the client generates a session key according to the quantum key and the first message; receives a second message sent by the client, and generates the session key according to the second message and the quantum key; and performs encrypted communication on communication data between the server and the client through the session key. The quantum key is applied to the communication between the client and the server, so that the communication between the client and the server has the anti-quantum attack performance, the communication data security is improved, the data security is ensured, and the security loophole problem is avoided. The quantum key is efficiently, safely and stably applied to the SSL protocol by using the handshake process of the SSL protocol, so that the SSL protocol has the anti-quantum attack performance. Only the quantum key and the hash value of the key identifier are transmitted between the two communication parties, instead of the key itself, and no other key-related information is transmitted, so as to ensure the security of the session key. The embodiments of the present application support various commercial cryptographic algorithms in the key exchange and encrypted communication process, and realize the combination of the quantum key and the commercial cryptographic algorithm.

[0066] In an implementation manner, after the quantum key is acquired according to the hash value, the method further includes:

[0067] generating a server random number according to the quantum key; acquiring a first elliptic curve, the first elliptic curve being used for key exchange; obtaining a public key of the first elliptic curve according to a base point of the first elliptic curve and a private key of the first elliptic curve; and sending the server random number, the base point of the first elliptic curve and the public key of the first elliptic curve to the client as the first message.

[0068] Specifically, the server selects a first elliptic curve used for key exchange, generates a random number as a private key of the first elliptic curve of the server and stores the random number in the local, and calculates a public key of the first elliptic curve of the server according to a base point G of the first elliptic curve and the private key of the server. The server sends a first message to the client, the first message can be a server key exchange (Server Key Exchange) message, and the first message includes the base point of the first elliptic curve of the server and the public key of the first elliptic curve. In this way, the client can generate a session key according to the quantum key and the first message.

[0069] In an implementation manner, after the session key is generated according to the second message and the quantum key, the method further includes:

[0070] The message sent during the handshake with the client is summarized to obtain a second summary message; the second summary message is encrypted using the session key to obtain a second encrypted summary message; and the second encrypted summary message is sent to the client, where the second encrypted summary message carries verification information.

[0071] Specifically, the server may send an Encrypted Handshake Message to the client, using a digest algorithm to digest the message sent by the client and server during the handshake to obtain a second digest message. The server may encrypt the second digest message using the generated session key to obtain a second encrypted digest message, and then send the second digest message to the client. The first encrypted digest message carries verification information, and the second encrypted digest message is used to verify the consistency of the session key between the client and the server. After receiving the second encrypted digest message, the client can verify the session key based on the second encrypted digest message, thereby ensuring the consistency of the session key.

[0072] In one implementation, after obtaining the second summary message, the method further includes:

[0073] Receive a first encrypted summary message sent by the client; decrypt the first encrypted summary message according to the session key to obtain a first summary message; and perform session key verification using the first summary message and the second summary message.

[0074] Specifically, the server can receive the first encrypted summary message sent by the client. Since the first encrypted summary message carries verification information, after receiving the first encrypted summary message, the server can decode the first encrypted summary message according to the obtained session key to obtain the first summary message, and perform session key verification by comparing the first summary message and the second summary message. If the first summary message and the second summary message are consistent, the server sends a notification to the client to communicate between the client and the server. If the first summary message and the second summary message are inconsistent, the server sends an error message to the client and re-handshakes and distributes quantum keys with the client. The embodiment of the present application supports consistency verification of the quantum keys used by the communicating parties to solve the possible problem of inconsistency of the key materials of the communicating parties.

[0075] In one implementation, the first message further includes certificate information of the server, and the certificate information is used by the client to verify the certificate information of the server through a certificate public key.

[0076] Specifically, the first message sent by the server further includes certificate information of the server, the client can verify the certificate information of the server, verify the signature of the certificate information through the certificate public key, and if the certificate of the server is not issued by a trusted agency, or the domain name in the certificate is inconsistent with the actual domain name, or the certificate has expired, the visitor selects whether to continue communication. In this way, by verifying the certificate information of the server, the credibility of the server can be ensured, data leakage is avoided, and the security of data is improved.

[0077] The communication method provided by the application will be specifically described below through specific embodiments, combined with the communication method flow schematic diagram shown in Figure 4 and the service flow chart shown in Figure 5 The communication method includes the following steps:

[0078] Step S1, generation and storage of quantum keys: the quantum key distribution network generates quantum keys and corresponding serial numbers (key identifiers) through a quantum key negotiation protocol (BB84 / B92 / TF-QKD) and stores them in the key pool of the quantum key distribution device, wherein the key identifier is the unique identifier of the quantum key.

[0079] Step S2, after step S1 is completed, the communication parties will perform an SSL handshake process and negotiate a session key. First, the client sends a quantum key distribution request to the key pool of the quantum key distribution device to obtain quantum keys and key identifiers, and then the client sends a series of information to the server.

[0080] The above step S2 specifically includes steps S21-S23:

[0081] S21, the client sends a quantum key distribution request to the key pool of the quantum key distribution device, and the key pool sends quantum keys and corresponding key identifiers to the client.

[0082] S22, the client uses a digest algorithm to calculate the hash value of the quantum key identifier and the quantum key using a hash algorithm, and fills it in the client random number field (32 bytes) as the client random number Random1.

[0083] S23, the client sends a Client Hello message to the server, which includes the client random number Random1, the protocol version (such as TLSv1.2) supported by the client, the session ID, the encryption suite list, the compression method list, and the optional extension field, etc.

[0084] S3, the server requests a quantum key: the server sends a quantum key extraction request to the key pool of the quantum key distribution device, obtains a quantum key matched with the client by traversing the key pool, and then sends a series of information to the client, and step S3 specifically includes steps S31-S36:

[0085] S31, the server sends a quantum key extraction request to the key pool of the quantum key distribution device, and searches the key pool for a set of quantum keys and key identifiers, and the set of data uses the hash value of the same hash function to equal the random number of the client to perform consistency verification of the quantum key.

[0086] S32, the server generates a random number Random2, and if the server searches the key pool to obtain a quantum key and the corresponding key identifier that meet the conditions, the last bit of the server random number Random2 is set to 1 as an identifier of whether the quantum key is used by the communication parties; otherwise, the last bit of Random2 is set to 0, indicating that the quantum key is not used in subsequent communication.

[0087] S33, the server sends a Server Hello message to the client, which contains the server random number Random2, the protocol version number (such as TLSv1.2) to be confirmed, the session ID, the encryption suite selected by the server, the compression method, and the optional extension field, etc.

[0088] S34, the server sends a Certificate message to the client, which contains the certificate information of the server.

[0089] S35, the server selects an elliptic curve for key exchange, generates a random number as the private key of the server elliptic curve and stores it locally, and calculates the public key of the server elliptic curve according to the base point G of the elliptic curve and the private key of the server.

[0090] S36, the server sends a Server Key Exchange message to the client, which contains the selected elliptic curve and base point G, and the server elliptic curve public key signed using a public key algorithm.

[0091] Step S4, the client generates a session key: if the quantum key is used, the client and the server replace the master key with the quantum key to obtain a session key; if the quantum key is not used, the client and the server generate a session key according to the selected key exchange algorithm. This step S4 specifically includes steps S41-S47:

[0092] S41, the client verifies the server certificate, and verifies the signature with the certificate public key. If the certificate is not issued by a trusted authority, or the domain name in the certificate does not match the actual domain name, or the certificate has expired, the visitor selects whether to continue communication.

[0093] S42, the client generates a random number as a private key of an elliptic curve of the client, and generates an elliptic curve public key of the client according to the information sent by the server.

[0094] S43, the client sends a Client Key Exchange message to the server, and the message contains the elliptic curve public key of the client.

[0095] S44, the client calculates an ECDHE shared key K by using the elliptic curve public key of the server, the elliptic curve private key of the client and an elliptic curve base point G, and calculates a master key according to three key materials of the client random number Random1, the server random number Random2 and the ECDHE shared key K.

[0096] S45, the client judges whether to use a quantum key according to the value of the last bit of the random number Random2, if the last bit is 1, the quantum key obtained in step S2 is used to replace the master key, and then a session key is generated by using a PRF function; if the last bit is 0, the master key is not replaced.

[0097] S46, the client sends a Change Cipher Spec message to the server, and notifies the server that the subsequent communication is changed to symmetric encryption communication.

[0098] S47, the client sends an Encrypted Handshake Message message to the server, uses a digest algorithm to digest the messages sent during the handshake, encrypts the messages by using the generated session key, and sends the messages to the server.

[0099] Step S5, the server generates a session key, and the step S5 specifically includes steps S51-S55:

[0100] S51, the server calculates an ECDHE shared key K by using the elliptic curve public key of the client, the elliptic curve private key of the server and the elliptic curve base point G, and calculates a master key according to three key materials of the client random number Random1, the server random number Random2 and the ECDHE shared key K.

[0101] S52, if a quantum key is used, the server uses the quantum key obtained in step S3 to replace the master key, and then generates a session key by using a PRF function; if a quantum key is not used, the master key is not replaced;

[0102] S53, the server sends a Change Cipher Spec message to the client, and notifies the client that the subsequent communication is changed to symmetric encryption communication.

[0103] S54, the server decrypts the Encrypted Handshake Message message sent by the client, uses a digest algorithm to digest the message sent during the handshake, compares the digest result with the decryption result, and then checks whether the session key is consistent, that is, further checks the consistency of the quantum key. If consistent, a notification is sent to the client, and then step S6 is entered; if inconsistent, an error message is sent to the client, and the handshake and quantum key distribution are performed again.

[0104] S55, the server sends the Encrypted Handshake Message message to the client for verification of the session key of the client.

[0105] Step S6, encrypted data transmission.

[0106] After all the above steps are completed, the SSL communication parties obtain a consistent session key that can be used for cryptographic applications, and the session key is used for encrypted transmission of communication data, so that the anti-quantum attack performance of the SSL protocol is realized. The related cryptographic algorithms in the above process can be replaced by any cryptographic series algorithm, such as SM2, SM3, SM4, etc.

[0107] It should be noted that the communication method provided in the embodiments of the present application can be executed by a communication device or a control module in the communication device for executing the communication method. In the embodiments of the present application, the communication device executes the communication method as an example to illustrate the communication device provided in the embodiments of the present application.

[0108] Figure 6 is a structural schematic diagram of a communication device according to the embodiments of the present application, which is applied to a client. As shown in Figure 6 the communication device 600 includes a first acquisition module 610, a sending module 620, a first generation module 630, and a first communication module 640.

[0109] The first acquisition module 610 is configured to acquire a quantum key and a key identifier of the quantum key; the sending module 620 is configured to send a hash value of the quantum key and the key identifier to a server; the first generation module 630 is configured to receive a first message sent by the server and generate a session key according to the quantum key and the first message; and the first communication module 650 is configured to obtain the session key and perform encrypted communication with the server.

[0110] In an implementation manner, the first message comprises a server random number, a first base point of an elliptic curve of the server, a public key of the first elliptic curve, the first generating module 630 is configured to obtain a shared key according to the public key of the first elliptic curve, a private key of a second elliptic curve of a client and the first base point of the elliptic curve, the first elliptic curve being used for key exchange; calculate a master key according to the server random number, a client random number and the shared key, the server random number being generated by the server according to the quantum key, the client random number being generated by the client according to the quantum key; replace the master key with the quantum key, and generate the session key according to the replaced master key.

[0111] In an implementation manner, the sending module 620 is further configured to generate a private key of a second elliptic curve of the client; generate a public key of the second elliptic curve according to the first message and the private key of the second elliptic curve; and send the public key of the second elliptic curve to the server as a second message.

[0112] In an implementation manner, the first obtaining module 610 is further configured to generate a first digest message by digesting a message sent during handshake with the server; encrypt the first digest message by using the session key to obtain a first encrypted digest message; and send the first encrypted digest message to the server, the first encrypted digest message carrying verification information.

[0113] In an implementation manner, the first obtaining module 610 is further configured to receive a second encrypted digest message sent by the server, decrypt the second encrypted digest message by using the session key to obtain a second digest message; and perform session key verification by using the first digest message and the second digest message.

[0114] In an implementation manner, the first message comprises certificate information of the server, and the first obtaining module 610 is further configured to verify the certificate information of the server by using a certificate public key.

[0115] The communication apparatus in the embodiments of the present application can be an apparatus, a component in a terminal, an integrated circuit, or a chip. The apparatus can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., which are not limited in the embodiments of the present application.

[0116] The communication apparatus in the embodiments of the present application can be an apparatus with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating systems, which are not limited in the embodiments of the present application.

[0117] The communication apparatus provided in the embodiments of the present application can implement Figure 1 The method embodiments implement various processes, which are not repeated here to avoid repetition.

[0118] Figure 7 FIG. 7 is a structural schematic diagram of another communication apparatus according to an embodiment of the present application, which is applied to a server. As shown in Figure 7 The communication apparatus 700 includes a receiving module 710, a second obtaining module 720, a second generating module 730, and a second communicating module 740.

[0119] The receiving module 710 is configured to receive a quantum key and a hash value of a key identifier of the quantum key sent by a client. The second obtaining module 720 is configured to obtain the quantum key according to the hash value. The second generating module 730 is configured to receive a second message sent by the client, and generate a session key according to the second message and the quantum key. The second communicating module 740 is configured to obtain the session key, and perform data encryption communication with the client.

[0120] In an implementation manner, the second obtaining module 720 is configured to obtain the quantum key matched with the hash value from the quantum key pool.

[0121] In an implementation manner, the second obtaining module 720 is further configured to: obtain a first elliptic curve, the first elliptic curve being used for key exchange; obtain a server random number according to the quantum key generation server; and obtain a public key of the first elliptic curve according to a base point of the first elliptic curve and a private key of the first elliptic curve; and send the server random number, the base point of the first elliptic curve and the public key of the first elliptic curve to the client as a first message.

[0122] In an implementation manner, the second message includes a public key of a second elliptic curve of the client, and the second generating module 740 is configured to: obtain a shared key according to the public key of the second elliptic curve, the private key of the first elliptic curve and the base point of the first elliptic curve; obtain a master key according to the server random number, a client random number and the shared key, the client random number being generated by the client according to the quantum key; replace the master key with the quantum key, and generate the session key according to the replaced master key.

[0123] In an implementation manner, the third sending module 730 is further configured to: obtain a second digest message by digesting a message sent during a handshake with the client; encrypt the second digest message by using the session key to obtain a second encrypted digest message; and send the second encrypted digest message to the client, the second encrypted digest message carrying verification information.

[0124] In an implementation manner, the receiving module 710 is further configured to: receive a first encrypted digest message sent by the client; decrypt the first encrypted digest message by using the session key to obtain a first digest message; and perform session key verification by using the first digest message and the second digest message.

[0125] In an implementation manner, the first message further includes certificate information of the server, and the certificate information is used for the client to verify the certificate information of the server by using a certificate public key.

[0126] The communication apparatus in the embodiments of the present application can be an apparatus, or a component, integrated circuit, or chip in a terminal. The apparatus can be a mobile electronic device, or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, tablet computer, notebook computer, palm computer, vehicle-mounted electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), teller machine, or self-service machine, etc., and the embodiments of the present application are not limited in this regard.

[0127] The communication apparatus in the embodiments of the present application can be an apparatus with an operating system. The operating system can be an Android operating system, an ios operating system, or other possible operating system, and the embodiments of the present application are not limited in this regard.

[0128] The communication apparatus provided in the embodiments of the present application can implement Figure 3 The method embodiments implement various processes, and to avoid repetition, the details are not described herein.

[0129] Optionally, as shown in Figure 8 The embodiments of the present application further provide an electronic device 800, which comprises a processor 801 and a memory 802, and the memory 802 stores programs or instructions which can run on the processor 801. When the programs or instructions are executed by the processor 801, the following steps are implemented: obtaining a quantum key and a key identifier of the quantum key; sending a hash value of the quantum key and the key identifier to a server; receiving a first message sent by the server, generating a session key according to the quantum key and the first message; obtaining the session key, and performing data encryption communication with the server.

[0130] In an implementation, the first message comprises a server random number, a first base point of an elliptic curve of the server, a public key of the first elliptic curve, a shared key is obtained according to the public key of the first elliptic curve, a private key of a second elliptic curve of a client and the first base point of the elliptic curve, the first elliptic curve is used for key exchange; a master key is calculated according to the server random number, a client random number and the shared key, the server random number is generated by the server according to the quantum key, and the client random number is generated by the client according to the quantum key; the quantum key is replaced by the master key, and the session key is generated according to the replaced master key.

[0131] In an implementation, after the first message sent by the server is received, the private key of the second elliptic curve of the client is generated according to the quantum key and the first message; the public key of the second elliptic curve is generated according to the first message and the private key of the second elliptic curve; and the public key of the second elliptic curve is sent to the server as a second message.

[0132] In an implementation, after the session key is generated according to the quantum key and the first message, a first digest message is obtained by digesting the messages sent during the handshake with the server; the first digest message is encrypted by the session key to obtain a first encrypted digest message; and the first encrypted digest message is sent to the server, and the first encrypted digest message carries verification information.

[0133] In an implementation, after the first digest message is obtained, a second encrypted digest message sent by the server is received, the second encrypted digest message is decrypted according to the session key to obtain a second digest message; and the session key is verified by the first digest message and the second digest message.

[0134] In an implementation, the first message comprises certificate information of the server, and before the session key is generated according to the quantum key and the first message, the certificate information of the server is verified by a certificate public key.

[0135] Alternatively, the program or instructions are executed by the processor 801 to implement: receiving a quantum key and a hash value of a key identifier of the quantum key sent by a client; obtaining the quantum key according to the hash value; receiving a second message sent by the client, and generating a session key according to the second message and the quantum key; and obtaining the session key and performing encrypted communication with the client.

[0136] In an implementation, the quantum key matched with the hash value is obtained from the quantum key pool.

[0137] In an implementation manner, after the quantum key is obtained according to the hash value, a server random number is generated according to the quantum key; a first elliptic curve is obtained, the first elliptic curve being used for key exchange; a public key of the first elliptic curve is obtained according to a base point of the first elliptic curve and a private key of the first elliptic curve; and the server random number, the base point of the first elliptic curve and the public key of the first elliptic curve are sent to the client as a first message.

[0138] In an implementation manner, the second message includes a public key of a second elliptic curve of the client, a shared key is obtained according to the public key of the second elliptic curve, the private key of the first elliptic curve and the base point of the first elliptic curve; a master key is calculated according to the server random number, a client random number and the shared key, the client random number being generated by the client according to the quantum key; the quantum key is replaced by the master key, and the session key is generated according to the replaced master key.

[0139] In an implementation manner, after the session key is generated according to the second message and the quantum key, a second digest message is obtained by digesting a message sent during a handshake with the client; a second encrypted digest message is obtained by encrypting the second digest message through the session key; and the second encrypted digest message is sent to the client, the second encrypted digest message carrying verification information.

[0140] In an implementation manner, after the second digest message is obtained, a first encrypted digest message sent by the client is received; a first digest message is obtained by decrypting the first encrypted digest message through the session key; and session key verification is performed through the first digest message and the second digest message.

[0141] In an implementation manner, the first message further includes certificate information of the server, the certificate information being used for the client to verify the certificate information of the server through a certificate public key.

[0142] The specific implementation steps can refer to the steps of the communication method embodiments described above, and the same technical effects can be achieved. To avoid repetition, details are not described here.

[0143] It should be noted that the electronic device in the embodiments of the present application includes a server, a terminal or other devices other than a terminal.

[0144] The above electronic device structure does not constitute a limitation on the electronic device, which can include more or fewer components than those shown, or combine some components, or have different arrangements of components, for example, the input unit can include a Graphics Processing Unit (GPU) and a microphone, and the display unit can be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes at least one of a touch panel and other input devices. The touch panel is also referred to as a touch screen. The other input devices can include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), a trackball, a mouse, a joystick, and the like, which will not be described here.

[0145] The memory can be used to store software programs and various data. The memory can mainly include a first storage area storing programs or instructions and a second storage area storing data, wherein the first storage area can store an operating system, application programs or instructions required by at least one function (such as a sound playing function, an image playing function, etc.), and the like. In addition, the memory can include a volatile memory or a non-volatile memory, or the memory can include both volatile and non-volatile memories. The non-volatile memory can be a Read-Only Memory (ROM), a Programmable ROM (PROM), an Erasable PROM (EPROM), an Electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a Random Access Memory (RAM), a Static RAM (SRAM), a Dynamic RAM (DRAM), a Synchronous DRAM (SDRAM), a Double Data Rate SDRAM (DDR SDRAM), an Enhanced SDRAM (ESDRAM), a Synchlink DRAM (SLDRAM), and a Direct Rambus RAM (DRRAM).

[0146] The processor can include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to operating systems, user interfaces, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It can be understood that the above-mentioned modem processor can also not be integrated into the processor.

[0147] The embodiments of the present application also provide a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to implement various processes of the above-mentioned communication method embodiments and achieve the same technical effects. To avoid repetition, details are not described herein.

[0148] The processor is the processor in the electronic device described in the above-mentioned embodiments. The readable storage medium includes a computer readable storage medium, such as a ROM, a RAM, a magnetic disk, or an optical disk.

[0149] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article, or device that includes the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to the order of performing the functions shown or discussed, and can also include performing the functions in a substantially simultaneous manner or in reverse order, for example, the described method can be performed in an order different from that described, and various steps can also be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0150] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and necessary general hardware platforms, of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present application.

[0151] The embodiments of the present application are described above with reference to the accompanying drawings, but the present application is not limited to the specific embodiments described above, and the specific embodiments described above are merely illustrative, but not restrictive, and a person of ordinary skill in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims.

Claims

1. A communication method, characterized in that: Applied to the client, including: Obtaining a quantum key and a key identifier of the quantum key; Sending the quantum key and a hash value of the key identifier to a server; receiving a first message sent by the server, and generating a session key according to the quantum key and the first message; Obtain the session key and perform data encryption communication with the server.

2. The communication method according to claim 1, wherein: The first message includes a server random number, a base point of a first elliptic curve of the server, and a public key of the first elliptic curve, and generating a session key according to the quantum key and the first message includes: Obtaining a shared key based on a public key of the first elliptic curve, a private key of a second elliptic curve of the client, and a base point of the first elliptic curve, wherein the first elliptic curve is used for key exchange; Calculate a master key based on the server random number, the client random number, and the shared key, where the server random number is generated by the server based on the quantum key, and the client random number is generated by the client based on the quantum key; The master key is replaced by the quantum key, and the session key is generated according to the replaced master key.

3. The communication method according to claim 2, wherein: After receiving the first message sent by the server and generating a first session key according to the quantum key and the first message, the method further includes: Generating a second elliptic curve private key for the client; Generate a public key of the second elliptic curve according to the first message and the private key of the second elliptic curve; The public key of the second elliptic curve is sent to the server as a second message.

4. The communication method according to claim 1, wherein: After generating a session key according to the quantum key and the first message, the method further includes: Summarize the message sent during the handshake with the server to obtain a first summary message; encrypting the first summary message using the session key to obtain a first encrypted summary message; The first encrypted summary message is sent to the server, where the first encrypted summary message carries verification information.

5. The communication method according to claim 4, wherein: After obtaining the first summary message, the method further includes: receiving a second encrypted summary message sent by the server; decrypting the second encrypted summary message according to the session key to obtain a second summary message; A session key verification is performed using the first digest message and the second digest message. The communication method according to claim 1 , wherein: The first message includes the certificate information of the server, and before generating the session key according to the quantum key and the first message, further includes: The server's certificate information is verified using the certificate public key.

7. A communication method, characterized in that: Applicable to servers, including: Receiving a quantum key and a hash value of a key identifier of the quantum key sent by a client; Obtaining the quantum key according to the hash value; receiving a second message sent by the client, and generating a session key according to the second message and the quantum key; Obtain the session key and perform data encryption communication with the client.

8. The communication method according to claim 7, wherein: The obtaining of the quantum key according to the hash value includes: The quantum key matching the hash value is obtained from the quantum key pool.

9. The communication method according to claim 7, wherein: After obtaining the quantum key according to the hash value, the method further includes: Generate a server random number based on the quantum key; Obtaining a first elliptic curve, where the first elliptic curve is used for key exchange; Obtaining a public key of the first elliptic curve according to a base point of the first elliptic curve and a private key of the first elliptic curve; The server random number, the base point of the first elliptic curve, and the public key of the first elliptic curve are sent to the client as a first message.

10. The communication method according to claim 9, wherein: The second message includes a public key of a second elliptic curve of the client, and generating the session key according to the second message and the quantum key includes: Obtaining a shared key according to the public key of the second elliptic curve, the private key of the first elliptic curve, and a base point of the first elliptic curve; Calculate a master key based on the server random number, the client random number, and the shared key, where the client random number is generated by the client based on the quantum key; The master key is replaced by the quantum key, and the session key is generated according to the replaced master key.

11. The communication method according to claim 7, wherein: After generating the session key according to the second message and the quantum key, the method further includes: Digest the message sent during the handshake with the client to obtain a second summary message; encrypting the second summary message using the session key to obtain a second encrypted summary message; The second encrypted summary message is sent to the client, where the second encrypted summary message carries verification information.

12. The communication method according to claim 11, wherein: After obtaining the second summary message, the method further includes: receiving a first encrypted summary message sent by the client; decrypting the first encrypted summary message according to the session key to obtain a first summary message; A session key verification is performed using the first digest message and the second digest message.

13. The communication method according to claim 9, wherein: The first message also includes the certificate information of the server, and the certificate information is used by the client to verify the certificate information of the server through the certificate public key.

14. An electronic device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the communication method according to any one of claims 1 to 6 or the steps of the communication method according to any one of claims 7 to 13.

15. A readable storage medium, characterized in that The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the communication method according to any one of claims 1 to 6 or the steps of the communication method according to any one of claims 7 to 13 are implemented.

Images