Communication system and method of super SIM card integrated with QRNG

Abstract

The invention discloses a communication system of a QRNG-integrated super SIM card. The communication system comprises a quantum key management system, a mobile communication terminal device SDK and a super SIM card, the quantum key management system forms and sends first encrypted data to a mobile communication terminal device SDK, and the mobile communication terminal device SDK allows data interaction between the quantum key management system and the super SIM card; quantum random numbers are generated in the super SIM card, and the quantum random numbers are called by a data interface and serve as parameters of symmetric password and asymmetric password operation processes. The invention relates to a super SIM (Subscriber Identity Module) card scheme integrated with QRNG, which is not limited to a quantum key storage medium and a carrier, and is endowed with quantum true randomness capability based on quantum mechanics, meanwhile, the influence range of a single-point randomness failure risk existing when a quantum key management system is used as a single key source is reduced, and the accuracy of the quantum key management system is improved. The quantum technology is deeply integrated into the mobile communication terminal, and the application scene of the quantum technology in the communication terminal is expanded.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of quantum secure communication, in particular to a communication system and method of a super SIM card integrated with a QRNG, and a super SIM card and a quantum key management system. BACKGROUND

[0002] A physical quantity is quantized if there is a smallest indivisible basic unit, and the smallest unit is called a quantum. The unique properties of the quantum world bring natural randomness to quantum technology, which can generate truly random numbers. True random numbers have the characteristics of disorder, non-repeatability and unpredictability, and are an indispensable means for information security protection technology in the quantum computing environment. As early as 2017, the official website of the National Cryptography Administration has popularized the scientific nature and importance of quantum random numbers in cryptography to the public. It is clear that any random number generated based on a classical process (i.e., a process of classical mechanics) is not truly random in nature, but only a combination of probabilities of deterministic events. Only quantum random numbers are based on the inherent randomness of quantum mechanics and are the only random number generator that can generate completely unpredictable random sequences in theory so far. Quantum random numbers are true random numbers generated by quantum random processes. Quantum random processes refer to processes that have random characteristics according to the principles or assumptions of quantum mechanics, such as non-intrinsic measurement processes of quantum state measurement, initial phases of spontaneous radiation, etc.

[0003] A quantum random number generator (QRNG) is based on the inherent randomness of quantum mechanics and is the only random number generator that can generate completely unpredictable random sequences in theory so far. As a quantum key source, the quantum random number generator ensures the quality of the generated key.

[0004] In cryptography, the most important thing is the key. The Kerckhoffs principle in cryptography: "As long as the key is not leaked, the system is secure, even if any details of the system are known to others". The Kerckhoffs principle is one of the most basic concepts of network security. Claude Shannon, the inventor of information theory, has a similar saying: "The enemy knows the system", which is called Shannon's axiom. Any existing or future cryptographic system must be based on high-quality key generation, i.e., a third party must be impossible to guess or infer the key. The key is composed of a random sequence and must be a true random number that is unpredictable or decipherable. Quantum random numbers are based on the "intrinsic randomness" of microscopic particles and are "true" random numbers that provide a more secure key generation method for the quantum era, generate higher quality keys, and provide a higher level of security trust.

[0005] The main function of the traditional SIM card is to identify the identity of the SIM card holder and charge the traffic generated during the communication process using the pre-set key. The SIM card is a computer chip that stores digital mobile phone customer information for GSM network to identify and verify the user's identity. The pre-set and stored key in the SIM card is mainly used for authentication and protection of the card holder's identity information, negotiation of session key to ensure the security of communication content.

[0006] The super SIM card is a multifunctional card that combines the functions of traditional SIM cards and memory cards. The super SIM card has been deployed and issued by China Mobile, China Telecom and China Unicom, aiming to meet the needs of the 5G era. The super SIM card not only has the functions of traditional SIM cards such as phone, SMS and Internet access, but also integrates storage functions into the SIM card through innovative chip technology, supporting higher storage capacity. The super SIM card has wide applications in digital identity verification, hotel check-in, scenic spot ticket verification, etc. Users can verify their digital identity through the super SIM card without carrying physical ID cards, which can replace traditional bank cards, transportation cards, etc., and realize the application of various life scenarios.

[0007] The quantum security super SIM card is a new type of communication security product that combines the functions of super SIM cards and quantum technology. It is designed to meet the application needs of mobile terminals, especially mobile phone terminals for quantum keys. Currently, the method of offline filling is mainly used to fill a certain amount of pre-generated quantum keys into the secure storage area of the SIM card, and the SIM card is distributed to mobile terminal users. The entire key offline filling operation is carried out in a secure physical environment to ensure the security of the key distribution process. For example, the publication number CN 116886277A, published on October 13, 2023, and the patent name "Quantum Key Encryption Method and Device Based on Super SIM Card" discloses a method comprising the following steps: access authentication with a quantum key server to connect the quantum key server to the client; call the interface provided by the quantum key server to upload the data to be encrypted to the quantum key server for primary encryption, and the encrypted data is uploaded to the application server by the quantum key server for secondary encryption; call the interface to receive the secondary encrypted data and decrypt the encrypted data.

[0008] However, due to the limited storage space for quantum-related services in the SIM card, the amount of keys that can be filled in one filling is also limited, usually tens to hundreds of Kbits. Therefore, after the pre-loaded keys are consumed, the quantum mobile terminal user is usually required to carry the terminal security medium to the designated point of the service operator and connect with the quantum key filling device to supplement the quantum key.

[0009] The above quantum technology has some disadvantages when combined with the super SIM card:

[0010] On the one hand, frequent user-side factory key refilling is not conducive to large-scale and normalized application, and therefore it is practically meaningful to realize key secure distribution through a wireless communication network, which is an effective way to solve the problem of quantum key mobile terminal deployment.

[0011] On the other hand, even if the SIM card is refilled with a key encryption key, the data encryption key is distributed online, and the security of all keys completely depends on the key management center, and the security risk of the key management center is fatal to the entire communication system.

[0012] In addition, quantum keys can only be used for communication transmission confidentiality protection using symmetric cryptography, and do not provide more security for more scenarios based on asymmetric cryptography for authenticity and non-repudiation.

[0013] There are two kinds of mainstream quantum security super SIM card-based communication systems and methods, both of which involve super SIM cards and quantum key management systems.

[0014] One communication method is that a quantum key is offline refilled in a super SIM card, the quantum key is used as a KEK (key encryption key), the true randomness of the KEK quantum key guarantees DEK (data encryption key) key distribution, and the DEK is used to guarantee the security of data encryption, and the DEK is uniformly generated by a quantum key management system. The disadvantage of this method is that DEK is generated and distributed by the quantum key management system, which has the risk of random single point failure affecting global terminals; in addition, the limited KEK pre-filled in the super SIM card is used to protect the online negotiation of DEK, so that the terminal local other applications (such as some public key system identity authentication, data storage, etc. cryptographic process) that need random numbers cannot effectively obtain quantum random numbers.

[0015] Another communication method is that a quantum key is offline refilled in a super SIM card, and the quantum key is used as a DEK to guarantee the security of data encryption. This method is simpler in implementation process, but because it lacks the design of KEK such as multi-level key, it is more vulnerable in key security. Moreover, there is also the risk of random single point failure affecting global terminals. SUMMARY

[0016] The technical problem to be solved by the present application is to realize a communication system and method of a super SIM card integrated with a QRNG, and a super SIM card and a quantum key management system, which can directly provide quantum keys for key application devices or programs by embedding a QRNG and adjusting key file storage space and data interaction interfaces on the basis of an existing super SIM card, thereby enhancing the security of a communication process.

[0017] To achieve the above-mentioned purpose, the technical solution adopted by the present application is as follows: a communication system of a super SIM card integrated with a QRNG, comprising a quantum key management system, a mobile communication terminal device SDK and a super SIM card;

[0018] The quantum key management system forms and sends first encrypted data to the mobile communication terminal device SDK.

[0019] The mobile communication terminal device SDK allows data interaction between the quantum key management system and the super SIM card.

[0020] The super SIM card internally generates quantum random numbers, which are called by a data interface as parameters for symmetric and asymmetric password operation processes.

[0021] The first encrypted data of the quantum key management system comprises a key encryption key KEK encrypted by an ECC public key.

[0022] In a key negotiation distribution mode, the quantum key management system obtains a data encryption key DEK for secure communication by means of decryption operation based on second encrypted data and a locally saved KEK.

[0023] In an initial parameter charging mode, the quantum key management system generates a key encryption key KEK based on its built-in QRNG, and encrypts the key encryption key KEK using an ECC public key; in a key negotiation distribution mode, the quantum key management system decrypts a data encryption key DEK encrypted by the KEK using the key encryption key KEK to obtain the data encryption key DEK.

[0024] The key encryption key KEK is a first symmetric key KEK; the data encryption key DEK is a second symmetric key DEK; and the public key and the private key are respectively a public key and a private key in an ECC public-private key pair.

[0025] Wherein, encryption and decryption are realized by means of symmetric encryption and decryption operation through XOR operation.

[0026] The quantum key management system comprises a data interface, a key encryption key generation module, a key data storage module and an encryption and decryption module.

[0027] The data interface is called to interact with the key data;

[0028] The key encryption key generation module is configured to generate a key encryption key KEK, and the key encryption key generation module generates a quantum random number based on the built-in QRNG and uses the quantum random number as the key encryption key;

[0029] The key data storage module is configured to store key data, and the key data includes the key encryption key KEK and the ECC public key;

[0030] The encryption and decryption module is configured to encrypt the key encryption key KEK by using the ECC public key by means of an encryption operation to form the first encrypted data in the initial parameter charging mode, and the encryption and decryption module is configured to obtain the data encryption key DEK from the second encrypted data by means of a decryption operation in the key negotiation distribution mode.

[0031] The mobile communication terminal device SDK is encapsulated as a software interface for data interaction with the quantum key management system and a software interface for data interaction with the super SIM card, and the super SIM card is defined with a software interface for being called by the mobile communication terminal device SDK to interact with data.

[0032] The super SIM card stores the first encrypted data in the initial parameter charging mode, obtains the key encryption key KEK by means of a decryption operation based on the first encrypted data and the locally saved ECC private key for secret transmission of the data encryption key DEK in the key negotiation distribution mode, and forms and sends the second encrypted data including the data encryption key DEK encrypted by the KEK in the key negotiation distribution mode.

[0033] The super SIM card pre-stores the key encryption key KEK encrypted by the ECC public key in the initial parameter charging mode, decrypts the key encryption key KEK encrypted by the ECC public key by using the ECC private key to obtain the key encryption key KEK in the key negotiation distribution mode, and generates the data encryption key DEK based on the built-in QRNG, and encrypts the data encryption key DEK by using the key encryption key KEK.

[0034] The QRNG integrated in the super SIM card replaces the physical random number generator or the algorithm random number generator in the conventional SIM card;

[0035] The quantum random number generated by the QRNG integrated in the super SIM card is used for random encryption key generation and random key seed generation of the SIM card itself each time.

[0036] The super SIM card comprises a data interface, a key data storage module, a data encryption key generation module, an encryption and decryption module, and a quantum random number generation module.

[0037] The data interface is configured to be called to interact with the key data and quantum random numbers.

[0038] The key data storage module is configured to store key data, wherein the key data comprises first encryption data and an ECC private key, and the first encryption data comprises a key encryption key KEK encrypted by an ECC public key.

[0039] The data encryption key generation module is configured to generate a data encryption key DEK, and the data encryption key generation module generates quantum random numbers based on an embedded QRNG and uses the quantum random numbers as the data encryption key.

[0040] The quantum random number generation module is configured to generate quantum random numbers, and the quantum random numbers are generated based on an embedded QRNG. The quantum random numbers are called by the data interface and can be used as parameters for symmetric and asymmetric cryptographic operations. The symmetric cryptographic operation parameters include keys, and the asymmetric cryptographic operation parameters include initial values, challenge values, and passwords. The data encryption key generation module generates the data encryption key in response to a data encryption key request.

[0041] In the key agreement distribution mode, the encryption and decryption module is configured to obtain the key encryption key KEK from the first encryption data by means of decryption operation. In the key agreement distribution mode, the encryption and decryption module is configured to encrypt the data encryption key DEK by means of encryption operation using the key encryption key KEK to form the second encryption data. The encryption and decryption module realizes symmetric encryption and decryption operation by means of XOR operation.

[0042] A communication method of a super SIM card integrated with a QRNG, comprising an initial parameter filling step and a key agreement distribution step:

[0043] The initial parameter filling step is configured to generate first encryption data and store the first encryption data in the super SIM card. The first encryption data comprises a key encryption key KEK encrypted by an ECC public key.

[0044] The key agreement distribution step is configured to generate second encryption data, wherein the second encryption data comprises a data encryption key DEK encrypted by the KEK; and obtain the key encryption key KEK from the first encryption data by means of decryption operation, and obtain the data encryption key DEK from the second encryption data.

[0045] Further comprising a step of configuring the mobile communication terminal device SDK to realize data interaction between the quantum key management system and the super SIM card.

[0046] In the initial parameter charging step, the quantum key management system generates the key encryption key KEK based on the built-in QRNG and encrypts the key encryption key KEK with the ECC public key;

[0047] In the initial parameter charging step, the super SIM card stores the key encryption key KEK encrypted by the ECC public key;

[0048] In the key negotiation distribution step, the super SIM card decrypts the first encrypted data with the ECC private key to obtain the key encryption key KEK; and the super SIM card generates the data encryption key DEK based on the built-in QRNG and encrypts the data encryption key DEK with the key encryption key KEK;

[0049] In the key negotiation distribution step, the quantum key management system decrypts the second encrypted data with the key encryption key KEK to obtain the data encryption key DEK;

[0050] In the key negotiation distribution step, the super SIM card generates the data encryption key DEK in response to a data encryption key request;

[0051] The key encryption key KEK is a first symmetric key KEK; the data encryption key DEK is a second symmetric key DEK; and the public key and the private key are respectively a public key and a private key in an ECC public-private key pair.

[0052] The application has the following advantages:

[0053] (1) The super SIM card integrated with QRNG is not limited to a quantum key storage medium or carrier;

[0054] The communication system and method mentioned in the application endow the super SIM card with quantum technology, which is not only a quantum key storage carrier, but also has the ability to generate quantum random numbers and perform quantum mechanical processes, and is a true quantum random number source;

[0055] (2) The influence range of the single-point randomness failure risk of the quantum key management system as a single key source is reduced;

[0056] The communication system and method mentioned in the application, from the influence of random single point failure, the randomness of the original single point quantum key management system fails in a period of time or is attacked, which will affect the key quality and security of N super SIM card terminals, because DEK is generated and distributed centrally.

[0057] (3) The quantum technology is deeply integrated into the mobile communication terminal, which expands the application scene of quantum technology in the communication terminal.

[0058] The communication system and method mentioned in the application, each super SIM card will have its own internal quantum random number source, so it can generate a continuous stream of quantum true random numbers for all cryptographic algorithm processes (not limited to the super SIM card itself), and build an independent cryptographic function domain. The super SIM card in the mobile phone is not only a cryptographic module that stores fixed symmetric keys, but also a quantum random number service output that provides quantum true random numbers to all cryptographic security applications on the mobile phone to meet their demand for high-quality true random numbers. BRIEF DESCRIPTION OF DRAWINGS

[0059] The content expressed in each figure in the specification of the application is briefly described as follows:

[0060] Figure 1 The communication system of the super SIM card integrated with QRNG is a flowchart for realizing initial parameter charging.

[0061] Figure 2 The communication system of the super SIM card integrated with QRNG is a flowchart for realizing key negotiation and distribution.

[0062] Figure 3 The architecture diagram of the overall composition of the super SIM card. DETAILED DESCRIPTION

[0063] The specific embodiments of the application will be further described in detail below with reference to the drawings, and the shape, structure, mutual position and connection relationship between parts, the function and working principle of each part, the manufacturing process and the operation and use method, etc. of the components involved in the application will be described in further detail to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the application.

[0064] The application discloses a communication system and method of a super SIM card integrated with a QRNG, and a super SIM card and a quantum key management system, which can provide quantum keys for key application devices or programs directly by means of the built-in QRNG and adjustment of key file storage space and data interaction interfaces on the basis of an existing super SIM card, and enhance the security of a communication process. The cooperation design based on an initial parameter charging mode and a key negotiation and distribution mode can effectively guarantee the real-time performance and security of data encryption key generation. Meanwhile, the design of the integrated QRNG can provide quantum true random number keys and parameters for the security application process of the super SIM card on the user side, such as authentication services, encryption and decryption operations and data storage, and improve the security and anti-repudiation of communication, and further expand the security capability of the super SIM card.

[0065] The communication system based on the quantum security SIM card integrated with the QRNG comprises a quantum key management system, a mobile communication terminal device SDK and a super SIM card.

[0066] The quantum key management system is used for forming and sending first encryption data in an initial parameter charging mode, wherein the first encryption data comprises a key encryption key KEK encrypted by an ECC public key; and obtaining a data encryption key DEK for secret communication by means of decryption operation based on second encryption data and the locally saved KEK in a key negotiation and distribution mode.

[0067] The mobile communication terminal device SDK is used for allowing data interaction between the quantum key management system and the super SIM card.

[0068] The super SIM card is used for storing the first encryption data in the initial parameter charging mode; obtaining the key encryption key KEK for secret transmission of the DEK by means of decryption operation based on the first encryption data and the locally saved ECC private key in the key negotiation and distribution mode; and forming and sending the second encryption data in the key negotiation and distribution mode, wherein the second encryption data comprises the data encryption key DEK encrypted by the KEK.

[0069] The quantum key management system generates the key encryption key KEK based on the built-in QRNG in the initial parameter charging mode, and encrypts the key encryption key KEK by using the ECC public key; and decrypts the data encryption key DEK encrypted by the KEK by using the key encryption key KEK to obtain the data encryption key DEK in the key negotiation and distribution mode.

[0070] Super SIM card: in the initial parameter filling mode, pre-storing the key encryption key KEK encrypted by the ECC public key; in the key agreement distribution mode, decrypting the key encryption key KEK encrypted by the ECC public key using the ECC private key to obtain the key encryption key KEK; generating a data encryption key DEK based on the built-in QRNG, and encrypting the data encryption key DEK using the key encryption key KEK.

[0071] Wherein, the key encryption key KEK is a first symmetric key KEK; the data encryption key DEK is a second symmetric key DEK; the public key and the private key are respectively a public key and a private key in an ECC public-private key pair.

[0072] Wherein, the encryption and decryption can realize symmetric encryption and decryption operations by means of XOR operation.

[0073] Wherein, the mobile communication terminal device SDK can be encapsulated as a software interface for data interaction with the quantum key management system, and a software interface for data interaction with the super SIM card; the super SIM card defines a software interface for being called by the mobile communication terminal device SDK to perform data interaction.

[0074] The communication method of the super SIM card integrated with the QRNG includes an initial parameter filling step and a key agreement distribution step.

[0075] The initial parameter filling step is used to generate first encryption data and store the first encryption data in the super SIM card, and the first encryption data includes a key encryption key KEK encrypted by an ECC public key.

[0076] The key agreement distribution step is used to generate second encryption data, and the second encryption data includes a data encryption key DEK encrypted by the KEK; and the data encryption key DEK is obtained from the first encryption data and the second encryption data by means of a decryption operation.

[0077] Wherein, in the initial parameter filling step, the key encryption key KEK is generated by the quantum key management system, and the key encryption key KEK is encrypted by the ECC public key.

[0078] Wherein, in the initial parameter filling step, the key encryption key KEK encrypted by the ECC public key is stored by the super SIM card.

[0079] Wherein, in the key agreement distribution step, the first encryption data belonging to the super SIM card is decrypted by the super SIM card using the ECC private key to obtain the key encryption key KEK belonging to the super SIM card; and the data encryption key DEK is generated by the super SIM card, and the data encryption key DEK is encrypted by the key encryption key KEK.

[0080] In the key agreement distribution step, the super SIM card decrypts the second encrypted data by using the key encryption key KEK to obtain the data encryption key DEK.

[0081] In the key agreement distribution step, the super SIM card generates the data encryption key DEK in response to a data encryption key request.

[0082] The communication method can further include a step of configuring the mobile communication terminal device SDK to enable data interaction between the quantum key management system and the super SIM card.

[0083] The key encryption key KEK is a first symmetric key KEK; the data encryption key DEK is a second symmetric key DEK; the public key and the private key are a public key and a private key in an ECC public-private key pair, respectively.

[0084] The super SIM card includes a data interface, a key data storage module, a data encryption key generation module, an encryption and decryption module, and a quantum random number generation module.

[0085] The data interface is called to interact with key data and quantum random numbers.

[0086] The key data storage module is used to store key data, wherein the key data includes first encrypted data and an ECC private key, and the first encrypted data includes a key encryption key KEK encrypted by an ECC public key.

[0087] The data encryption key generation module is used to generate a data encryption key DEK; the data encryption key generation module generates a quantum random number based on an embedded QRNG and uses it as a data encryption key.

[0088] The quantum random number generation module is used to generate a quantum random number; the quantum random number is generated based on an embedded QRNG; the quantum random number is called by the data interface and can be used as a parameter for symmetric and asymmetric cryptographic operations; the symmetric cryptographic operation parameters include keys, etc.; the asymmetric cryptographic operation parameters include initial values, challenge values, passwords, etc.

[0089] The data encryption key generation module generates a data encryption key in response to a data encryption key request.

[0090] The encryption and decryption module, in the key agreement distribution mode, is used to obtain the key encryption key KEK from the first encrypted data by means of decryption operation; the encryption and decryption module, in the key agreement distribution mode, is used to encrypt the data encryption key DEK by using the key encryption key KEK by means of encryption operation to form the second encrypted data.

[0091] The encryption and decryption module can realize symmetric encryption and decryption operation by means of XOR operation.

[0092] The quantum key management system comprises a data interface, a key encryption key generation module, a key data storage module, and an encryption and decryption module.

[0093] The data interface is configured to be called to interact with the key data.

[0094] The key encryption key generation module is configured to generate a key encryption key KEK. The key encryption key generation module generates a quantum random number based on a built-in QRNG and uses the quantum random number as the key encryption key.

[0095] The key data storage module is configured to store key data, wherein the key data comprises the key encryption key KEK and an ECC public key.

[0096] The encryption and decryption module is configured to, in an initial parameter charging mode, encrypt the key encryption key KEK by means of an encryption operation using the ECC public key to form first encrypted data. The encryption and decryption module is configured to, in a key agreement distribution mode, obtain a data encryption key DEK from second encrypted data by means of a decryption operation.

[0097] The encryption and decryption module can implement a symmetric encryption and decryption operation by means of an XOR operation.

[0098] According to the application, the communication system based on the super SIM card integrated with the QRNG can comprise a quantum key management system, a mobile communication terminal device SDK, and a super SIM card.

[0099] The quantum key management system can work in an initial parameter charging mode and a key agreement distribution mode.

[0100] In the initial parameter charging mode, the quantum key management system generates a key encryption key KEK based on its built-in QRNG, encrypts the key encryption key KEK using an ECC public key to form first encrypted data, and sends the first encrypted data to the mobile communication terminal device SDK through a network. The first encrypted data comprises the key encryption key KEK encrypted by the ECC public key.

[0101] In the key agreement distribution mode, the quantum key management system obtains second encrypted data from the mobile communication terminal device SDK through a network, and decrypts the second encrypted data using a pre-stored key encryption key KEK to obtain a data encryption key DEK. The second encrypted data comprises the data encryption key DEK encrypted by the KEK.

[0102] As an example, the public key can be an ECC public key. As an example, the symmetric encryption operation can be performed by means of an XOR operation.

[0103] In an embodiment, the quantum key management system can include a data interface, a key encryption key generation module, a key data storage module, and an encryption and decryption module.

[0104] The data interface can be used for data interaction with the outside (e.g. mobile communication terminal SDK), such as outputting the first encrypted data, and receiving the second encrypted data.

[0105] The key encryption key generation module can generate the first symmetric key KEK in the initial parameter charging mode, which is based on the quantum random number generated by the QRNG built-in in the key encryption key generation module.

[0106] The key data storage module can store the first symmetric key KEK in the initial parameter charging mode. The key data storage module can receive and store the second encrypted data from the mobile communication terminal SDK in the key agreement distribution mode.

[0107] The encryption and decryption module can be used to perform an encryption operation to generate the first encrypted data, and perform a decryption operation to obtain the second symmetric key. Wherein, in the initial parameter charging mode, the first symmetric key can be encrypted by the ECC public key to form the first encrypted data. In the key agreement distribution mode, the second encrypted data is decrypted by the pre-stored first symmetric key in the key data storage module, and the second symmetric key DEK is obtained from the second encrypted data and used as a data encryption key for secure communication.

[0108] The mobile communication terminal device SDK can be packaged with a software interface for data interaction with the quantum key management system, and a software interface for data interaction with the super SIM card, thereby providing a data channel between the quantum key management system and the super SIM card to allow data interaction between the quantum key management system and the super SIM card. Therefore, the mobile communication terminal device SDK itself does not store task key related data.

[0109] At the same time, the super SIM card vendor can define a software interface for allowing the mobile communication terminal device SDK to call for data interaction.

[0110] In addition, the super SIM card also works in the initial parameter charging mode and the key agreement distribution mode.

[0111] In the initial parameter charging mode, the super SIM card can receive and store the first encrypted data through the mobile communication terminal device SDK.

[0112] In the key agreement distribution mode, the super SIM card can receive and store the second encrypted data from the mobile communication terminal device SDK, and decrypt the first symmetric key KEK encrypted by the public key in the first encrypted data using the pre-stored corresponding private key (such as the ECC private key) to obtain the first symmetric key KEK; generate a quantum random number based on the built-in QRNG as a second symmetric key, and encrypt the second symmetric key using the first symmetric key to obtain the second encrypted data sent to the mobile communication terminal device SDK.

[0113] As can be seen, in the initial parameter filling mode, the key-related data stored in the super SIM card is in an encrypted form (stored in the form of first encrypted data), and only in the key agreement distribution mode, the quantum random number generated by the built-in QRNG is used as the second symmetric key as the data encryption key. The data encryption key is generated and distributed in real time, and is used for secure communication.

[0114] As an implementation, the super SIM card can include a data interface, a key data storage module, a data encryption key generation module, an encryption and decryption module, and a quantum random number generation module.

[0115] The data interface can allow data interaction between the called (such as the mobile communication terminal SDK), such as outputting the second encrypted data, and receiving the first encrypted data. It can also be used for quantum random number interaction.

[0116] The key data storage module can be used to store key data, such as including the first encrypted data, the second symmetric key, and the ECC private key. The second symmetric key DEK is used for the secure communication process.

[0117] The data encryption key generation module can generate a quantum random number based on the built-in QRNG as the second symmetric key DEK in the initial parameter filling mode. The data encryption key generation module generates a quantum random number in response to a data encryption key request from, for example, the mobile communication terminal SDK, and generates a quantum random number according to the request.

[0118] The encryption and decryption module can be used to perform encryption operations to generate the second encrypted data, and to perform decryption operations to obtain the first symmetric key. In the key agreement distribution mode, the first encrypted data is decrypted using the pre-stored ECC private key to obtain the first symmetric key KEK; the second symmetric key is encrypted using the first symmetric key to form the second encrypted data sent to the mobile communication terminal SDK.

[0119] The quantum random number generation module generates quantum random numbers based on the built-in QRNG; the generated quantum random numbers are called by the data interface and can be used for parameters of symmetric and asymmetric cryptographic operation processes; the symmetric cryptographic process parameters include keys and the like; the asymmetric cryptographic process parameters include initial values, challenge values, passwords and the like.

[0120] The workflow of the communication method of the super SIM card integrated with the QRNG will be further described below, so as to better understand the working principle of the communication system of the application.

[0121] Figure 1 A flowchart for implementing initial parameter filling of the communication system of the super SIM card integrated with the QRNG according to the application is shown.

[0122] As Figure 1 shown, in the initial parameter filling mode, the initial parameter filling step is performed.

[0123] In the initial parameter filling step, the quantum key management system generates a first symmetric key KEK based on the built-in QRNG and encrypts the first symmetric key by using the ECC public key to obtain the first symmetric key encrypted by the ECC public key. Thus, the quantum key management system forms the first encrypted data, including the first symmetric key KEK encrypted by the ECC public key.

[0124] Subsequently, the quantum key management system sends the first encrypted data to the mobile communication terminal device SDK.

[0125] The mobile communication terminal device SDK stores the first encrypted data in the super SIM card by means of the data interface and the data interface of the super SIM card, thereby allowing the initial parameter filling of the super SIM card.

[0126] Figure 2 A flowchart for implementing key agreement distribution of the communication system of the super SIM card integrated with the QRNG according to the application is shown.

[0127] When the upper layer application requires communication, i.e. in the key agreement distribution mode, the data encryption key agreement step is performed.

[0128] As Figure 2 shown, in the data encryption key agreement step, the data encryption key agreement request is sent to the super SIM card via the mobile communication terminal device SDK to apply for the data encryption key of the current communication.

[0129] The super SIM card responds to the data encryption key negotiation request, generates a second symmetric key (for example, a 128-bit key for one-time SM4 encryption) based on the built-in QRNG, as a data encryption key DEK for this communication encryption negotiation, and pre-stores it locally; at the same time, the super SIM card decrypts the first symmetric key KEK encrypted by the ECC public key in the pre-stored first encrypted data using the pre-stored ECC private key. The super SIM card encrypts the second symmetric key DEK using the decrypted first symmetric key KEK to form second encrypted data and sends it to the mobile communication terminal device SDK.

[0130] The mobile communication terminal device SDK calls the data interface of the super SIM to obtain the second encrypted data and sends it to the data interface of the quantum key management system via the network.

[0131] The quantum key management system receives the second encrypted data from the mobile communication terminal device SDK via the data interface and decrypts it using the pre-stored first symmetric key KEK to obtain the second symmetric key.

[0132] At this time, the second symmetric key DEK as the data encryption key has been stored in the super SIM card in plaintext. Therefore, the two parties of the communication service (the quantum key management system side and the super SIM card side) can use the second symmetric key KEK as the data encryption key for secure communication.

[0133] In summary, the communication system and method of the super SIM card integrated with QRNG according to the application can provide quantum keys for key application devices or programs directly based on the existing traditional super SIM card by built-in QRNG, adjusting the key file storage space and data interaction interface, and enhancing the security of the communication process. Based on the cooperation design of the initial parameter charging mode and the key negotiation distribution mode, the real-time performance and security of the data encryption key generation can be effectively guaranteed. The freshness of the data encryption key generation and the security of the negotiation between the service side of the quantum key management system and the terminal side using the super SIM card can be ensured, and the data transmission and communication process can be protected. At the same time, the design of integrating QRNG can provide quantum true random number keys and parameters for the authentication service, encryption and decryption operation, data storage and other security application processes of the super SIM card on the user side, improve the security and anti-repudiation of the communication, and further expand the security capabilities of the super SIM card.

[0134] Glossary:

[0135] KEK (Key Encryption Key): Key Encryption Key.

[0136] DEK (Data Encryption Key): Data Encryption Key.

[0137] ECC public key: a set of encryption and decryption public and private key pairs generated by the super SIM card based on the random number parameters generated by the built-in QRNG, the private key is saved locally by the super SIM card, the public key can be disclosed to the other party, the ciphertext information encrypted by the public key of the other party can only be decrypted by the super SIM card holding the private key. The public key in the public and private key pair is the ECC public key.

[0138] ECC private key: a set of encryption and decryption public and private key pairs generated by the super SIM card based on the random number parameters generated by the built-in QRNG, the private key is saved locally by the super SIM card, the public key can be disclosed to the other party, the ciphertext information encrypted by the public key of the other party can only be decrypted by the super SIM card holding the private key. The private key in the public and private key pair is the ECC private key.

[0139] The communication system and method of the super SIM card integrated with the QRNG, and the super SIM card and the quantum key management system can directly provide quantum keys for the upper key application device or program based on the existing super SIM card by built-in QRNG, adjusting the key file storage space and data interaction interface, and enhancing the security of the communication process. The cooperation design based on the initial parameter charging mode and the key negotiation distribution mode can effectively ensure the real-time generation of the data encryption key and the security of the distribution.

[0140] Meanwhile, the integrated QRNG can provide quantum random number keys and parameters for the super SIM card in the user side authentication service, encryption and decryption operation, data storage and other security application processes, improve the security and anti-repudiation of the communication, and further expand the security capability of the super SIM card; the integrated QRNG can also be used for the security process of random encryption key generation, random key seed generation or other entropy generation of the SIM card itself each time.

[0141] The communication system and method, and the super SIM card and the quantum key management system mentioned in the application are a high-security wireless physical layer security technology key wireless distribution scheme, further expand the security capability of the super SIM card, and are a deeper quantum technology in mobile communication network security fusion application, which makes the quantum technology deeply integrated into the mobile communication terminal.

[0142] The application is exemplarily described above in combination with the drawings, and it is obvious that the specific implementation of the application is not limited by the above manner, as long as various non-essential improvements are made by adopting the method concept and technical scheme of the application, or the concept and technical scheme of the application are directly applied to other occasions without improvement, all of which are within the protection scope of the application.

Claims

1. A communication system of an integrated QRNG super-SIM card, characterized in that: A quantum key management system, a mobile communication terminal device SDK, and a super SIM card are included. The quantum key management system forms and sends first encrypted data to the mobile communication terminal device SDK. The mobile communication terminal device SDK allows data interaction between the quantum key management system and the super SIM card. The super SIM card internally generates quantum random numbers, which are called by a data interface as parameters for symmetric and asymmetric cryptographic operation processes.

2. The communication system of super SIM card integrated with QRNG according to claim 1, characterized in that: The first encrypted data of the quantum key management system includes a key encryption key KEK encrypted by an ECC public key. In a key agreement distribution mode, the quantum key management system obtains a data encryption key DEK for secure communication by means of decryption operation based on second encrypted data and a locally saved KEK. In an initial parameter charging mode, the quantum key management system generates a key encryption key KEK based on its built-in QRNG, encrypts the key encryption key KEK using an ECC public key, and in a key agreement distribution mode, decrypts a KEK-encrypted data encryption key DEK using the key encryption key KEK to obtain the data encryption key DEK. The key encryption key KEK is a first symmetric key KEK, the data encryption key DEK is a second symmetric key DEK, and the public key and the private key are a public key and a private key in an ECC public-private key pair. The encryption and decryption are implemented by means of symmetric encryption and decryption operation through XOR operation.

3. The communication system of super-SIM card integrated with QRNG according to claim 1 or 2, characterized in that: The quantum key management system includes a data interface, a key encryption key generation module, a key data storage module, and an encryption and decryption module. The data interface is called to interact with the key data. The key encryption key generation module generates a key encryption key KEK, and the key encryption key generation module generates a quantum random number based on a built-in QRNG and uses it as a key encryption key. The key data storage module stores key data, and the key data includes a key encryption key KEK and an ECC public key. In the initial parameter charging mode, the encryption and decryption module encrypts the key encryption key KEK using the ECC public key by means of encryption operation to form the first encrypted data, and in the key agreement distribution mode, the encryption and decryption module obtains the data encryption key DEK from the second encrypted data by means of decryption operation.

4. The communication system of super SIM card integrated with QRNG as claimed in claim 1, wherein: The mobile communication terminal device SDK is encapsulated as a software interface for data interaction with the quantum key management system and a software interface for data interaction with the super SIM card. The super SIM card defines a software interface for being called by the mobile communication terminal device SDK to interact with data.

5. The communication system of the super SIM card integrated with QRNG according to claim 1, characterized in that: The super SIM card stores the first encrypted data in an initial parameter filling mode; in a key agreement distribution mode, the first encrypted data and a locally saved ECC private key are used to obtain the key encryption key KEK for secret transmission of the data encryption key DEK through decryption operation; and in the key agreement distribution mode, the second encrypted data is formed and sent, the second encrypted data including the data encryption key DEK encrypted by the KEK; The super SIM card pre-stores the key encryption key KEK encrypted by the ECC public key in the initial parameter filling mode; In the key agreement distribution mode, the key encryption key KEK encrypted by the ECC public key is decrypted using the ECC private key to obtain the key encryption key KEK; the data encryption key DEK is generated based on the built-in QRNG, and the data encryption key DEK is encrypted using the key encryption key KEK; The QRNG integrated in the super SIM card replaces the physical random number generator or algorithm random number generator in the traditional SIM card; The quantum random number generated by the QRNG integrated in the super SIM card is used for random encryption key generation and random key seed generation of the SIM card itself each time.

6. The communication system of super SIM card integrated with QRNG according to claim 1 or 5, characterized in that: The super SIM card includes a data interface, a key data storage module, a data encryption key generation module, an encryption and decryption module, and a quantum random number generation module; The data interface is used to be called to interact the key data and the quantum random number; The key data storage module is used to store the key data, wherein the key data includes the first encrypted data and the ECC private key, and the first encrypted data includes the key encryption key KEK encrypted by the ECC public key; The data encryption key generation module is used to generate the data encryption key DEK; the data encryption key generation module generates the quantum random number based on the built-in QRNG, and uses the quantum random number as the data encryption key; The quantum random number generation module is used to generate the quantum random number; the quantum random number is generated based on the built-in QRNG; the quantum random number is called by the data interface and can be used for parameters of symmetric cipher and asymmetric cipher operation processes; the symmetric cipher process parameters include keys; the asymmetric cipher process parameters include initial values, challenge values, and passwords; the data encryption key generation module generates the data encryption key in response to a data encryption key request; In the key agreement distribution mode, the encryption and decryption module is used to obtain the key encryption key KEK from the first encrypted data through decryption operation; in the key agreement distribution mode, the encryption and decryption module is used to encrypt the data encryption key DEK using the key encryption key KEK through encryption operation to form the second encrypted data; and the encryption and decryption module realizes symmetric encryption and decryption operation through XOR operation.

7. A communication method of an integrated QRNG super-SIM card, characterized in that, The method includes an initial parameter filling step and a key agreement distribution step: The initial parameter filling step is used to generate the first encrypted data and store the first encrypted data in the super SIM card, the first encrypted data including the key encryption key KEK encrypted by the ECC public key; The key agreement and distribution step is configured to generate second encrypted data including data encryption key DEK encrypted by KEK, and obtain the key encryption key KEK from the first encrypted data by means of a decryption operation, and obtain the data encryption key DEK from the second encrypted data.

8. The communication method of the super SIM card integrated with the QRNG according to claim 7, wherein: Further comprising a step of configuring a mobile communication terminal device SDK to realize data interaction between the quantum key management system and the super SIM card.

9. The communication method of the super SIM card integrated with the QRNG according to claim 8, wherein: In the initial parameter filling step, the key encryption key KEK is generated by the quantum key management system based on the built-in QRNG, and the key encryption key KEK is encrypted by the ECC public key; In the initial parameter filling step, the key encryption key KEK encrypted by the ECC public key is stored by the super SIM card.

10. The communication method of the super SIM card integrated with the QRNG according to claim 7, 8 or 9, wherein: In the key agreement and distribution step, the first encrypted data is decrypted by the super SIM card using the ECC private key to obtain the key encryption key KEK, and the data encryption key DEK is generated by the super SIM card based on the built-in QRNG, and the data encryption key DEK is encrypted by the key encryption key KEK; In the key agreement and distribution step, the second encrypted data is decrypted by the quantum key management system using the key encryption key KEK to obtain the data encryption key DEK; In the key agreement and distribution step, the super SIM card generates the data encryption key DEK in response to a data encryption key request; The key encryption key KEK is a first symmetric key KEK, the data encryption key DEK is a second symmetric key DEK, and the public key and the private key are respectively a public key and a private key in an ECC public-private key pair.

Images