Quantum key charging method and system, and electronic equipment

Abstract

The invention relates to the technical field of quantum communication, and discloses a quantum key charging method and system, and electronic equipment. The quantum key charging method is applied to a key management system and comprises the steps that a request sent by equipment is received, and the request is a key charging request or a key updating request; calling a lattice cryptographic algorithm to generate a public and private key pair; calling a white box encryption algorithm to encrypt a private key in the public and private key pair to obtain private key encryption data; public key and private key encryption data in the public and private key pair are sent to the equipment; and sending the quantum security key encrypted by the public key to the device, so that the device decrypts the encrypted quantum security key according to the private key encryption data, and performs key charging by using the decrypted quantum security key. And the security and flexibility of quantum key charging can be improved at least.

Description

Technical Field

[0001] This application relates to the field of quantum communication technology, and in particular to a quantum key injection method and system, and electronic equipment. Background Technology

[0002] Quantum encryption technology utilizes quantum principles to perform a series of encryption techniques, including key generation, plaintext obfuscation and encryption, ciphertext decryption, ciphertext communication, and anti-eavesdropping. Among these, quantum key injection is a crucial step. Currently, there are two injection methods: hardware injection and software injection. Hardware injection relies on a hard cryptographic card, while software injection relies on a software environment, requiring no dedicated hardware support, reducing reliance on manual intervention, supporting remote injection, and showing broad prospects.

[0003] However, the security and flexibility of existing quantum key injection schemes still need to be improved. Summary of the Invention

[0004] This application provides a quantum key injection method, system, and electronic device, which at least helps to improve the security and flexibility of quantum key injection.

[0005] According to some embodiments of this application, a first aspect of this application provides a quantum key injection method applied to a key management system. The method includes: receiving a request sent by a device, wherein the request is a key injection request or a key update request; invoking a lattice cryptography algorithm to generate a public-private key pair; invoking a white-box encryption algorithm to encrypt the private key in the public-private key pair to obtain private key encrypted data; sending the public key in the public-private key pair and the private key encrypted data to the device; and sending a quantum secure key encrypted with the public key to the device, so that the device can decrypt the encrypted quantum secure key according to the private key encrypted data and use the decrypted quantum secure key for key injection.

[0006] In some embodiments, the step of invoking the lattice cryptography algorithm to generate a public-private key pair includes: determining the currently used security parameters; determining a dimension parameter based on the currently used security parameters, wherein the dimension parameter satisfies: k = 2(Kyber - n), where k is the dimension parameter, Kyber is the currently used security parameter, and n is the degree of the preset polynomial ring; generating a random matrix that conforms to the dimension parameter based on the preset polynomial ring; and generating the public-private key pair based on the random matrix.

[0007] In some embodiments, the step of invoking a white-box encryption algorithm to encrypt the private key in the public-private key pair to obtain encrypted private key data includes: performing a random linear transformation on the private key to obtain transformed data, wherein the transformed data satisfies: , For the transformed data, It is a random matrix. The private key, For random vectors, This represents the modulo operation. The modulus of the polynomial ring in the lattice cryptography algorithm used to generate the private key is then used; a white-box encryption algorithm is invoked to encrypt the transformed data to obtain the encrypted data of the private key.

[0008] In some embodiments, sending the encrypted public key and private key data of the public-private key pair to the device includes: sending a collaborative signature request to a collaborative signature system, wherein the collaborative signature request carries the encrypted public key and private key data, so that the collaborative signature system can transmit the encrypted public key and private key data to the device through collaborative signature.

[0009] According to some embodiments of this application, a second aspect of this application also provides a quantum key injection method applied to a device. The method includes: sending a request to a key management system, wherein the request is a key injection request or a key update request; receiving and storing public and private key encrypted data returned by the key management system according to the request, wherein the public and private key encrypted data are obtained by the key management system according to the quantum key injection method as described in any one of the first aspects; receiving a quantum secure key encrypted with the public key sent by the key management system; decrypting the quantum secure key encrypted with the public key according to the private key encrypted data to store the decrypted quantum secure key; and performing key injection based on the stored quantum secure key.

[0010] In some embodiments, the key injection based on the stored quantum security key includes: querying the device status; if the device status is an unissued state or an audited state, continuously detecting whether key injection is needed, and injecting at least one of the stored quantum security keys if key injection is needed, until key injection is no longer needed, and performing device enumeration if key injection is no longer needed; wherein, device enumeration is performed when the device status is an activated state.

[0011] In some embodiments, storing the public and private key encrypted data returned by the key management system according to the key injection request includes: fragmenting the private key encrypted data to obtain a first data fragment; encrypting each of the first data fragments using local hardware features to obtain a first encrypted data fragment; writing each of the first encrypted data fragments into a local secure storage area; and / or, storing the decrypted quantum secure key includes: fragmenting the decrypted quantum secure key to obtain a second data fragment; encrypting each of the first data fragments to obtain a second encrypted data fragment; and writing each of the second encrypted data fragments into a local secure storage area.

[0012] In some embodiments, after key injection based on the stored quantum secure key, the method further includes: registering the status information of the currently stored quantum secure key with the key management system; and registering an update instruction with the key management system based on the key validity period information carried in the metadata of the currently stored quantum secure key.

[0013] According to some embodiments of this application, a third aspect of this application also provides a quantum secure key injection system, including: a key management system and a device, wherein the key management system is used to implement the quantum key injection method as described in any one of the first aspects, and the device is used to implement the quantum key injection method as described in any one of the second aspects.

[0014] According to some embodiments of this application, a fourth aspect of this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a quantum key injection method as described in any one aspect of the first aspect, or to perform a quantum key injection method as described in any one aspect of the second aspect.

[0015] The technical solution provided in this application embodiment has at least the following advantages:

[0016] Because the public-private key pair is generated using a lattice cryptography algorithm, it is difficult to crack, resulting in higher security. Furthermore, when the public-private key pair is transmitted between the key management system and the device, the private key is not transmitted directly; instead, data encrypted with the private key obtained by encrypting the private key using a white-box encryption algorithm is transmitted, further enhancing the security of the transmitted public-private key pair. This higher security of the public-private key pair leads to higher security for the quantum-safe key used for encrypted transmission, thereby improving the security of the injected quantum-safe key and achieving enhanced security for quantum key injection. Simultaneously, it supports not only quantum key injection triggered by key injection requests but also by key update requests, enabling flexible updates and injections. Attached Figure Description

[0017] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0018] Figure 1 This is a flowchart of a quantum key injection method provided in one embodiment of this application;

[0019] Figure 2 This is a flowchart of a quantum key injection method provided in another embodiment of this application;

[0020] Figure 3 This is a schematic diagram of the filling process involved in the quantum key filling method provided in another embodiment of this application;

[0021] Figure 4 This is an interactive flowchart of a quantum key injection method provided in another embodiment of this application;

[0022] Figure 5 This is a schematic diagram of the structure of a quantum key injection system provided in another embodiment of this application;

[0023] Figure 6 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0024] As can be seen from the background technology, the security and flexibility of existing quantum key injection schemes still need to be improved.

[0025] Analysis revealed that existing quantum key distribution (QKD) software injection schemes suffer from insufficient security and flexibility, at least in the following ways: Typically, the key issuance and management system negotiates an encryption key with the device, then the system uses this key to encrypt and transmit the key to be injected. The device then stores the decrypted key plaintext directly in its local file system or database. This approach makes key storage vulnerable to malware theft or man-in-the-middle attacks. Furthermore, keys cannot be flexibly updated or dynamically injected after generation, requiring manual intervention for regeneration. Additionally, encryption keys using symmetric encryption algorithms are transmitted via a fixed protocol.

[0026] Based on this, embodiments of this application provide a quantum key injection method, system, and electronic device. It uses asymmetric encryption public-private key pairs to encrypt and transmit quantum secure keys. Furthermore, it combines lattice cryptography and white-box encryption algorithms when generating public-private key pairs to provide further security protection. It also supports key injection triggered by key update requests, enabling automatic injection when keys need to be updated, making key injection more flexible.

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been presented in the various embodiments of this application to enable readers to better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments.

[0028] The division of the following embodiments is for ease of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0029] The first aspect of this application provides a quantum key injection method for use in a key management system. The process is as follows: Figure 1 As shown, it includes at least the following steps:

[0030] Step 101: Receive a request sent by the device, wherein the request is a key filling request or a key update request.

[0031] Step 102: Invoke the lattice cryptography algorithm to generate a public-private key pair.

[0032] Step 103: Call the white-box encryption algorithm to encrypt the private key in the public-private key pair to obtain the private key encrypted data.

[0033] Step 104: Send the encrypted data using the public and private keys from the public-private key pair to the device.

[0034] Step 105: Send the public-key encrypted quantum security key to the device so that the device can decrypt the encrypted quantum security key based on the private key encrypted data and use the decrypted quantum security key for key filling.

[0035] Because the public-private key pair is generated using a lattice cryptography algorithm, it is difficult to crack, resulting in higher security. Furthermore, during transmission between the key management system and devices, the private key is not directly transmitted; instead, data encrypted with the private key obtained through white-box encryption is transmitted, further enhancing the security of the transmitted public-private key pair. This enhanced security of the public-private key pair leads to higher security for the quantum-safe key used for encrypted transmission, thereby improving the security of the injected quantum-safe key and achieving enhanced security for quantum key injection. Moreover, it supports both key injection triggered by key injection requests and key update requests, enabling flexible updates and injections.

[0036] For ease of understanding Figure 1 The steps of the illustrated embodiment will be explained below.

[0037] In step 101, a request sent by the receiving device is received, wherein the request is a key injection request or a key update request. That is to say, the device can initiate an injection process through a key injection request; it can also initiate an injection process through a key update request. In this case, it can be understood that key update is achieved by injection, or that key update expands the injection scenario and supports automated dynamic injection without human intervention.

[0038] It should be noted that the embodiments of this application do not limit the key injection request and the key update request. They carry the device-side information required to trigger the key injection process, such as injection parameters and key information, to indicate the number of keys, key type, key generation algorithm, etc. that the device needs to inject / update. These will not be described in detail here.

[0039] It should also be noted that the device in this application is a device that can support software key injection, and can also be called a "soft key device".

[0040] In step 102, a lattice cryptography algorithm is invoked to generate a public-private key pair. This embodiment of the application does not limit the lattice cryptography algorithm used; it can be any lattice cryptography algorithm capable of generating public-private key pairs.

[0041] In some embodiments, to further improve the security of the public-private key pair, a lattice cryptography algorithm is invoked to generate the public-private key pair. This can be achieved as follows: determine the security parameters currently in use; determine the dimension parameters based on the security parameters currently in use, where the dimension parameters satisfy: k = 2(Kyber - n), where k is the dimension parameter, Kyber is the security parameter currently in use, and n is the degree of a preset polynomial ring; generate a random matrix that conforms to the dimension parameters based on the preset polynomial ring; and generate the public-private key pair based on the random matrix.

[0042] In some examples, the pre-defined polynomial ring R q Satisfy R q =Z q [X] / (X n +1), where q is the modulus and n is the degree of the polynomial. For example, q = 3329 and n = 1024 can be chosen.

[0043] Based on a predefined polynomial ring, a random matrix A conforming to the dimension parameter can be generated using the following expression:

[0044] k = 2 (Kyber - 1024) is the dimension parameter of the matrix.

[0045] The public-private key pair can be generated based on the random matrix as follows: Randomly generate a vector s, which is used as the private key; generate the public key according to the following expression: PK = (A, t), where PK is the public key, A is the random matrix mentioned above, t = A·s + e, and e is the noise vector.

[0046] Compared to the lattice cryptography algorithms provided in related technologies, the above embodiment further associates the dimension of the random matrix used in the lattice cryptography algorithm with the currently used security parameters. This makes the dimension of the random matrix no longer uniquely determined, but rather changes with the currently used security parameters. This further increases the randomness of the dimension of the random matrix, building upon the randomness of the matrix elements. Consequently, the randomness of the lattice cryptography algorithm is increased, making it more difficult to crack. This reduces the risk of leakage of the public-private key pair obtained based on the lattice cryptography algorithm and improves security. Therefore, it further enhances the security of key injection based on the private key.

[0047] It should be noted that, in this embodiment of the application, the method of determining the currently used security parameters is not limited. They can be determined by the user or by random generation, etc., which will not be listed here.

[0048] Of course, the above are just examples. In some embodiments, other lattice cryptography algorithms can also be used, which will not be listed here.

[0049] In step 103, a white-box encryption algorithm is invoked to encrypt the private key in the public-private key pair, resulting in encrypted private key data. This embodiment does not limit the white-box encryption algorithm used; it can be any white-box encryption algorithm capable of embedding the key into a complex data structure.

[0050] In some embodiments, a white-box encryption algorithm is invoked to encrypt the private key in the public-private key pair to obtain encrypted private key data. This can be achieved as follows: A random linear transformation is performed on the private key to obtain transformed data, where the transformed data satisfies: s' = (M·s + v) mod q, s' is the transformed data, M is a random matrix, s is the private key, v is a random vector, mod represents the modulo operation, and q is the modulus of the polynomial ring in the lattice cryptography algorithm used to generate the private key; the white-box encryption algorithm is then invoked to encrypt the transformed data to obtain encrypted private key data.

[0051] In some cases, the random matrix M satisfies: Where q is the modulus of the polynomial ring in the lattice cryptography algorithm used to generate the private key.

[0052] In some examples, the random vector v satisfies: Where q is the modulus of the polynomial ring in the lattice cryptography algorithm used to generate the private key.

[0053] In some cases, a white-box encryption algorithm is used to encrypt the transformed data to obtain the private key-encrypted data. This can be achieved by embedding the transformed data s' into a multivariable polynomial. Then, by using LUT[i] = S-Box(si⊕ri), each byte obtained is mapped to a randomized lookup table; finally, by inserting a random linear transformation layer using WB-SK = L·LUT(s') + mod q, the private key is used to encrypt the data.

[0054] Compared to the white-box encryption algorithms provided in related technologies, the above embodiments further perform a random linear transformation on the encrypted private key before embedding data into the complex data structure using the white-box encryption algorithm. This hides the original private key content before the complex data structure, and the hiding method is random, further increasing the randomness of the white-box encryption algorithm. Furthermore, the random linear transformation can be recovered through an inverse transformation, ensuring that the device can recover the private key from the received content and use it, thus guaranteeing the availability of the private key. This reduces the risk of private key leakage during the transmission of the private key from the key management system to the device and improves the security of the private key. Therefore, it further enhances the security of key injection based on the private key.

[0055] Of course, the above are just examples. In some embodiments, other lattice cryptography algorithms can also be used, which will not be listed here.

[0056] In step 104, the encrypted public and private key data of the public-private key pair is sent to the device that initiated the key injection request. This embodiment of the application does not limit the method of sending the encrypted public and private key data.

[0057] In some embodiments, since the private key has been securely protected through steps 101-103, while the public key is allowed to be disclosed, the key management system can directly send the encrypted public and private key data to the device. This allows for a simpler and more efficient transmission of the encrypted public and private key data to the device, completing the key negotiation between the key management system and the device before refilling.

[0058] In some embodiments, the key management system can also send encrypted public and private key data to the device via secure transmission. For example, in some cases, sending the encrypted public and private key data of a public-private key pair to the device can be achieved by sending a collaborative signature request to a collaborative signature system, wherein the collaborative signature request carries the encrypted public and private key data, so that the collaborative signature system can transmit the encrypted public and private key data to the device via collaborative signature. Thus, with the cooperation of the collaborative signature system, the encrypted public and private key data is further sent to the device in a secure manner, further increasing the security of the encrypted public and private key data, thereby further improving the security of key injection based on the public and private keys.

[0059] Of course, the above are just examples. In some embodiments, the public and private keys can be used to encrypt data and send it to the device in other ways, which will not be listed here.

[0060] In step 105, a public-key encrypted quantum secure key is sent to the device, which then decrypts the encrypted quantum secure key using the private key encrypted data and uses the decrypted quantum secure key for key filling. This application embodiment does not limit the quantum secure key used for filling.

[0061] In some embodiments, the quantum secure key can be obtained by the key management system in real time by requesting it from the quantum network. In this case, the security of the quantum secure key is further guaranteed by the real-time request.

[0062] In some embodiments, the quantum secure key can also be an unused quantum secure key currently securely stored locally by the key management system. In this case, there is no need for processes such as applying to the quantum network, making it more efficient and faster.

[0063] Of course, the above are just examples of obtaining quantum secure keys. In some embodiments, they can also be obtained in other ways. For example, locally stored quantum secure keys can be used first, and when their quantity is insufficient to meet the device's charging requirements, quantum secure keys can be requested from the quantum network. These will not be listed here.

[0064] It should be noted that the quantum secure key exchange between the key management system and the device is achieved through encrypted transmission using the previously mentioned public-private key pair. The encrypted transmission using public-private key pairs in related technologies is also applicable to this step, and will not be elaborated on here.

[0065] The second aspect of this application provides a quantum key injection method applied to a device. The process is as follows: Figure 2 As shown, it includes at least the following steps:

[0066] Step 201: Send a request to the key management system, wherein the request is a key filling request or a key update request.

[0067] Step 202: Receive and store the public and private key encrypted data returned by the key management system according to the request.

[0068] Step 203: Receive the quantum security key encrypted with the public key from the key management system.

[0069] Step 204: Decrypt the quantum-safe key encrypted with the public key based on the data encrypted with the private key, and store the decrypted quantum-safe key.

[0070] Step 205: Perform key filling based on the stored quantum secure key.

[0071] It is not difficult to see that this embodiment is a method embodiment corresponding to the foregoing method embodiments, and this embodiment can be implemented in conjunction with the foregoing method embodiments. The relevant technical details mentioned in the foregoing method embodiments are still valid in this embodiment. In order to reduce repetition, the same parts will not be repeated here, but the content not described in the foregoing embodiments will be mainly explained. At the same time, the relevant technical details mentioned in the following description can also be applied to the foregoing method embodiments.

[0072] In some embodiments, the storage key management system can encrypt data based on the public and private keys returned by the key filling request in the following manner: the private key encrypted data is fragmented to obtain a first data fragment; each first data fragment is encrypted using local hardware features to obtain a first encrypted data fragment; and each first encrypted data fragment is written to a local secure storage area.

[0073] In some embodiments, the decrypted quantum secure key can be stored in the following manner: the decrypted quantum secure key is fragmented to obtain second data fragments; each first data fragment is encrypted to obtain second encrypted data fragments; and each second encrypted data fragment is written to a local secure storage area.

[0074] In other words, the device does not store the entire data directly for the content that needs to be stored during the filling process. Instead, it segments the data and encrypts and writes it to a local secure storage area to enhance security and prevent key leakage on the device.

[0075] It should be noted that this application does not limit the methods of fragmentation and encryption. In some embodiments, the data to be stored can be fragmented based on a preset fragment size. In this case, the allocation rules are simple, the implementation is easy, and fragment management is convenient. In some embodiments, the data to be stored can also be fragmented based on a preset number of fragments. In this case, the number of fragments to be maintained is fixed, which facilitates fragment management. In some embodiments, encryption algorithms such as DES and AES can be used for encryption. These will not be listed here.

[0076] In some embodiments, after key injection based on the stored quantum secure key, the method further includes: registering the status information of the currently stored quantum secure key with the key management system; and registering an update instruction with the key management system based on the key validity information carried in the metadata of the currently stored quantum secure key. In other words, the key is registered with the key management system.

[0077] In some embodiments, key injection based on a stored quantum secure key can be achieved by querying the device status;

[0078] When the device status is either unissued or verified, the device and its user are verified. If the verification passes, a key is injected based on the stored quantum security key. After injection, the device and its user are verified again. If the verification passes, device enumeration begins; otherwise, the current process ends. Specifically, device enumeration is performed when the device status is activated. That is, the injection process can be as follows: Figure 3 As shown, where, Figure 3 The return value is used to verify the device and its user. A return value of 0 indicates successful verification, while a non-zero return value indicates failed verification. Thus, multiple verifications ensure the security of key injection and issuance.

[0079] It should be noted that the embodiments of this application do not limit the verification method of the above-mentioned filling process. It can be verified by one or more of the following: user password, biometrics and device hardware information, which will not be listed here.

[0080] To facilitate understanding of the quantum key injection method provided in the above embodiments, the following will combine... Figure 4 The interaction flowchart shown is used for illustration. To better describe the interaction between the key management system and the device, a collaborative signature system is also introduced.

[0081] like Figure 4 As shown, the quantum key injection method includes the following steps:

[0082] Step S1: The device sends a key injection request to the key management system via a routing trigger (not shown in the figure). The key injection request may include information such as the device's unique identifier DEVICE_SERIALNUM and hardware fingerprint.

[0083] In step S2, the key management system verifies the legitimacy of the device based on its unique identifier and hardware fingerprint.

[0084] Step S3: After the device passes verification, the key management system calls the lattice cryptography algorithm to generate a public-private key pair.

[0085] In step S4, the key management system calls a white-box encryption algorithm to encrypt the private key in the public-private key pair, thus obtaining encrypted private key data.

[0086] Step S5: The key management system encapsulates the encrypted data of the public and private keys in the public-private key pair to obtain a key packet.

[0087] The KeyPackage consists of {WB-SK, PK, Metadata}, where WB-SK is the private key encrypted data, PK is the public key, and Metadata contains information such as the key validity period and the device's unique identifier DEVICE_SERIALNUM.

[0088] Step S6: The key management system sends the key packet to the collaborative signature system.

[0089] Step S7: The collaborative signature system performs signature authentication on the key packet.

[0090] Step S8: After the key packet passes the signature authentication, the collaborative signature system sends the encrypted packet to the device.

[0091] In step S9, the device fragments the private key encrypted data in the encrypted packet and writes it to the local secure storage area.

[0092] After receiving the key packet, the device fragments the private key encrypted data WB-SK into {s1,s2,…,s}. n Each chip is individually bound to its hardware characteristics and then encrypted and stored in a local secure storage area. In some cases, the device can also simultaneously write the private key-encrypted data WB-SK to the local secure storage area.

[0093] In step S10, the device sends a notification to the key management system to inform the key management system that it has completed storage.

[0094] Step S11: The key management system requests a quantum secure key from the quantum network.

[0095] In step S12, the key management system uses the previously obtained private key to encrypt the acquired quantum security key and sends it to the device.

[0096] Step S13: The device performs key filling based on the received encrypted quantum secure key.

[0097] In step S14, the device sends a registration request to the key management system, wherein the registration request carries information such as the status of the quantum security key.

[0098] Step S15: The device performs key expiration processing on the quantum secure key based on the expiration information carried in the Matdata.

[0099] Step S16: The device sends a key update request to the key management system.

[0100] Subsequently, the key management system returns to execute step S2 based on the key update request, which will not be described in detail here.

[0101] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this patent.

[0102] A third aspect of this application also provides a quantum key injection system, such as... Figure 5 As shown, it includes: a key management system and equipment.

[0103] The key management system and device are used to implement the quantum key injection method provided in the aforementioned embodiments.

[0104] It is not difficult to see that this embodiment is a system embodiment corresponding to the method embodiment, and this embodiment can be implemented in conjunction with the method embodiment. The relevant technical details mentioned in the method embodiment are still valid in this embodiment, and will not be repeated here to reduce repetition. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the method embodiment.

[0105] Furthermore, in order to highlight the innovative aspects of this application, no units that are not closely related to solving the technical problems proposed in this application are introduced in this embodiment, but this does not mean that there are no other units in this embodiment.

[0106] The fourth aspect of this application also provides an electronic device, such as... Figure 6 As shown, it includes: at least one processor 601; and a memory 602 communicatively connected to at least one processor 601; wherein the memory 602 stores instructions executable by at least one processor 601, which are executed by at least one processor 601 to enable at least one processor 601 to perform the quantum key injection method described in any of the above method embodiments.

[0107] The memory 602 and processor 601 are connected via a bus, which may include any number of interconnecting buses and bridges. The bus connects various circuits of one or more processors 601 and memory 602 together. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 601 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to processor 601.

[0108] Processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 602 can be used to store data used by processor 601 during operation.

[0109] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A quantum key injection method, characterized in that, Applied to a key management system, the method includes: The receiving device sends a request, wherein the request is a key filling request or a key update request; Use the lattice cryptography algorithm to generate a public-private key pair; A white-box encryption algorithm is invoked to encrypt the private key in the public-private key pair, resulting in encrypted private key data. Send the public key and the private key from the public-private key pair to the device to encrypt data; The device sends a quantum-safe key encrypted with the public key, so that the device can decrypt the encrypted quantum-safe key based on the private key encrypted data, and use the decrypted quantum-safe key for key filling.

2. The quantum key injection method according to claim 1, characterized in that, The process of calling the lattice cryptography algorithm to generate a public-private key pair includes: Determine the currently used security parameters; Based on the currently used security parameters, determine the dimension parameters, wherein the dimension parameters satisfy: k = 2(Kyber - n), where k is the dimension parameter, Kyber is the currently used security parameter, and n is the degree of the preset polynomial ring; Generate a random matrix that conforms to the dimension parameters based on the preset polynomial ring. The public-private key pair is generated based on the random matrix.

3. The quantum key injection method according to claim 1, characterized in that, The step of invoking a white-box encryption algorithm to encrypt the private key in the public-private key pair to obtain encrypted private key data includes: The private key is subjected to a random linear transformation to obtain transformed data, wherein the transformed data satisfies: s' = (M·s+v)mod q, s' is the transformed data, M is a random matrix, s is the private key, v is a random vector, mod represents the modulo operation, and q is the modulus of the polynomial ring in the lattice cryptography algorithm used to generate the private key; The transformed data is encrypted using a white-box encryption algorithm to obtain the private key encrypted data.

4. The quantum key injection method according to any one of claims 1 to 3, characterized in that, Sending encrypted data containing the public key and the private key from the public-private key pair to the device includes: A collaborative signature request is sent to the collaborative signature system, wherein the collaborative signature request carries encrypted data of the public key and the private key, so that the collaborative signature system can transmit the encrypted data of the public key and the private key to the device through collaborative signature.

5. A quantum key injection method, characterized in that, Applied to a device, the method includes: Send a request to the key management system, wherein the request is a key filling request or a key update request; The system receives and stores encrypted public and private key data returned by the key management system according to the request, wherein the encrypted public and private key data is obtained by the key management system according to the quantum key injection method as described in any one of claims 1 to 4; Receive the quantum security key encrypted with the public key from the key management system; The quantum secure key encrypted with the public key is decrypted based on the data encrypted with the private key, and the decrypted quantum secure key is stored. Key filling is performed based on the stored quantum secure key.

6. The quantum key injection method according to claim 5, characterized in that, The key filling based on the stored quantum secure key includes: Check device status; If the device status is unissued or audited, the device and the user of the device are verified. If the verification is successful, the key is injected according to the stored quantum security key. After the injection is completed, the device and the user of the device are verified again. If the verification is successful, the device enumeration is performed. If the verification fails, the current process ends. Specifically, when the device is in the activated state, device enumeration is performed.

7. The quantum key injection method according to claim 5 or 6, characterized in that, The storage of data encrypted with the public and private keys returned by the key management system according to the key injection request includes: The private key encrypted data is fragmented to obtain the first data fragment; By utilizing local hardware characteristics, each of the first data fragments is encrypted to obtain the first encrypted data fragment; Write each of the first encrypted data fragments to the local secure storage area; And / or, The storage of the decrypted quantum secure key includes: The decrypted quantum-secure key is fragmented to obtain a second data fragment; Each of the first data fragments is encrypted to obtain the second encrypted data fragment; Each of the second encrypted data fragments is written to the local secure storage area.

8. The quantum key injection method according to claim 5 or 6, characterized in that, After key injection based on the stored quantum secure key, the method further includes: Register the status information of the currently stored quantum security key with the key management system; Based on the key validity information carried in the currently stored quantum security key's metadata, an update instruction is registered with the key management system.

9. A quantum key injection system, characterized in that, include: A key management system and a device, wherein the key management system is used to implement the quantum key injection method as described in any one of claims 1 to 4, and the device is used to implement the quantum key injection method as described in any one of claims 5 to 8.

10. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the quantum key injection method as described in any one of claims 1 to 4, or to perform the quantum key injection method as described in any one of claims 5 to 8.

Images