Internet of Things module quantum key filling method, system and device and medium

Abstract

The invention provides an Internet of Things module quantum key charging method, system and device and a medium, and relates to the technical field of network security communication. The method comprises the following steps: according to an encryption key pair acquisition request, generating and importing a first encryption random number, an encryption private key and a public key into a target Internet of Things module, so that the target Internet of Things module decrypts according to the first encryption random number and the encryption private key to obtain a private key; according to the symmetric encryption key acquisition request, generating and importing an encrypted symmetric encryption key to the target Internet of Things module, so that the target Internet of Things module decrypts the encrypted symmetric encryption key according to the private key to obtain the symmetric encryption key; and according to the charging key acquisition request, generating and importing an encrypted charging key into the target Internet of Things module, so that the target Internet of Things module decrypts the encrypted charging key according to the symmetric encryption key to obtain a charging key. According to the invention, the security of the secret key in the charging process can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security communication, in particular to a quantum key charging method, system, device and medium for Internet of Things module. BACKGROUND

[0002] In the field of quantum communication, the current common operation mode is offline pre-charging of keys. This mode requires that the key data be pre-transmitted from a cryptographic service device and securely stored in the target Internet of Things module. During this transmission process, strict security measures must be taken to ensure the confidentiality and integrity of the keys, preventing any potential risk of theft or tampering.

[0003] However, it should be noted that the current key charging process for Internet of Things modules lacks uniform technical standard specifications. In actual production, the operation mode of exporting key files from a cryptographic machine and then importing them into Internet of Things devices is usually adopted. This operation process has obvious defects in terms of security, which may lead to key leakage or malicious tampering and other security risks. SUMMARY

[0004] The purpose of the present application is to address the deficiencies in the prior art and provide a quantum key charging method, system, device and medium for Internet of Things module to ensure the security of the keys during the charging process.

[0005] To achieve the above-mentioned purpose, the technical solutions adopted by the embodiments of the present application are as follows: In a first aspect, the embodiments of the present application provide a quantum key charging method for Internet of Things module, applied to a charging station node of a quantum key charging system, the quantum key charging system further comprising a charging software and at least one Internet of Things module, the charging software being used to connect the charging station node and the at least one Internet of Things module, and the method comprising: generating and importing, through the charging software, a first encrypted random number, an encrypted private key and a public key to a target Internet of Things module according to an encrypted key pair acquisition request sent by the charging software, so that the target Internet of Things module decrypts to obtain a private key according to the first encrypted random number and the encrypted private key; generating and importing, through the charging software, an encrypted symmetric encryption key to the target Internet of Things module according to a symmetric encryption key acquisition request sent by the charging software, so that the target Internet of Things module decrypts to obtain a symmetric encryption key according to the private key and the encrypted symmetric encryption key; generating and importing, through the charging software, an encrypted charging key to the target Internet of Things module according to a charging key acquisition request sent by the charging software, so that the target Internet of Things module decrypts to obtain the charging key according to the symmetric encryption key and the encrypted charging key.

[0006] Optionally, the generating the first encrypted random number, the encrypted private key and the public key according to the encrypted key pair acquisition request sent by the refilling software comprises: generating a first quantum random number and a public-private key pair according to the encrypted key pair acquisition request, the encrypted key pair acquisition request comprising a signature public key of the target Internet of Things module, the signature public key of the target Internet of Things module being obtained by the refilling software sending a key refilling request to the target Internet of Things module; encrypting the first quantum random number according to the signature public key to generate the first encrypted random number; encrypting the private key in the public-private key pair according to the first quantum random number to generate the encrypted private key.

[0007] Optionally, the generating the encrypted symmetric encryption key according to the symmetric encryption key acquisition request sent by the refilling software comprises: generating a second quantum random number according to the symmetric encryption key acquisition request; encrypting the second quantum random number according to the public key to generate a second encrypted random number, the encrypted symmetric encryption key being the second encrypted random number.

[0008] Optionally, the generating the encrypted refilling key according to the refilling key acquisition request sent by the refilling software comprises: generating the refilling key according to the refilling key acquisition request; encrypting the refilling key according to the symmetric encryption key to generate the encrypted refilling key.

[0009] In a second aspect, the embodiments of the present application further provide a quantum key refilling method for an Internet of Things module, applied to a target Internet of Things module of a quantum key refilling system, the quantum key refilling system further comprising a refilling software and a refilling station node, the refilling software being connected to the refilling station node and at least one Internet of Things module, and the method comprising: importing a first encrypted random number, an encrypted private key and a public key into a secure chip based on an encrypted key pair import instruction sent by the refilling software, the refilling station node being configured to generate the first encrypted random number, the encrypted private key and the public key according to an encrypted key pair acquisition request sent by the refilling software; decrypting the first encrypted random number and the encrypted private key to generate a private key; importing an encrypted symmetric encryption key into the secure chip based on a symmetric encryption key import instruction sent by the refilling software, the refilling station node being configured to generate the encrypted symmetric encryption key according to a symmetric encryption key acquisition request sent by the refilling software; decrypt the encrypted symmetric encryption key according to the private key to generate a symmetric encryption key; based on the charging key import instruction sent by the charging software, import an encrypted charging key into the secure chip, and the charging station node is configured to generate the encrypted charging key according to a charging key acquisition request sent by the charging software; decrypt the encrypted charging key according to the symmetric encryption key to generate the charging key.

[0010] Optionally, the decrypting the first encrypted random number and the encrypted private key to generate a private key comprises: decrypt the first encrypted random number according to a signature private key to generate a first quantum random number, the first encrypted random number being generated by encrypting the first quantum random number according to a signature public key of the target Internet of Things module; decrypt the encrypted private key according to the first quantum random number to generate the private key, the encrypted private key being generated by encrypting the private key using the first quantum random number.

[0011] Optionally, after the decrypting the encrypted symmetric encryption key according to the private key to generate a symmetric encryption key, the method further comprises: if the encrypted symmetric encryption key is successfully decrypted according to the private key, send a verification result to the charging software to instruct the charging software to send the charging key acquisition request to the charging station node.

[0012] In a third aspect, an embodiment of the present application provides a quantum key charging device for an Internet of Things module, applied to a charging station node of a quantum key charging system, the quantum key charging system further comprising a charging software and at least one Internet of Things module, the charging software being configured to connect the charging station node and the at least one Internet of Things module, and the device comprising: a key pair encryption module configured to generate and import, through the charging software, a first encrypted random number, an encrypted private key and a public key into a target Internet of Things module according to an encrypted key acquisition request sent by the charging software, so that the target Internet of Things module decrypts to obtain a private key according to the first encrypted random number and the encrypted private key; a symmetric key encryption module configured to generate and import, through the charging software, an encrypted symmetric encryption key into the target Internet of Things module according to a symmetric encryption key acquisition request sent by the charging software, so that the target Internet of Things module decrypts the encrypted symmetric encryption key according to a private key to obtain a symmetric encryption key; The filling key encryption module is configured to generate and import an encrypted filling key into the target Internet of Things module according to a filling key acquisition request sent by the filling software, so that the target Internet of Things module decrypts the encrypted filling key according to the symmetric encryption key to obtain the filling key.

[0013] Optionally, the key pair encryption module is specifically configured to generate a first quantum random number and a public-private key pair according to the encrypted key pair acquisition request, the encrypted key pair acquisition request including a signature public key of the target Internet of Things module, the signature public key of the target Internet of Things module being obtained by the filling software sending a key filling request to the target Internet of Things module; encrypt the first quantum random number according to the signature public key to generate the first encrypted random number; and encrypt a private key in the public-private key pair according to the first quantum random number to generate the encrypted private key.

[0014] Optionally, the symmetric key encryption module is specifically configured to generate a second quantum random number according to the symmetric encryption key acquisition request; and encrypt the second quantum random number according to the public key to generate a second encrypted random number, the encrypted symmetric encryption key being the second encrypted random number.

[0015] Optionally, the filling key encryption module is specifically configured to generate the filling key according to the filling key acquisition request; and encrypt the filling key according to the symmetric encryption key to generate the encrypted filling key.

[0016] In a fourth aspect, the embodiments of the present application further provide an Internet of Things module quantum key filling device, applied to a target Internet of Things module of a quantum key filling system, the quantum key filling system further including a filling software and a filling station node, the filling software being connected to the filling station node and at least one Internet of Things module, and the device including: A key pair import module is configured to import a first encrypted random number, an encrypted private key and a public key into a secure chip based on an encrypted key pair import instruction sent by the filling software, the filling station node being configured to generate the first encrypted random number, the encrypted private key and the public key according to an encrypted key pair acquisition request sent by the filling software. A private key decryption module is configured to decrypt the first encrypted random number and the encrypted private key to generate a private key. A symmetric key import module is configured to import an encrypted symmetric encryption key into the secure chip based on a symmetric encryption key import instruction sent by the filling software, the filling station node being configured to generate the encrypted symmetric encryption key according to a symmetric encryption key acquisition request sent by the filling software. a symmetric key decryption module configured to decrypt the encrypted symmetric encryption key according to the private key to generate a symmetric encryption key; a charging key import module configured to import an encrypted charging key into the secure chip based on a charging key import instruction sent by the charging software, and the charging station node is configured to generate the encrypted charging key according to a charging key acquisition request sent by the charging software; a charging key decryption module configured to decrypt the encrypted charging key according to the symmetric encryption key to generate the charging key.

[0017] Optionally, the private key decryption module is specifically configured to decrypt the first encrypted random number according to a signature private key to generate a first quantum random number, and the first encrypted random number is generated by encrypting the first quantum random number according to a signature public key of the target Internet of Things module; and decrypt the encrypted private key according to the first quantum random number to generate the private key, and the encrypted private key is generated by encrypting the private key using the first quantum random number.

[0018] Optionally, the apparatus further includes: a result sending module configured to send a verification result to the charging software to instruct the charging software to send the charging key acquisition request to the charging station node, if the encrypted symmetric encryption key is successfully decrypted according to the private key.

[0019] In a fifth aspect, an embodiment of the present application further provides a quantum key charging system, which includes a charging station node, charging software and at least one Internet of Things module, the charging software is configured to connect the charging station node and the at least one Internet of Things module; The charging station node is configured to execute the method in any one of the first aspect, and the Internet of Things module is configured to execute the method in any one of the second aspect, so that the charging station node charges the key to the Internet of Things module through the charging software.

[0020] In a sixth aspect, an embodiment of the present application further provides an electronic device, which includes a processor, a storage medium and a bus, the storage medium stores program instructions executable by the processor, when the electronic device is running, the processor and the storage medium communicate through the bus, and the processor executes the program instructions to execute the method in any one of the first aspect, or the method in any one of the second aspect.

[0021] In a seventh aspect, an embodiment of the present application further provides a computer readable storage medium, the storage medium stores a computer program, and the computer program is executed by a processor to execute the method in any one of the first aspect, or the method in any one of the second aspect.

[0022] The beneficial effects of the present application are: The Internet of Things module quantum key charging method, system, device and medium provided by the present application encrypt the charging key using a symmetric encryption key, encrypt the symmetric encryption key using a public key, encrypt the private key using a first quantum random number, and encrypt the first quantum random number, so that the first quantum random number, the private key, the symmetric encryption key and the charging key always exist in the form of ciphertext during the circulation process, that is, it is impossible to detect plaintext in the charging software, and the import process of the first quantum random number, the private key, the symmetric encryption key and the charging key is completely completed by software, without exporting the charging software and the Internet of Things module in any form, reducing the risk of tampering, stealing and leaking of the key, and ensuring the security of the charging key. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0024] Figure 1 The system architecture diagram of the quantum key charging system provided by the embodiments of the present application; Figure 2 The architecture diagram of the security chip provided by the embodiments of the present application; Figure 3 The flowchart of the Internet of Things module quantum key charging method provided by the embodiments of the present application Figure 1 ; Figure 4 The flowchart of the Internet of Things module quantum key charging method provided by the embodiments of the present application Figure 2 ; Figure 5 The interaction diagram of the Internet of Things module quantum key charging method provided by the embodiments of the present application; Figure 6 The structure diagram of the Internet of Things module quantum key charging device provided by the embodiments of the present application Figure 1 ; Figure 7 The structure diagram of the Internet of Things module quantum key charging device provided by the embodiments of the present application Figure 2 ; Figure 8 The schematic diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application but not all the embodiments of the present application.

[0026] Therefore, the detailed description of the embodiments of the present application provided in the drawings below is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by a person of ordinary skill in the art without creative labor based on the embodiments in the present application are within the scope of protection of the present application.

[0027] In addition, the terms "first", "second", and the like in the specification and claims of the present application and the above drawings are used to distinguish similar objects and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the features in the embodiments of the present application can be combined with each other without conflict.

[0029] In order to better understand the Internet of Things module quantum key charging method provided by the present application, the quantum key charging system to which the Internet of Things module quantum key charging method is applied will be introduced first.

[0030] Figure 1 The system architecture diagram of the quantum key charging system provided by the embodiments of the present application is shown in Figure 1 As shown in the figure, the quantum key charging system includes a charging station node, charging software and at least one Internet of Things module, the charging software is used to connect the charging station node and the at least one Internet of Things module.

[0031] In the present embodiment, the charging software and the charging station node can be deployed on the same electronic device or on different electronic devices, and the present embodiment does not limit this.

[0032] The charging software is used to be responsible for managing and coordinating the entire key charging process, to obtain the key by sending a request to the charging station node, and to interact with the Internet of Things module to control the Internet of Things module to import the key to the security chip.

[0033] The filling station node can be deployed with a random number generation module for generating quantum random numbers and a key generation module for generating keys using a preset key generation algorithm. The filling station node can also encrypt the quantum random numbers and the keys using a preset encryption algorithm.

[0034] In some embodiments, as shown in Figure 1 The quantum key filling system can further include a key service platform node connected with the filling station node, and the key service platform node generates the keys using the preset key generation algorithm and provides the keys to the filling station node.

[0035] The module tooling includes at least one Internet of Things module, and each Internet of Things module is connected with the filling software through each serial port on the module tooling.

[0036] The filling software can enumerate all serial port devices on the electronic device by calling an operating system API, create a new thread for the enumerated serial port devices, attempt to open the serial port devices through the thread, determine whether the serial port devices are connected with the Internet of Things modules, and then the filling software attempts different baud rate settings for each serial port device that can be connected with the Internet of Things modules one by one, determines the baud rate that can successfully establish a connection, and if the serial port device can be opened and a connection is successfully established through the specified baud rate, it is determined that the Internet of Things module connected with the serial port device can be filled with keys. A user interaction interface is provided in the electronic device to display the Internet of Things modules that can be filled.

[0037] The filling software and the filling station node communicate using the Hypertext Transfer Protocol Secure (HTTPS), and the filling software and the Internet of Things modules communicate using the Attention Command (AT).

[0038] In some embodiments, each Internet of Things module has a National Cryptographic Security Chip inside, uses the National Cryptographic Algorithm (SM series algorithm) certified by the China National Cryptographic Administration for data encryption, identity authentication and secure storage, and has a hardware-level tamper-proof design.

[0039] Figure 2 The architecture diagram of the security chip provided for the embodiments of the present application is shown in Figure 2As shown, the secure chip can be integrated inside a micro controller unit (MCU), or the secure chip can be integrated on the same circuit board as the MCU and communicate with the MCU through an on-chip bus. The on-chip communication mode includes but is not limited to an inter-integrated circuit (IIC) bus, a serial port, etc., and the present embodiment does not limit the same.

[0040] In some embodiments, the quantum key replenishment system further comprises: a network node, such as Figure 1 As shown, a plurality of network nodes constitute a quantum key distribution network, are connected to each other through a quantum network link control center, form a stable communication network, and can be distributed in different geographical locations to realize cross-regional data transmission and resource sharing. Each network node corresponds to a cryptographic service platform node.

[0041] Based on the quantum key replenishment system provided in the above embodiments, the specific implementation of the Internet of Things module quantum key replenishment method applied to the replenishment station node will be described below in combination with the embodiments.

[0042] Figure 3 The flowchart of the Internet of Things module quantum key replenishment method provided in the embodiments of the present application is shown in Figure 1 As shown in Figure 3 The method can include: S110, according to the encryption key pair acquisition request sent by the replenishment software, generating and importing a first encrypted random number, an encrypted private key and a public key into the target Internet of Things module through the replenishment software, so that the target Internet of Things module decrypts the private key according to the first encrypted random number and the encrypted private key.

[0043] In the present embodiment, the user triggers the process of injecting the replenishment key into the target Internet of Things module in at least one Internet of Things module through the replenishment software. The replenishment software sends a request replenishment instruction to the target Internet of Things module, receives a response of the target Internet of Things module to the request replenishment instruction, and if the response of the request replenishment instruction indicates that the target Internet of Things module receives the replenishment of the replenishment key, the replenishment software sends an encryption key pair acquisition request to the replenishment station node.

[0044] The encryption key pair acquisition request is used to instruct the replenishment station node to generate a public-private key pair, wherein the public key is used for encryption of the replenishment station node, and the private key is used for decryption of the target Internet of Things module.

[0045] In order to ensure the security of the filling key injection target Internet of Things module process, the filling station node encrypts the filling key with a symmetric encryption key and transmits it in ciphertext form. In the process of transmitting the symmetric encryption key to the target Internet of Things module, in order to avoid the symmetric encryption key being stolen, the symmetric encryption key is encrypted with a public key, and the private key corresponding to the public key is also encrypted, so that the filling key, the symmetric encryption key and the private key are all transmitted in the form of ciphertext.

[0046] In some embodiments, the filling station node generates a public-private key pair based on the encryption key acquisition request, encrypts the private key using a preset encryption method to generate an encrypted private key, and imports the encrypted private key and the public key into the target Internet of Things module through the filling software. The target Internet of Things module decrypts the encrypted private key using an encryption method corresponding to the preset encryption method to obtain the private key.

[0047] In other embodiments, the filling station node generates a first quantum random number and a public-private key pair based on the encryption key acquisition request, encrypts the private key using the first quantum random number to generate an encrypted private key, and encrypts the first quantum random number to generate a first encrypted random number in order to avoid the first quantum random number being stolen, resulting in the encrypted private key and the encrypted filling key being encrypted.

[0048] The filling station node sends the first encrypted random number, the encrypted private key and the public key to the filling software, the filling software sends an encryption key pair import instruction to the target Internet of Things module, and the target Internet of Things module imports the first encrypted random number, the encrypted private key and the public key into the secure chip based on the encryption key pair import instruction. The secure chip can first decrypt the first encrypted random number to generate the first quantum random number, and then decrypt the encrypted private key based on the first quantum random number to determine the private key.

[0049] S120, according to the symmetric encryption key acquisition request sent by the filling software, generate and import the encrypted symmetric encryption key into the target Internet of Things module through the filling software, so that the target Internet of Things module decrypts the encrypted symmetric encryption key according to the private key to obtain the symmetric encryption key.

[0050] In this embodiment, after receiving the encryption key pair import success indication sent by the target Internet of Things module, the filling software sends a symmetric encryption key acquisition request to the filling station node. The symmetric encryption key acquisition request is used to instruct the filling station node to generate a symmetric encryption key for encrypting the filling key. The symmetric encryption key is a key that is used for encryption and decryption. The filling station node encrypts the filling key using the symmetric encryption key, and the secure chip also decrypts the encrypted filling key using the symmetric encryption key.

[0051] In order to avoid the symmetric encryption key being stolen in the transmission process, the symmetric encryption key is encrypted by using the public key generated in S110 to generate an encrypted symmetric encryption key. Since the private key has been imported into the security chip of the target Internet of Things module, after the encrypted symmetric encryption key is imported into the security chip of the target Internet of Things module, the encrypted symmetric encryption key is decrypted by using the private key, and the symmetric encryption key can be obtained.

[0052] In S130, the encrypted provisioning key is generated according to the provisioning key acquisition request sent by the provisioning software, and is imported into the target Internet of Things module through the provisioning software, so that the target Internet of Things module decrypts the encrypted provisioning key according to the symmetric encryption key to obtain the provisioning key.

[0053] In the embodiment, after receiving the symmetric encryption key import success indication sent by the target Internet of Things module, the provisioning software sends a provisioning key acquisition request to the provisioning station node. The provisioning key acquisition request is used to instruct the provisioning station node to generate the provisioning key. The provisioning key is the key finally used by the security chip for encryption, identity verification and the like.

[0054] According to the foregoing description, in order to avoid the provisioning key being stolen, the symmetric encryption key generated in S120 is used to encrypt the provisioning key to generate an encrypted provisioning key. Since the symmetric encryption key has been imported into the security chip of the target Internet of Things module, after the encrypted provisioning key is imported into the security chip of the target Internet of Things module, the encrypted provisioning key is decrypted by using the symmetric encryption key, and the provisioning key can be obtained.

[0055] The Internet of Things module quantum key provisioning method provided in the foregoing embodiments encrypts the provisioning key by using the symmetric encryption key, encrypts the symmetric encryption key by using the public key, encrypts the private key by using the first quantum random number, and also encrypts the first quantum random number. Therefore, the first quantum random number, the private key, the symmetric encryption key and the provisioning key always exist in the form of ciphertext in the circulation process, and the plaintext cannot be detected in the provisioning software. Moreover, the import process of the first quantum random number, the private key, the symmetric encryption key and the provisioning key is completely completed by the software, and the provisioning software and the Internet of Things module are not exported in any form. Therefore, the risk of tampering, stealing and leaking of the key is reduced, and the security of the provisioning key is ensured.

[0056] In a possible implementation, the process of generating the first encrypted random number, the encrypted private key and the public key according to the encrypted key pair acquisition request sent by the provisioning software in S110 can include the following steps. According to the encryption key pair, a first quantum random number and a public-private key pair are generated, and the encryption key pair acquisition request comprises: a signature public key of the target Internet of Things module, which is obtained by the charging software sending a key charging request to the target Internet of Things module; the first quantum random number is encrypted according to the signature public key to generate a first encrypted random number; and the private key in the public-private key pair is encrypted according to the first quantum random number to generate an encrypted private key.

[0057] In the embodiment, the user triggers a process of injecting a charging key into a target Internet of Things module in at least one Internet of Things module through the charging software, and the charging software sends a request charging instruction to the target Internet of Things module and receives identification information ID of a security chip on the target Internet of Things module and a signature public key Sign-pub of the security chip returned by the target Internet of Things module in response to the request charging instruction.

[0058] The charging software sends an encryption key pair acquisition request to the charging station node based on the received identification information ID of the security chip and the signature public key Sign-pub of the security chip, and the encryption key pair acquisition request comprises the identification information ID of the security chip and the signature public key Sign-pub of the security chip.

[0059] The charging station node generates a first quantum random number Ka and a public-private key pair En-pub, En-pri based on the encryption key pair acquisition request, encrypts the first quantum random number Ka using a preset encryption method using the signature public key Sign-pub to generate a first encrypted random number Sign-pub(Ka), and encrypts the private key En-pri using a preset encryption method using the first quantum random number Ka to generate an encrypted private key Ka(En-pri).

[0060] The Internet of Things module quantum key charging method provided in the above embodiment encrypts the private key using the first quantum random number and encrypts the first quantum random number using the signature public key of the target Internet of Things module, so that the first quantum random number and the private key always exist in the form of ciphertext in the transmission process, avoiding the first quantum random number and the private key from being stolen or tampered with, and ensuring the security of the charging key.

[0061] In a possible implementation, the process of generating an encrypted symmetric encryption key according to the symmetric encryption key acquisition request sent by the charging software in S120 can comprise: A second quantum random number is generated according to the symmetric encryption key acquisition request, and the second quantum random number is encrypted according to the public key to generate a second encrypted random number, and the encrypted symmetric encryption key is the second encrypted random number.

[0062] In the embodiment, after receiving the indication of successful import of the symmetric encryption key sent by the target Internet of Things module, the filling software sends a symmetric encryption key acquisition request to the filling station node. The filling station node generates a second quantum random number Kb, which is used as the symmetric encryption key. The second quantum random number Kb is encrypted by using the public key En-pub to generate a second encrypted random number En-pub(Kb), which is used as the encrypted symmetric encryption key.

[0063] The Internet of Things module quantum key filling method provided in the above embodiment encrypts the second quantum random number by using the public key, so that the second quantum random number always exists in the form of ciphertext in the transmission process, avoids the second quantum random number from being stolen or tampered with, and ensures the security of the filling key.

[0064] In a possible implementation, the process of generating the encrypted filling key according to the filling key acquisition request sent by the filling software can include the following steps. According to the filling key acquisition request, a filling key is generated. The filling key is encrypted by using the symmetric encryption key to generate an encrypted filling key.

[0065] In the embodiment, after receiving the indication of successful import of the symmetric encryption key sent by the target Internet of Things module, the filling software sends a symmetric encryption key acquisition request to the filling station node. The filling station node generates a second quantum random number Kb, which is used as the symmetric encryption key. The second quantum random number Kb is encrypted by using the public key En-pub to generate a second encrypted random number En-pub(Kb), which is used as the encrypted symmetric encryption key.

[0066] After obtaining the filling key Key, the filling station node encrypts the filling key Key by using the symmetric encryption key. In some embodiments, the symmetric encryption key is the second quantum random number Kb, and the filling key Key is encrypted by using the second quantum random number Kb to generate an encrypted filling key Kb(Key).

[0067] The Internet of Things module quantum key filling method provided in the above embodiment encrypts the filling key by using the symmetric encryption key, so that the filling key always exists in the form of ciphertext in the transmission process, avoids the filling key from being stolen or tampered with, and ensures the security of the filling key.

[0068] The specific implementation of the Internet of Things module quantum key filling method applied to the Internet of Things module is described below in combination with embodiments.

[0069] Figure 4 The flowchart of the Internet of Things module quantum key filling method provided in the embodiments of the present application Figure 2 As shown in Figure 4 the method can include: S210, based on the encryption key pair sent by the charging software, import the first encrypted random number, the encrypted private key and the public key to the secure chip, and the charging station node is used to generate the first encrypted random number, the encrypted private key and the public key according to the encryption key pair acquisition request sent by the charging software.

[0070] In this embodiment, the charging station node generates the first encrypted random number Sign-pub(Ka), the encrypted private key Ka(En-pri) and the public key En-pub in the manner of S110 as described above, and sends them to the charging software.

[0071] The charging software sends the encryption key pair import instruction to the target Internet of Things module, and the target Internet of Things module converts the first encrypted random number Sign-pub(Ka), the encrypted private key Ka(En-pri) and the public key En-pub into a digital envelope format and imports them into the secure chip using the SKF_ImportECCKeyPair interface. For details, please refer to GM / T 0016-2012 Intelligent Cipher Key Application Interface Specification.

[0072] S220, decrypt the first encrypted random number and the encrypted private key to generate a private key.

[0073] In this embodiment, the secure chip encrypts the first encrypted random number Sign-pub(Ka) to generate the first quantum random number Ka, and decrypts the encrypted private key Ka(En-pri) using the first quantum random number Ka to generate the private key En-pri.

[0074] In some embodiments, the process of decrypting the first encrypted random number and the encrypted private key to generate a private key in S220 can include: decrypt the first encrypted random number according to the signature private key to generate the first quantum random number, the first encrypted random number being generated by encrypting the first quantum random number according to the signature public key of the target Internet of Things module; and decrypt the encrypted private key according to the first quantum random number to generate the private key, the encrypted private key being generated by encrypting the private key using the first quantum random number.

[0075] In this embodiment, the first encrypted random number Sign-pub(Ka) is decrypted according to the signature private key corresponding to the signature public key of the secure chip to generate the first quantum random number Ka, and the encrypted private key Ka(En-pri) is decrypted using the first quantum random number Ka to generate the private key En-pri.

[0076] S230, based on the symmetric encryption key import instruction sent by the charging software, import the encrypted symmetric encryption key to the secure chip, and the charging station node is used to generate the encrypted symmetric encryption key according to the symmetric encryption key acquisition request sent by the charging software.

[0077] In the embodiment, the filling station node generates the encrypted symmetric encryption key in the manner of S120 as described above, and sends it to the filling software.

[0078] The filling software sends a symmetric encryption key import instruction to the target Internet of Things module, the target Internet of Things module converts the encrypted symmetric encryption key into a digital envelope format, and imports it into the security chip using the SKF_ImportSessionKey interface.

[0079] S240, decrypt the encrypted symmetric encryption key according to the private key to generate the symmetric encryption key.

[0080] In the embodiment, the security chip decrypts the encrypted symmetric encryption key according to the private key En-pri obtained in S220 to obtain the symmetric encryption key.

[0081] In some embodiments, the encrypted symmetric encryption key is a second encrypted random number En-pub(Kb), and the second encrypted random number En-pub(Kb) is decrypted using the private key to obtain the second quantum random number Kb as the symmetric encryption key.

[0082] In some embodiments, after the encrypted symmetric encryption key is decrypted according to the private key in S240 to generate the symmetric encryption key, the method can further include: If the encrypted symmetric encryption key is successfully decrypted according to the private key, a verification result is sent to the filling software to instruct the filling software to send a filling key acquisition request to the filling station node.

[0083] In the embodiment, in order to avoid tampering of the symmetric encryption key during transmission, the encrypted symmetric encryption key is decrypted using the private key, if the decryption is successful, it is determined that the symmetric encryption key has not been tampered with, and a verification result is sent to the filling software to instruct the filling software to send a filling key acquisition request to the filling station node to obtain the encrypted filling key, if the decryption fails, it is determined that the symmetric encryption key has been tampered with, then the first quantum random number, the public and private key pair and the encrypted symmetric encryption key are discarded, and reacquired.

[0084] S250, based on the filling key import instruction sent by the filling software, import the encrypted filling key into the security chip, and the filling station node is used to generate the encrypted filling key according to the filling key acquisition request sent by the filling software.

[0085] In the embodiment, the filling station node generates the encrypted filling key in the manner of S130 as described above, and sends it to the filling software.

[0086] The filling software sends a filling key import instruction to the target Internet of Things module, and the target Internet of Things module calls the SKF_WriteFile interface to import the encrypted filling key into the secure chip.

[0087] S260, decrypt the encrypted filling key according to the symmetric encryption key to generate the filling key.

[0088] In this embodiment, the secure chip decrypts the encrypted filling key according to the symmetric encryption key obtained by the above S240 to obtain the filling key.

[0089] In some embodiments, the symmetric encryption key is a second quantum random number Kb, and the encrypted filling key Kb(Key) is decrypted using the second quantum random number Kb to generate the filling key Key.

[0090] The Internet of Things module quantum key filling method provided by the above embodiments encrypts the first quantum random number, the private key, the symmetric encryption key and the filling key imported into the Internet of Things module, so that the first quantum random number, the private key, the symmetric encryption key and the filling key always exist in the form of ciphertext during the circulation process, even if in the filling software, it is impossible to detect plaintext, and the import process of the first quantum random number, the private key, the symmetric encryption key and the filling key is completely completed by software, without exporting the filling software and the Internet of Things module in any form, reducing the risk of tampering, stealing and leaking of the key, and ensuring the security of the filling key.

[0091] Figure 5 The interaction diagram of the Internet of Things module quantum key filling method provided by the embodiments of the present application is shown in Figure 5 As shown, the Internet of Things module quantum key filling process can include: S310, the filling software sends a request filling instruction to the Internet of Things module, and the request filling instruction is an AT instruction.

[0092] S320, the Internet of Things module returns the ID and signature public key Sign-pub of the secure chip to the filling software.

[0093] S330, the filling software sends an encrypted key pair acquisition request to the filling station node, carrying the ID and signature public key Sign-pub of the secure chip.

[0094] S340, the filling station node generates a first quantum random number Ka, a public-private key pair En-pub, En-pri, encrypts the first quantum random number Ka and the public-private key pair En-pub, and generates a first encrypted random number Sign-pub(Ka) and an encrypted private key Ka(En-pri).

[0095] S350, the filling station node returns the first encrypted random number Sign-pub(Ka), the encrypted private key Ka(En-pri) and the public key En-pub to the filling software.

[0096] S360, the filling software sends an encrypted key pair import instruction to the Internet of Things module, carrying the first encrypted random number Sign-pub(Ka), the encrypted private key Ka(En-pri) and the public key En-pub, and the encrypted key pair import instruction is an AT instruction.

[0097] S370, the Internet of Things module sends a message of successful import of the encrypted key pair to the filling software.

[0098] S380, the filling software sends a symmetric encryption key acquisition request to the filling station node.

[0099] S390, the filling station node generates a second quantum random number Kb, and encrypts the second quantum random number Kb using the public key to generate a second encrypted random number En-pub(Kb).

[0100] S400, the filling station node returns the second encrypted random number En-pub(Kb) to the filling software.

[0101] S410, the filling software sends a symmetric encryption key import instruction to the Internet of Things module, carrying the second encrypted random number En-pub(Kb), and the symmetric encryption key import instruction is an AT instruction.

[0102] S420, the Internet of Things module decrypts the second encrypted random number En-pub(Kb) and determines that the decryption is successful.

[0103] S430, the Internet of Things module sends a verification result to the filling software, indicating that the decryption of the second encrypted random number En-pub(Kb) is successful.

[0104] S440, the filling software sends a filling key acquisition request to the filling station node.

[0105] S450, the filling station node sends an encrypted filling key Kb(Key) to the filling software.

[0106] S460, the filling software sends a filling key import instruction to the Internet of Things module, carrying the encrypted filling key Kb(Key), and the filling key import instruction is an AT instruction.

[0107] S470, the encrypted filling key Kb(Key) is written to the secure chip.

[0108] S480, the Internet of Things module sends a filling result to the filling software.

[0109] Based on the above method embodiments, this application provides an IoT module quantum key injection device, which is applied to the injection station node of a quantum key injection system. The quantum key injection system further includes: injection software and at least one IoT module. The injection software is used to connect the injection station node and at least one IoT module. Figure 6 A schematic diagram of the structure of the quantum key injection device for the Internet of Things module provided in this application embodiment. Figure 1 ,like Figure 6 As shown, the device may include: The key pair encryption module 510 is used to generate, and import a first encrypted random number, an encrypted private key and a public key into the target IoT module through the encryption key pair acquisition request sent by the filling software, so that the target IoT module can decrypt and obtain the private key based on the first encrypted random number and the encrypted private key. The symmetric key encryption module 520 is used to generate and import the encrypted symmetric encryption key into the target IoT module through the filling software according to the symmetric encryption key acquisition request sent by the filling software, so that the target IoT module can decrypt the encrypted symmetric encryption key according to the private key to obtain the symmetric encryption key. The charging key encryption module 530 is used to generate and import an encrypted charging key into the target IoT module through the charging software according to the charging key acquisition request sent by the charging software, so that the target IoT module can decrypt the encrypted charging key according to the symmetric encryption key to obtain the charging key.

[0110] Optionally, the key pair encryption module 510 is specifically used to generate a first quantum random number and a public-private key pair according to the encryption key pair acquisition request. The encryption key pair acquisition request includes: the signature public key of the target IoT module, which is obtained by the injection software sending a key injection request to the target IoT module; encrypting the first quantum random number according to the signature public key to generate a first encrypted random number; and encrypting the private key in the public-private key pair according to the first quantum random number to generate an encrypted private key.

[0111] Optionally, the symmetric key encryption module 520 is specifically used to generate a second quantum random number according to the symmetric encryption key acquisition request; encrypt the second quantum random number according to the public key to generate a second encrypted random number, wherein the encrypted symmetric encryption key is the second encrypted random number.

[0112] Optionally, the filling key encryption module 530 is specifically used to generate a filling key according to the filling key acquisition request; and to encrypt the filling key according to the symmetric encryption key to generate an encrypted filling key.

[0113] Based on the above method embodiments, this application embodiment also provides an IoT module quantum key injection device, which is applied to a target IoT module in a quantum key injection system. The quantum key injection system further includes: injection software and injection station nodes, wherein the injection software connects the injection station nodes and at least one IoT module. Figure 7 A schematic diagram of the structure of the quantum key injection device for the Internet of Things module provided in this application embodiment. Figure 2 ,like Figure 7 As shown, the device may include: The key pair import module 610 is used to import a first encrypted random number, an encrypted private key, and a public key into the security chip based on the encryption key pair import instruction sent by the refilling software. The refilling station node is used to generate the first encrypted random number, an encrypted private key, and a public key according to the encryption key pair acquisition request sent by the refilling software. The private key decryption module 620 is used to decrypt the first encrypted random number and the encrypted private key to generate a private key; The symmetric key import module 630 is used to import the encrypted symmetric encryption key into the security chip based on the symmetric encryption key import instruction sent by the filling software. The filling station node is used to generate the encrypted symmetric encryption key according to the symmetric encryption key acquisition request sent by the filling software. The symmetric key decryption module 640 is used to decrypt the encrypted symmetric encryption key based on the private key and generate a symmetric encryption key. The charging key import module 650 is used to import the encrypted charging key into the security chip based on the charging key import instruction sent by the charging software. The charging station node is used to generate the encrypted charging key according to the charging key acquisition request sent by the charging software. The filling key decryption module 660 is used to decrypt the encrypted filling key based on the symmetric encryption key and generate a filling key.

[0114] Optionally, the private key decryption module 620 is specifically used to decrypt the first encrypted random number according to the signing private key to generate a first quantum random number, wherein the first encrypted random number is generated by encrypting the first quantum random number according to the signing public key of the target IoT module; and to decrypt the encrypted private key according to the first quantum random number to generate a private key, wherein the encrypted private key is generated by encrypting the private key using the first quantum random number.

[0115] Optionally, the device may further include: The result sending module is used to send a verification result to the filling software if the encrypted symmetric encryption key is successfully decrypted according to the private key, so as to instruct the filling software to send a filling key acquisition request to the filling station node.

[0116] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0117] The above modules can be one or more integrated circuits configured to implement the above methods, for example, one or more Application Specific Integrated Circuits (ASICs), or one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs), etc. For another example, when a certain module above is implemented in the form of a processing element scheduling code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor that can invoke code. For another example, the modules can be integrated together to implement a system-on-a-chip (SOC).

[0118] Figure 8 A schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 7. As shown in FIG. 7, the electronic device 700 can include a processor 710, a storage medium 720, and a bus. The storage medium 720 stores program instructions executable by the processor 710. When the electronic device 700 is running, the processor 710 communicates with the storage medium 720 through the bus. The processor 710 executes the program instructions to perform the above method embodiments. The specific implementation and technical effects are similar, and will not be described here. Figure 8

[0119] Optionally, the present application also provides a computer-readable storage medium, and the storage medium stores a computer program. The computer program is run by a processor to execute the above method embodiments.

[0120] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between different units, or the among different units, can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0121] ​The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0122] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

[0123] The integrated unit realized in the form of software functional unit can be stored in a computer readable storage medium. The software functional unit stored in a storage medium includes a plurality of instructions for making a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) execute part of the steps of the method described in each embodiment of the present application. And the foregoing storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, for short: ROM), random access memory (English: Random Access Memory, for short: RAM), magnetic disk or optical disk and various program code storage media.

[0124] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for Internet of Things module quantum key injection, characterized in that, The application is applied to a refilling station node of a quantum key refilling system, the quantum key refilling system further comprises a refilling software and at least one Internet of Things module, the refilling software is used for connecting the refilling station node and the at least one Internet of Things module, and the method comprises the following steps: According to the encrypted key pair acquisition request sent by the refilling software, a first encrypted random number, an encrypted private key and a public key are generated and imported to a target Internet of Things module through the refilling software, so that the target Internet of Things module decrypts to obtain a private key according to the first encrypted random number and the encrypted private key; According to the symmetric encryption key acquisition request sent by the refilling software, an encrypted symmetric encryption key is generated and imported to the target Internet of Things module through the refilling software, so that the target Internet of Things module decrypts the encrypted symmetric encryption key according to the private key to obtain a symmetric encryption key; According to the refilling key acquisition request sent by the refilling software, an encrypted refilling key is generated and imported to the target Internet of Things module through the refilling software, so that the target Internet of Things module decrypts the encrypted refilling key according to the symmetric encryption key to obtain the refilling key.

2. The method of claim 1, wherein, The first encrypted random number, the encrypted private key and the public key are generated according to the encrypted key pair acquisition request sent by the refilling software, which comprises the following steps: According to the encrypted key pair acquisition request, a first quantum random number and a public-private key pair are generated, the encrypted key pair acquisition request comprises a signature public key of the target Internet of Things module, and the signature public key of the target Internet of Things module is obtained by the refilling software sending a key refilling request to the target Internet of Things module; The first quantum random number is encrypted according to the signature public key to generate the first encrypted random number; The private key in the public-private key pair is encrypted according to the first quantum random number to generate the encrypted private key.

3. The method of claim 1, wherein, The encrypted symmetric encryption key is generated according to the symmetric encryption key acquisition request sent by the refilling software, which comprises the following steps: According to the symmetric encryption key acquisition request, a second quantum random number is generated; The second quantum random number is encrypted according to the public key to generate a second encrypted random number, and the encrypted symmetric encryption key is the second encrypted random number.

4. The method of claim 1, wherein, The encrypted refilling key is generated according to the refilling key acquisition request sent by the refilling software, which comprises the following steps: The refilling key is generated according to the refilling key acquisition request; The refilling key is encrypted according to the symmetric encryption key to generate the encrypted refilling key.

5. A method for IoT module quantum key infusion, the method comprising: receiving a request for a quantum key from a first IoT module; generating a quantum key; and transmitting the quantum key to the first IoT module. The application is applied to a target Internet of Things module of a quantum key refilling system, the quantum key refilling system further comprises a refilling software and a refilling station node, the refilling software connects the refilling station node and at least one Internet of Things module, and the method comprises the following steps: Based on the encrypted key pair import instruction sent by the refilling software, a first encrypted random number, an encrypted private key and a public key are imported to a secure chip, and the refilling station node is used for generating the first encrypted random number, the encrypted private key and the public key according to the encrypted key pair acquisition request sent by the refilling software; decrypting the first encrypted random number and the encrypted private key to generate a private key; based on the symmetric encryption key import instruction sent by the refilling software, importing an encrypted symmetric encryption key into the secure chip, the refilling station node being configured to generate the encrypted symmetric encryption key according to a symmetric encryption key acquisition request sent by the refilling software; decrypting the encrypted symmetric encryption key according to the private key to generate a symmetric encryption key; based on the refilling key import instruction sent by the refilling software, importing an encrypted refilling key into the secure chip, the refilling station node being configured to generate the encrypted refilling key according to a refilling key acquisition request sent by the refilling software; decrypting the encrypted refilling key according to the symmetric encryption key to generate the refilling key.

6. The method of claim 5, wherein, The decrypting the first encrypted random number and the encrypted private key to generate a private key comprises: decrypting the first encrypted random number according to a signature private key to generate a first quantum random number, the first encrypted random number being generated by encrypting the first quantum random number according to a signature public key of the target Internet of Things module; decrypting the encrypted private key according to the first quantum random number to generate the private key, the encrypted private key being generated by encrypting the private key using the first quantum random number.

7. The method of claim 5, wherein, After the decrypting the encrypted symmetric encryption key according to the private key to generate a symmetric encryption key, the method further comprises: if the encrypted symmetric encryption key is successfully decrypted according to the private key, sending a verification result to the refilling software to instruct the refilling software to send the refilling key acquisition request to the refilling station node.

8. A quantum key replenishment system, comprising: The quantum key refilling system comprises a refilling station node, refilling software and at least one Internet of Things module, the refilling software being configured to connect the refilling station node and the at least one Internet of Things module; The refilling station node is configured to execute the method of any one of claims 1-4, and the Internet of Things module is configured to execute the method of any one of claims 5-7, so that the refilling station node performs key refilling on the Internet of Things module through the refilling software.

9. An electronic device, comprising: comprise: a processor, a storage medium and a bus, the storage medium storing program instructions executable by the processor, the processor and the storage medium being in communication through the bus when the electronic device is running, and the processor executing the program instructions to execute the method of any one of claims 1-4, or the method of any one of claims 5-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to execute the method of any one of claims 1-4, or the method of any one of claims 5-7.

Images