Quantum security universal gateway and working method thereof
By designing a quantum-safe universal gateway, the problems of flexibility and security of communication devices in heterogeneous network environments are solved, and efficient and secure communication in a quantum computing environment is realized.
Patent Information
- Application Number
- CN202511479223.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2024-12-19
- Filing Date
- 2025-10-16
- Publication Date
- 2025-12-12
AI Technical Summary
Existing network communication gateway devices exhibit significant limitations and security vulnerabilities in heterogeneous network environments. They struggle to flexibly adapt to rapidly evolving network interface standards and emerging application layer protocols. Furthermore, traditional encryption algorithms are vulnerable to quantum computing attacks, and there is a lack of unified security protection mechanisms.
Design a quantum-safe universal gateway, comprising a power supply unit, an input/output unit, an encryption/decryption unit, an information processing unit, and a storage unit. Employing a combination of quantum encryption algorithms and hash calculations, it provides multiple communication protocols and data structure formats to realize data parsing, encapsulation, encryption/decryption, and storage, ensuring data security and integrity.
It enables seamless integration of multiple network interfaces and protocols in heterogeneous network environments, provides unified quantum security protection, improves communication efficiency and performance, reduces the probability of malicious attacks, and ensures data security and integrity.
Smart Images
Figure CN121125396A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to a quantum-safe universal gateway and its operating method. Background Technology
[0002] With the rapid development of network technology and the approaching era of quantum computing, traditional network communication systems face increasingly severe challenges in terms of compatibility and security. Existing network communication gateway devices are typically designed to be optimized for specific types of network interfaces (such as Ethernet, Fibre Channel, serial communication interfaces, etc.) or specific communication protocols (such as TCP / IP, Modbus, PROFIBUS, proprietary encryption protocols, etc.), resulting in significant limitations in heterogeneous network environments. When it is necessary to establish communication connections between network domains using different physical interfaces, data formats, transmission rates, or communication protocols, existing technologies often require multiple independent gateway devices for cascaded conversion or rely on complex protocol conversion software layers. This multi-layered conversion mechanism not only introduces additional transmission delays and reduces communication efficiency, but also, due to the rigid adaptation logic and poor scalability of each conversion stage, it is difficult to flexibly cope with rapidly evolving network interface standards and emerging application layer protocols, thus becoming a bottleneck in building efficient and flexible converged networks.
[0003] Of particular concern is the significant threat to secure data transmission during cross-domain communication. Existing security gateways primarily employ classical encryption algorithms (such as RSA and ECC) and authentication mechanisms to ensure data confidentiality and integrity. However, these traditional cryptographic systems, based on computational complexity, have already demonstrated vulnerability to quantum computing attacks and could potentially be cracked by quantum computers in a short time. Furthermore, because different network domains may employ heterogeneous security protocols and key management strategies, existing gateways often require multiple encryption / decryption and protocol reconstruction steps to achieve secure interoperability across protocols. This not only creates potential data exposure windows but also expands the attack surface due to increased system complexity. Current technology lacks a mechanism that can seamlessly integrate multiple network interfaces, proactively defend against quantum computing attacks, and provide unified security protection for heterogeneous protocol communication.
[0004] Therefore, in existing network communication scenarios, how to design a universal gateway device and its working method to adapt to communication between different network interfaces and protocols, while ensuring the security of communication data, is an urgent problem to be solved. Summary of the Invention
[0005] Purpose of the invention: This application provides a quantum-safe universal gateway and its operating method to solve the problems mentioned in the prior art.
[0006] Technical solution: The present invention provides a quantum-safe universal gateway, including a power supply unit, an input / output unit, an encryption / decryption unit, an information processing unit, a storage unit, and a communication unit; wherein, the power supply unit is communicatively connected to all other units, the input / output unit, the encryption / decryption unit, the information processing unit, and the storage unit are communicatively connected in sequence, the storage unit is also communicatively connected to the encryption / decryption unit, and the input / output unit is also communicatively connected to the communication unit;
[0007] The power supply unit is used to provide power to the quantum-safe universal gateway;
[0008] The communication unit is used to receive data and send encrypted data processing results.
[0009] The input / output unit is used to interact with the outside world through the communication unit: to receive data through the communication unit, and to send encrypted data processing results to the outside world through the communication unit;
[0010] The encryption / decryption unit is used to perform decryption operations on data in ciphertext state and to perform encryption operations on data processing results;
[0011] The information processing unit is used to receive instructions and data, and process the data according to the instructions to obtain the data processing result;
[0012] The storage unit is used to store data, data processing results, and keys.
[0013] As an improvement of the present invention, the encryption / decryption unit includes a data parsing module, a data encapsulation module, and an algorithm module, wherein the data parsing module and the data minute module are respectively communicatively connected to the algorithm module;
[0014] The data parsing module includes various communication protocols or data structure formats to handle the parsing of data transmitted from different edge computing devices.
[0015] The data encapsulation module also includes various communication protocols or data structure formats for encapsulating data to be transmitted to different edge computing devices.
[0016] The algorithm module is pre-configured with an encryption algorithm and a corresponding decryption algorithm; the algorithm module is used to call the key in the storage unit to perform decryption operation on the ciphertext data; the algorithm module is also used to call the key in the storage unit to perform encryption operation on the data processing result to perform encryption operation.
[0017] As an improvement of the present invention, the information processing module includes an instruction processing module and a data processing module, wherein the instruction processing module is used to receive instructions and instruct the data processing module to perform processing operations according to the received instruction content, and the data processing module is used to process data according to the instruction content to obtain the data processing result;
[0018] The instruction processing module and the data processing module are each configured with multiple processing sub-modules for concurrent instruction processing and data processing.
[0019] As an improvement of the present invention, the storage unit includes a memory and a key pool, wherein the memory is used to store data and its corresponding processing results, and the key pool is used to store keys for use by the encryption and decryption unit.
[0020] As an improvement to the present invention, a method for operating a quantum-safe universal gateway is also provided, applied to the quantum-safe universal gateway as described above, the method comprising the following steps:
[0021] Step 1: The communication unit of the quantum-safe universal gateway obtains information mes1 from the edge computing device, and the communication unit sends information mes1 to the encryption / decryption unit of the quantum-safe universal gateway via the input / output unit;
[0022] Step 2: The encryption and decryption unit of the quantum-safe universal gateway parses the information mes1 and sends it to the information processing unit of the quantum-safe universal gateway for processing, to obtain plaintext data data1 and data processing result data2;
[0023] Step 3: The information processing unit sends the plaintext data1 and the data processing result data2 together to the memory in the storage unit for corresponding storage, and feeds back the data processing result data2 to the encryption and decryption unit for encryption and data encapsulation operations to obtain the encapsulated information mes2;
[0024] Step 4: The encryption / decryption unit of the quantum-safe universal gateway sends the encapsulated information mes2 to the communication unit via the input / output unit, so that the encapsulated information mes2 can be sent to the outside world through the communication unit.
[0025] As an improvement to the present invention, the specific process of step 1 includes:
[0026] The communication unit of the quantum-safe universal gateway uses a communication unit connected to the edge computing device to obtain information mes1 from the edge computing device. The information mes1 encapsulates the ciphertext data DATA1 to be processed and the data processing instruction order. The communication interface sends the information mes1 to the input / output unit, and the input / output unit sends the information mes1 to the encryption / decryption unit of the quantum-safe universal gateway.
[0027] As an improvement to the present invention, the specific process of step 2 includes:
[0028] Step 2-1: The data parsing module in the encryption / decryption unit of the quantum-safe universal gateway parses the received information mes1, decomposes the data processing instruction order and the ciphertext data DATA1 to be processed, and records the communication protocol or data structure format involved in parsing the information mes1.
[0029] Step 2-2: The data parsing module sends the data processing instruction order to the instruction processing module in the information processing unit; the data parsing module sends the ciphertext data DATA1 to the local algorithm module of the encryption / decryption unit to perform the decryption operation, and sends the decrypted plaintext data data1 to the data processing module of the information processing unit.
[0030] As an improvement to the present invention, the specific process of step 3 includes:
[0031] Step 3-1: The instruction processing module in the information processing unit instructs the data processing module to process the plaintext data data1 according to the data processing instruction order, and obtains the data processing result data2. The data processing result data2 is fed back to the algorithm module in the encryption and decryption unit. The plaintext data data1 and the data processing result data2 are sent together to the memory in the storage unit for corresponding storage, so that the memory contains the plaintext data data1' and the data processing result data2' respectively.
[0032] Step 3-2: The algorithm module of the encryption / decryption unit calls the encryption key k2 in the key pool of the storage unit to encrypt the data processing result data2, obtaining ciphertext data DATA2. It records the key index idx-k2 of the encryption key k2 in the key file in the key pool, and stores the key index idx-k2 and the ciphertext data DATA2 locally. The ciphertext data DATA2 and the key index idx-k2 are sent to the data encapsulation module. After the data encapsulation operation, the encapsulation information mes2 containing the ciphertext data DATA2 and the key index idx-k2 is transmitted to the input / output unit.
[0033] Step 3-3: The algorithm module sends the encrypted data DATA2 to the data processing module for corresponding storage.
[0034] As an improvement of the present invention, in step 3-2, the data encapsulation operation includes:
[0035] The data encapsulation module obtains the ciphertext data DATA1 stored corresponding to the ciphertext data DATA2 from the data processing module. Based on the ciphertext data DATA1, it determines the communication protocol or data structure format of the information mes1 including the ciphertext data DATA1. The data encapsulation module uses the same communication protocol or data structure format to encapsulate the ciphertext data DATA2 and the key index idx-k2 to obtain the encapsulated information mes2.
[0036] As an improvement to the present invention, step 3 further includes:
[0037] Steps 3-4: The memory performs authentication operations on the corresponding stored data processing result data2':
[0038] A1: The memory generates a hash calculation instruction, which is sent to the data processing module via the instruction processing module to calculate the hash value h(data1, data2) of the plaintext data data1 and data processing result data2 stored locally in the data processing module. The hash value h(data1, data2) and the hash value calculation parameters are then sent to the memory.
[0039] The specific process for calculating the hash value h(data1, data2) includes:
[0040] The data processing module generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the key pool of the storage unit. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a hash function h. p1,s1 The plaintext data data1 and the data processing result data2 are input into the hash function h. p1,s1 The hash value h(data1, data2) = h is obtained. p1,s1 (data1, data2); Records the calculation parameters of the hash value during the calculation process: string str1 and input random number s1;
[0041] A2: The memory retrieves the ciphertext data DATA2 and the key index idx-k2 from the algorithm module. Based on the key index idx-k2, it retrieves the decryption key k2' from the key file in the key pool, performs the decryption operation, and obtains the data processing result data2''. It compares whether the decrypted data processing result data2'' is consistent with the data processing result data2' stored in step 3-1. If they are consistent, it continues to step A3; otherwise, the memory retrieves the data processing result data2 again from the data processing module.
[0042] A3: The memory calculates the hash value h'(data1', data2'') locally, and compares the calculated hash value h'(data1', data2'') with the hash value h(data1, data2) obtained in step A1. If they match, the authentication is successful; if they do not match, the memory retrieves the corresponding plaintext data data1 and data processing result data2 from the data processing module for secondary authentication. After successful authentication, the memory is updated.
[0043] The specific process for calculating the hash value h'(data1', data2'') includes:
[0044] The memory generates a hash function h' based on the received string str1' and the input random number s1'. p1’,s1’ Input the plaintext data1' stored in step 3-1 and the data processing result data2'' obtained in step A2 into the hash function h'. p1’,s1’ The hash value h'(data1', data2'') = h' is obtained. p1’,s1’ (data1', data2'').
[0045] Beneficial effects:
[0046] 1. The quantum-safe universal gateway provided in this application can perform a variety of functions, including data encryption and decryption operations, data processing and storage, to meet various needs of business development and backend operation and maintenance;
[0047] 2. The quantum-safe universal gateway provided in this application includes a variety of different interfaces, which have high flexibility and scalability; at different network connections and device connections, it provides more connection possibilities to adapt to different network environments and application scenarios, reduces the number of reconnections, optimizes the data transmission path, and effectively improves communication efficiency and performance;
[0048] 3. The quantum-safe universal gateway provided in this application is applicable to a wide range of scenarios, effectively reducing the number of reconnections. Consequently, the number and probability of malicious attacks on transmitted data are also reduced. At the same time, encryption and decryption operations provide guarantees for data security, thus effectively improving data security.
[0049] 4. The working method of the quantum-safe universal gateway provided in this application uses quantum security mechanism as an underlying universal service, rather than an external module that depends on a specific protocol. Regardless of the network interface from which the data comes or what communication protocol it follows, when the data is converted and forwarded through the gateway, it can enjoy the unified security protection of quantum encryption without difference. This effectively avoids the security difference problem caused by protocol heterogeneity, ensures the consistency of the security level of the entire communication link, and simplifies security deployment.
[0050] 5. The improved quantum-safe universal gateway working method of this application combines hash calculation with quantum encryption process to perform integrity verification during data transmission, ensuring the integrity and authenticity of stored data and preventing security risks caused by malicious data tampering. Attached Figure Description
[0051] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 This is a schematic diagram of the structure of the quantum-safe universal gateway of this application;
[0053] Figure 2 This is a schematic diagram of the communication system based on a quantum-safe universal gateway according to this application;
[0054] Figure 3 This is a flowchart illustrating the working method of the quantum-safe universal gateway of this application. Detailed Implementation
[0055] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0056] To address the universality issue of accessibility for various terminals as described in the background art, this application provides a quantum-safe universal gateway, including a power supply unit, an input / output unit, an encryption / decryption unit, an information processing unit, a storage unit, and a communication unit. For example... Figure 1 As shown, in the quantum-safe universal gateway provided in this application, the power supply unit is communicatively connected to all other units (not shown), the input / output unit, encryption / decryption unit, information processing unit, and storage unit are communicatively connected in sequence, the storage unit is also communicatively connected to the encryption / decryption unit, and the input / output unit is also communicatively connected to the communication unit.
[0057] The power supply unit (PSU) provides power to the quantum-safe universal gateway. The PSU is responsible for converting external power, typically household AC, into direct current (DC) required by the internal components of the computer, ensuring a stable and reliable power supply to these components. The performance and quality of the PSU directly affect the stability and lifespan of the entire quantum-safe universal gateway. More specifically, the power supply unit includes a power source and indicator lights. The power source converts external power into DC to provide power. The indicator lights show a green light indicating that the quantum-safe universal gateway is working normally, a red light indicating that power is connected, and a flashing light indicating that the quantum-safe universal gateway is restarting.
[0058] The communication unit is a component responsible for exchanging data with other devices or networks. It enables the computer to communicate with other devices, networks, or the Internet via wired or wireless means. Specifically, the communication unit can receive encrypted data from the outside world and send the encrypted data processing results to the outside world. More specifically, the communication unit includes wired and wireless interfaces to achieve data interaction with the outside world. The wired and wireless interfaces are used to connect to external hardware devices, public networks, etc., to receive data from external hardware devices, public networks, etc., and forward it to the input / output unit, or send encrypted data processing results to external hardware devices, public networks, etc. The wired interface includes: a USB interface, such as USB 4.0, USB 3.0, USB 2.0, USB Type-C, etc.; a serial universal interface, such as RS232 / 485; a wired network interface, including a wide area network (WAN) interface and a local area network (LAN) interface; a SIM card slot interface, a TF (TransFlash) slot, etc., for inserting a SIM card and a TF memory. The wireless interfaces include cellular network interfaces, Wi-Fi network interfaces, Bluetooth interfaces, Near Field Communication (NFC) interfaces, satellite communication interfaces, etc.
[0059] The input / output unit is used for data interaction with the outside world via the communication unit and with the encryption / decryption unit. The input / output unit includes an input module and an output module, and can determine whether to operate the input or output module based on the data flow. The data interaction includes receiving encrypted data via the communication unit and forwarding it to the encryption / decryption unit for further processing. The data interaction also includes sending the encrypted data processing result to the outside world via the communication unit. It should be noted that the encrypted data processing result here originates from the encryption / decryption unit.
[0060] The encryption / decryption unit is used to decrypt received ciphertext data and encrypt the data processing results. It should be noted that to ensure data transmission security, data from external sources is generally in ciphertext, which the information processing unit cannot directly process. Therefore, the encryption / decryption unit includes a data parsing module, a data encapsulation module, and an algorithm module. The data parsing module and the data encapsulation module are communicatively connected to the algorithm module. The data parsing module includes various communication protocols or data structure formats to handle the parsing of data transmitted from different edge computing devices. The data encapsulation module also includes various communication protocols or data structure formats to encapsulate data to be transmitted to different edge computing devices. The algorithm module has pre-set encryption and decryption algorithms. The algorithm module is used to call the key in the storage unit to decrypt the ciphertext data and send the decrypted data to the information processing unit for processing. The algorithm module is also used to call the key in the storage unit to encrypt the data processing results, preventing the data processing results from being transmitted in plaintext to external hardware devices and public networks.
[0061] The information processing unit receives instructions and data, processes the data according to the instructions, and obtains the data processing result. More specifically, the information processing module includes an instruction processing module and a data processing module. The instruction processing module receives instructions and instructs the data processing module to perform processing operations according to the received instruction content. The data processing module processes the data according to the instruction content and obtains the data processing result. The instruction processing module and the data processing module may also be configured with multiple processing sub-modules for concurrent instruction processing and data processing, saving time and improving work efficiency.
[0062] The storage unit is used to store data and keys. The storage unit includes a memory and a key pool, wherein the memory stores data and its corresponding processing results, and the key pool stores keys for use by the encryption / decryption unit. In embodiments of this application, the key may be a quantum key. The memory includes flash memory, DDR memory, TF memory, and hard disk.
[0063] The aforementioned quantum-safe universal gateway operates in, for example, Figure 2The communication system shown includes a quantum-safe universal gateway, an edge computing device, a router, and a server. In this system, the edge computing device, quantum-safe universal gateway, router, and server are sequentially connected. The edge computing device is used by users to conduct business, providing a service port for them to perform their own business. The edge computing device can be... Figure 2 The example shown is one of several terminals, which may come from different manufacturers and adopt different industry standards. Therefore, different terminals have different communication protocols, data structures, and data interfaces. For example, electricity meters collect readings, personal computers conduct office work, and gaming terminals transmit game commands or game data. In the communication system, the main functions of the quantum-safe universal gateway are device authentication and network access, quantum encryption and decryption, and service routing selection. The quantum-safe universal gateway of this application includes wired and wireless communication means, is compatible with various communication protocols and methods, and provides a broad verification environment for research and development. The router, as an optional device, provides internet access for devices. The server device is used to match the quantum-safe universal gateway, providing authentication access services for terminal devices and providing complete key services. It also provides corresponding business services for edge computing devices, such as electricity meter collection centers and service centers for gaming or office work.
[0064] Based on the quantum-safe universal gateway described above, this application also provides a method for operating the quantum-safe universal gateway. For example... Figure 3 As shown, the method includes the following steps:
[0065] Step 1: The communication unit of the quantum-safe universal gateway obtains information mes1 from the edge computing device, and the communication unit sends information mes1 to the encryption / decryption unit of the quantum-safe universal gateway via the input / output unit.
[0066] Specifically, step 1 includes: the communication unit of the quantum-safe universal gateway uses a communication unit (e.g., a wired interface or a wireless interface) connected to the edge computing device to obtain information mes1 from the edge computing device, wherein the information mes1 encapsulates the ciphertext data DATA1 to be processed and the data processing instruction order according to the requirements of the data transmission protocol or data transmission format; the communication interface sends the information mes1 to the input / output unit; the input / output unit of the quantum-safe universal gateway determines the operation of the input module according to the data flow direction and sends the information mes1 to the encryption / decryption unit.
[0067] In an embodiment of the present invention, the encrypted data DATA1 further includes key information and encrypted data content. Further, the key information may be the key index idx-k1 of the encryption key k1 used to encrypt the plaintext data data1 to obtain the encrypted data DATA1. It should be noted that the encryption key k1 is obtained from a symmetric key file pre-synchronized in the key pool of the storage unit of the edge computing device and the quantum-safe universal gateway, and the key index idx-k1 indicates the position information of the encryption key k1 in the key file.
[0068] Step 2: The encryption and decryption unit of the quantum-safe universal gateway parses the information mes1 and sends it to the information processing unit of the quantum-safe universal gateway for processing, to obtain plaintext data data1 and data processing result data2.
[0069] Specifically, step 2 includes:
[0070] Step 2-1: The data parsing module in the encryption / decryption unit of the quantum-safe universal gateway parses the received information mes1, decomposes the data processing instruction order and the ciphertext data DATA1 to be processed, and records the communication protocol or data structure format involved in parsing the information mes1; wherein, the data parsing module includes multiple communication protocol or data structure formats to cope with the parsing of data transmitted from different edge computing devices.
[0071] Step 2-2: The data parsing module sends the data processing instruction order to the instruction processing module in the information processing unit; the data parsing module sends the ciphertext data DATA1 to be processed to the local algorithm module of the encryption / decryption unit to perform the decryption operation, and sends the decrypted plaintext data data1 to the data processing module of the information processing unit.
[0072] In an embodiment of the present invention, the decryption operation described in step 2-2 includes: the algorithm module obtaining the corresponding decryption key from the key pool of the storage unit according to the key information included in the ciphertext data DATA1; the algorithm module using the decryption key to execute the decryption algorithm to decrypt the ciphertext data DATA1 to obtain the plaintext data data1 to be processed.
[0073] Step 3: The information processing unit of the quantum-safe universal gateway sends the plaintext data1 and the data processing result data2 together to the memory in the storage unit for corresponding storage. The data processing result data2 is fed back to the encryption and decryption unit for encryption and data encapsulation operations to obtain the encapsulated information mes2.
[0074] Specifically, step 3 includes:
[0075] Step 3-1: The instruction processing module in the information processing unit of the quantum-safe universal gateway instructs the data processing module to process the plaintext data data1 according to the data processing instruction order, and obtain the data processing result data2. The data processing result data2 is fed back to the algorithm module in the encryption and decryption unit. The plaintext data data1 and the data processing result data2 are sent together to the memory in the storage unit for corresponding storage. At this time, the memory contains the plaintext data data1' and the data processing result data2'. It should be noted that the plaintext data data1' and the data processing result data2' are related, that is, (data1', data2').
[0076] The data processing module can also obtain the ciphertext data DATA1 corresponding to the plaintext data data1 from the algorithm module of the encryption / decryption unit. At this time, the data processing module stores the corresponding relationship of "DATA1-data1-data2".
[0077] Step 3-2: The algorithm module of the encryption / decryption unit calls the encryption key k2 in the key pool of the storage unit to encrypt the data processing result data2, obtaining ciphertext data DATA2. It records the key index idx-k2 of the encryption key k2 in the key file in the key pool, and stores the key index idx-k2 and the ciphertext data DATA2 locally. The ciphertext data DATA2 and the key index idx-k2 are sent to the data encapsulation module. After the data encapsulation operation, the encapsulation information mes2, which contains the ciphertext data DATA2 and the key index idx-k2 and conforms to the data transmission format, is transmitted to the input / output unit.
[0078] Similarly, the data encapsulation module includes various communication protocols or data structure formats.
[0079] The data encapsulation operation described in step 3-2 includes: the data encapsulation module obtains the original unprocessed ciphertext data DATA1 stored corresponding to the ciphertext data DATA2 from the data processing module, and then determines the communication protocol or data structure format involved in parsing the recorded information mes1 including the ciphertext data DATA1 based on the ciphertext data DATA1. The data encapsulation module uses the same communication protocol or data structure format as during parsing to encapsulate the ciphertext data DATA2 and the key index idx-k2 to obtain the encapsulated information mes2.
[0080] Step 3-3: The algorithm module can also send the encrypted data DATA2 to the data processing module for corresponding storage to complete the storage of the complete correspondence "DATA1-data1-data2-DATA2".
[0081] In some embodiments, to ensure the correspondence between (data1', data2') stored in the memory and the integrity of the data processing result data2', the memory will also perform an authentication operation on the data processing result data2' received and stored in step 3-1 (i.e., step 3-4):
[0082] A1: The memory generates a hash calculation instruction, which is sent to the data processing module via the instruction processing module to calculate the hash value h(data1, data2) of the plaintext data data1 and data processing result data2 stored locally in the data processing module. The hash value h(data1, data2) and the hash value calculation parameters (string str1 and input random number s) are then sent to the memory.
[0083] The specific process for calculating the hash value h(data1, data2) as described in step A1 includes:
[0084] The data processing module generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the key pool of the storage unit. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a hash function h. p1,s1 The plaintext data data1 and the data processing result data2 are input into the hash function h. p1,s1 The hash value h(data1, data2) = h is obtained. p1,s1 (data1, data2); Records the calculation parameters of the hash value during the calculation process: string str1 and input random number s1.
[0085] A2: The memory retrieves the ciphertext data DATA2 and the key index idx-k2 from the algorithm module. Based on the key index idx-k2, it retrieves the decryption key k2' from the key file in the key pool and performs the decryption operation locally. Alternatively, it calls the algorithm module in the encryption / decryption unit to perform the decryption operation, obtaining the data processing result data2''. It compares the decrypted data processing result data2'' with the data processing result data2' stored in step 3-1. If they match, it continues to step A3; otherwise, the memory needs to retrieve the data processing result data2 again from the data processing module.
[0086] A3: The memory calculates the hash value h'(data1', data2'') locally and compares the calculated hash value h'(data1', data2'') with the hash value h(data1, data2) obtained in step A1. If they match, the correspondence is valid, the memory stores the data correctly, and the authentication operation is successful. If they do not match, the memory retrieves the corresponding plaintext data data1 and data processing result data2 from the data processing module for secondary authentication. After successful authentication, the memory is updated.
[0087] The specific process for calculating the hash value h'(data1', data2'') as described in step A3 includes:
[0088] The memory generates a hash function h' based on the received string str1' and the input random number s1'. p1’,s1’ Input the plaintext data1' stored in step 3-1 and the data processing result data2'' obtained in step A2 into the hash function h'. p1’,s1’ The hash value h'(data1', data2'') = h' is obtained. p1’,s1’ (data1', data2'').
[0089] Step 4: The encryption / decryption unit of the quantum-safe universal gateway sends the encapsulated information mes2 to the communication unit via the input / output unit, so that the encapsulated information mes2 can be sent to the outside world through the communication unit.
[0090] Specifically, step 4 includes: the input / output unit determines the operation of the output module according to the data flow direction of the encapsulation information mes2, sends the encapsulation information mes2 to the communication unit, and uses the corresponding interface in the communication unit to send the encapsulation information mes2 to the outside world.
Claims
1. A quantum-safe universal gateway, characterized in that, It includes a power supply unit, an input / output unit, an encryption / decryption unit, an information processing unit, a storage unit, and a communication unit; wherein, the power supply unit is communicatively connected to all other units, the input / output unit, the encryption / decryption unit, the information processing unit, and the storage unit are communicatively connected in sequence, the storage unit is also communicatively connected to the encryption / decryption unit, and the input / output unit is also communicatively connected to the communication unit; The power supply unit is used to provide power to the quantum-safe universal gateway; The communication unit is used to receive data and send encrypted data processing results. The input / output unit is used to interact with the outside world through the communication unit: to receive data through the communication unit, and to send encrypted data processing results to the outside world through the communication unit; The encryption / decryption unit is used to perform decryption operations on data in ciphertext state and to perform encryption operations on data processing results; The information processing unit is used to receive instructions and data, and process the data according to the instructions to obtain the data processing result; The storage unit is used to store data, data processing results, and keys.
2. The quantum-safe universal gateway according to claim 1, characterized in that, The encryption / decryption unit includes a data parsing module, a data encapsulation module, and an algorithm module, wherein the data parsing module and the data encapsulation module are respectively communicatively connected to the algorithm module; The data parsing module includes various communication protocols or data structure formats to handle the parsing of data transmitted from different edge computing devices. The data encapsulation module also includes various communication protocols or data structure formats for encapsulating data to be transmitted to different edge computing devices. The algorithm module is pre-configured with an encryption algorithm and a corresponding decryption algorithm; the algorithm module is used to call the key in the storage unit to perform decryption operation on the ciphertext data; the algorithm module is also used to call the key in the storage unit to perform encryption operation on the data processing result to perform encryption operation.
3. The quantum-safe universal gateway according to claim 1, characterized in that, The information processing module includes an instruction processing module and a data processing module. The instruction processing module is used to receive instructions and instruct the data processing module to perform processing operations according to the received instruction content. The data processing module is used to process the data according to the instruction content to obtain the data processing result. The instruction processing module and the data processing module are each configured with multiple processing sub-modules for concurrent instruction processing and data processing.
4. The quantum-safe universal gateway according to claim 1, characterized in that, The storage unit includes a memory and a key pool, wherein the memory is used to store data and its corresponding processing results, and the key pool is used to store keys for use by the encryption and decryption unit.
5. A method for operating a quantum-safe universal gateway, applied to the quantum-safe universal gateway as described in any one of claims 1 to 4, characterized in that, The working method includes the following steps: Step 1: The communication unit of the quantum-safe universal gateway obtains information mes1 from the edge computing device, and the communication unit sends information mes1 to the encryption / decryption unit of the quantum-safe universal gateway via the input / output unit; Step 2: The encryption and decryption unit of the quantum-safe universal gateway parses the information mes1 and sends it to the information processing unit of the quantum-safe universal gateway for processing, to obtain plaintext data data1 and data processing result data2; Step 3: The information processing unit sends the plaintext data1 and the data processing result data2 together to the memory in the storage unit for corresponding storage, and feeds back the data processing result data2 to the encryption and decryption unit for encryption and data encapsulation operations to obtain the encapsulated information mes2; Step 4: The encryption / decryption unit of the quantum-safe universal gateway sends the encapsulated information mes2 to the communication unit via the input / output unit, so that the encapsulated information mes2 can be sent to the outside world through the communication unit.
6. The method for operating the quantum-safe universal gateway according to claim 5, characterized in that, The specific process of step 1 includes: The communication unit of the quantum-safe universal gateway uses a communication unit connected to the edge computing device to obtain information mes1 from the edge computing device. The information mes1 encapsulates the ciphertext data DATA1 to be processed and the data processing instruction order. The communication interface sends the information mes1 to the input / output unit, and the input / output unit sends the information mes1 to the encryption / decryption unit of the quantum-safe universal gateway.
7. The method for operating a quantum-safe universal gateway according to claim 6, characterized in that, The specific process of step 2 includes: Step 2-1: The data parsing module in the encryption / decryption unit of the quantum-safe universal gateway parses the received information mes1, decomposes the data processing instruction order and the ciphertext data DATA1 to be processed, and records the communication protocol or data structure format involved in parsing the information mes1. Step 2-2: The data parsing module sends the data processing instruction order to the instruction processing module in the information processing unit; the data parsing module sends the ciphertext data DATA1 to the local algorithm module of the encryption / decryption unit to perform the decryption operation, and sends the decrypted plaintext data data1 to the data processing module of the information processing unit.
8. The method for operating the quantum-safe universal gateway according to claim 7, characterized in that, The specific process of step 3 includes: Step 3-1: The instruction processing module in the information processing unit instructs the data processing module to process the plaintext data data1 according to the data processing instruction order, and obtains the data processing result data2. The data processing result data2 is fed back to the algorithm module in the encryption and decryption unit. The plaintext data data1 and the data processing result data2 are sent together to the memory in the storage unit for corresponding storage, so that the memory contains the plaintext data data1' and the data processing result data2' respectively. Step 3-2: The algorithm module of the encryption / decryption unit calls the encryption key k2 in the key pool of the storage unit to encrypt the data processing result data2, obtaining ciphertext data DATA2. It records the key index idx-k2 of the encryption key k2 in the key file in the key pool, and stores the key index idx-k2 and the ciphertext data DATA2 locally. The ciphertext data DATA2 and the key index idx-k2 are sent to the data encapsulation module. After the data encapsulation operation, the encapsulation information mes2 containing the ciphertext data DATA2 and the key index idx-k2 is transmitted to the input / output unit. Step 3-3: The algorithm module sends the encrypted data DATA2 to the data processing module for corresponding storage.
9. The method of operating the quantum-safe universal gateway according to claim 8, characterized in that, In step 3-2, the data encapsulation operation includes: The data encapsulation module obtains the ciphertext data DATA1 stored corresponding to the ciphertext data DATA2 from the data processing module. Based on the ciphertext data DATA1, it determines the communication protocol or data structure format of the information mes1 including the ciphertext data DATA1. The data encapsulation module uses the same communication protocol or data structure format to encapsulate the ciphertext data DATA2 and the key index idx-k2 to obtain the encapsulated information mes2.
10. The method of operating the quantum-safe universal gateway according to claim 8, characterized in that, Step 3 also includes: Steps 3-4: The memory performs authentication operations on the corresponding stored data processing result data2': A1: The memory generates a hash calculation instruction, which is sent to the data processing module via the instruction processing module to calculate the hash value h(data1, data2) of the plaintext data data1 and data processing result data2 stored locally in the data processing module. The hash value h(data1, data2) and the hash value calculation parameters are then sent to the memory. The specific process for calculating the hash value h(data1, data2) includes: The data processing module generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from a key pool of the storage unit, and a string composed of coefficients of each term of the irreducible polynomial p1(x) except the highest term is recorded as str1; an irreducible polynomial p1(x) and an input random number s1 are used to generate a hash function h p1,s1 The plaintext data data1 and the data processing result data2 are input into the hash function h p1,s1 , and a hash value h(data1, data2)=h p1,s1 (data1, data2) is obtained; the calculation parameters of the hash value in the calculation process are recorded: the string str1 and the input random number s1; A2: The memory retrieves the ciphertext data DATA2 and the key index idx-k2 from the algorithm module. Based on the key index idx-k2, it retrieves the decryption key k2' from the key file in the key pool, performs the decryption operation, and obtains the data processing result data2''. It compares whether the decrypted data processing result data2'' is consistent with the data processing result data2' stored in step 3-1. If they are consistent, it continues to step A3; otherwise, the memory retrieves the data processing result data2 again from the data processing module. A3: The memory calculates the hash value h'(data1', data2'') locally, and compares the calculated hash value h'(data1', data2'') with the hash value h(data1, data2) obtained in step A1. If they match, the authentication is successful; if they do not match, the memory retrieves the corresponding plaintext data data1 and data processing result data2 from the data processing module for secondary authentication. After successful authentication, the memory is updated. The specific process for calculating the hash value h'(data1', data2'') includes: The memory generates a hash function h' based on the received string str1' and the input random number s1'. p1’,s1’ Input the plaintext data1' stored in step 3-1 and the data processing result data2'' obtained in step A2 into the hash function h'. p1’,s1’ The hash value h'(data1', data2'') = h' is obtained. p1’,s1’ (data1', data2'').