Quantum safety USB flash disk

Abstract

The embodiment of the invention provides a quantum security USB flash disk, which comprises a common storage area for storing common files, and further comprises a main quantum key generation module for generating a quantum key; the key area is used for storing the quantum key generated by the main quantum key generation module; the processor is used for judging whether the security level of a to-be-stored file is a first level or a second level based on feature information of the to-be-stored file, and encrypting the to-be-stored file with the security level being the second level based on the quantum key generated by the main quantum key generation module to obtain a quantum security file; and the secure storage area is used for storing the quantum security file. And a true random number generation technology based on a quantum physical phenomenon meets a data protection requirement of a high security level.

Description

Technical Field

[0001] This application relates to the field of quantum technology, and in particular to a quantum-safe USB flash drive. Background Technology

[0002] With the rapid development of information technology and the increasing demand for data security, portable storage devices have become an important tool for modern office and personal data management. USB flash drives (U-disks), as the most commonly used portable storage devices, are widely used in government agencies, financial institutions, enterprises, and individual users. However, traditional U-disks have many shortcomings in data security protection, especially in the face of increasingly severe cybersecurity threats and the upcoming challenges of quantum computing; existing technologies are struggling to meet the high-security requirements for data protection. Summary of the Invention

[0003] This application provides a solution to the technical problem that traditional USB flash drives in the prior art cannot meet the requirements for high-security data protection.

[0004] In a first aspect, embodiments of this application provide a quantum-safe USB flash drive, comprising: The master quantum key generation module is used to generate quantum keys; The key area is used to store the quantum keys generated by the main quantum key generation module. The processor is used to determine whether the security level of the file to be stored is level one or level two based on the feature information of the file to be stored, and to encrypt the file to be stored with a security level of level two using a first encryption algorithm based on the quantum key generated by the master quantum key generation module, so as to obtain a quantum-safe file. A secure storage area is used to store the quantum-safe files; The general storage area is used to directly store files with a security level of Level 1.

[0005] In one possible implementation, the processor is further configured to determine whether the computer is a trusted computer when the quantum-safe USB flash drive is in a communicative connection with the computer. When the computer is a trusted computer, the quantum-safe file stored in the secure storage area is decrypted before the user operates on the quantum-safe file; When the computer is untrusted, a locking operation is performed when the quantum-safe USB flash drive is connected to the computer. The operation also detects whether the untrusted computer connected to the quantum-safe USB flash drive is connected to the internet. The locking operation prohibits copying or cutting quantum-safe files stored in the secure storage area, and also prohibits decryption of quantum-safe files. If the untrusted computer connected to the quantum-safe USB flash drive is detected to be connected to the internet, a security request is sent to a designated network address. If no security indication is received from the designated network address within a preset time period after sending the security request, the quantum-safe files stored in the secure storage area are encrypted again using a second encryption algorithm. If a security indication is received from the designated network address within a preset time period after sending the key request, the locking operation is released.

[0006] In one possible implementation, the quantum-safe USB flash drive further includes: a positioning module, used to locate the geographical location of the quantum-safe USB flash drive and obtain positioning information; The processor is also configured to acquire the location information, and when the location information indicates that the quantum-safe USB flash drive is in a secure area, and the quantum-safe USB flash drive is connected to a computer, decrypt the quantum-safe files stored in the secure storage area before the user operates on the quantum-safe files.

[0007] In one possible implementation, the quantum-safe USB flash drive further includes: a positioning module, used to locate the geographical location of the quantum-safe USB flash drive and obtain positioning information; The processor is further configured to, when the positioning information indicates that the quantum-safe USB drive is in an insecure area and the quantum-safe USB drive is connected to a computer, perform a locking operation. The locking operation prohibits copying or cutting quantum-safe files and also prohibits decryption of quantum-safe files. Then, it determines whether the computer is a trusted computer. If the computer is an untrusted computer, it is checked whether the untrusted computer is connected to the network. If it is not connected to the network, the quantum-safe file is deleted directly. If it is connected to the network, the quantum-safe file is sent to the designated network address, and the quantum-safe file stored in the secure storage area is deleted. If a security instruction including the quantum-safe file is received from the designated network address within a preset time period after sending the quantum-safe file to the designated network address, the quantum-safe file is re-stored in the secure storage area.

[0008] In one possible implementation, the feature information of the file to be stored includes at least one of the following: file name information, text information, image information, author information, and security level identification information of the file to be stored.

[0009] In one possible implementation, the master quantum key generation module includes: a quantum random number generator for generating quantum random numbers for generating quantum keys; The random number quality detection unit is used to perform real-time quality detection on the random numbers generated by the quantum random number generator. The quality detection includes at least one of frequency testing, intra-block frequency testing, run testing, and longest run testing. When the p-value of the detection result is lower than a preset threshold, the main quantum key generation module outputs a warning signal to the processor.

[0010] In one possible implementation, the master quantum key generation module further includes: An entropy source monitoring unit is used to monitor the physical parameters of the quantum random number generator in real time, the physical parameters including at least one of photon count rate, noise power spectral density and signal-to-noise ratio; When the physical parameters deviate from the preset normal range, the master quantum key generation module outputs a warning signal to the processor.

[0011] In one possible implementation, the quantum-safe USB flash drive further includes: An environmental monitoring module is used to monitor environmental parameters that affect the operation of the quantum random number generator in real time. The environmental parameters include at least one of temperature, humidity, electromagnetic field strength, and mechanical vibration. The processor is also used to obtain an environment determination result based on the correlation model between the environmental parameters and the quality of random numbers. When the environment determination result indicates that the quantum-safe USB flash drive is in an unstable environment, the processor controls the quantum-safe USB flash drive to output a prompt message to the user to switch the usage environment.

[0012] In one possible implementation, the quantum-safe USB flash drive further includes a backup quantum key generation module; The processor is further configured to instruct the backup quantum key generation module to generate random numbers when it receives an early warning signal output by the main quantum key generation module; The processor is further configured to, upon receiving a firmware upgrade request signal, send a start command to the backup quantum key generation module to enable the backup quantum key generation module to start the quantum key generation function, and send a pause command to the main quantum key generation module to enable the main quantum key generation module to pause the quantum key generation function; Based on the start confirmation signal returned by the backup quantum key generation module and the pause confirmation signal returned by the main quantum key generation module, an upgrade operation is performed on the control firmware corresponding to the main quantum key generation module. When the upgrade operation is completed, a pause command is sent to the backup quantum key generation module to make the backup quantum key generation module pause the quantum key generation function, and a start command is sent to the main quantum key generation module to make the main quantum key generation module start the quantum key generation function.

[0013] In one possible implementation, the master quantum key generation module includes a quantum random number generator, and the processor is further configured to: execute the data spoofing storage process of the quantum-secure file; The data masquerading and storage process includes: Retrieve the data stored in the secure storage area; Based on the length of the data, a noise generation request is sent to the quantum random number generator to obtain a quantum noise sequence of the corresponding length; Based on the quantum noise sequence, a mixing operation is performed on the data to obtain disguised data; The spoofed data is divided into multiple data blocks according to a preset block size; Send a position calculation seed generation request to the quantum random number generator to obtain the position calculation seed; Based on the location, a seed is calculated to generate a candidate location sequence, wherein the candidate location sequence is mapped to the available storage addresses in the ordinary storage area; Detect whether there are duplicate addresses in the candidate location sequence. If a duplicate address is detected, replace the duplicate address with another available storage address until there are no duplicate addresses in the candidate location sequence. Based on the location candidate sequence, the spoofed data is distributed and stored in the ordinary storage area, and the data in the secure storage area is deleted.

[0014] The quantum-safe USB flash drive proposed in this application, in addition to a regular storage area for storing ordinary files, also includes: a master quantum key generation module for generating quantum keys; a key area for storing the quantum keys generated by the master quantum key generation module; a processor for determining the security level of the file to be stored as either level one or level two based on the characteristic information of the file to be stored, and encrypting the file to be stored with a security level of level two based on the quantum key generated by the master quantum key generation module to obtain a quantum-safe file; and a secure storage area for storing the quantum-safe file. The true random number generation technology based on quantum physics phenomena meets the requirements for high-security data protection. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] Figure 1 This is a schematic diagram of the structure of a quantum-safe USB flash drive provided in one embodiment of this application; Figure 2 This application provides a schematic diagram of a data processing flow as an embodiment of the present application. Figure 3 This is a schematic diagram of another data processing flow provided in an embodiment of this application.

[0017] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0018] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of systems and methods consistent with some aspects of this application as detailed in the appended claims.

[0019] With the rapid development of information technology and the increasing demand for data security, portable storage devices have become an important tool for modern office and personal data management. USB flash drives (U-disks), as the most commonly used portable storage devices, are widely used in government agencies, financial institutions, enterprises, and individual users. However, traditional U-disks have many shortcomings in data security protection, especially in the face of increasingly severe cybersecurity threats and the upcoming challenges of quantum computing; existing technologies are struggling to meet the high-security requirements for data protection.

[0020] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0021] Example 1 like Figure 1 As shown, this embodiment provides a quantum-safe USB flash drive, including a main quantum key generation module 100, a key area 200, a processor 300, a secure storage area 400, and a normal storage area 500.

[0022] The master quantum key generation module 100 is the core security component of the entire quantum-safe USB flash drive. Its main function is to provide high-quality quantum-safe keys for file encryption. This module employs true random number generation technology based on quantum physics phenomena to ensure that the generated keys are unpredictable and unreproducible, thus providing theoretical-level protection for data security. Furthermore, the master quantum key generation module 100 may specifically include a quantum random number generator, a key derivation unit, and a key management unit.

[0023] In one alternative implementation, the quantum random number generator employs photon time interval detection technology, generating truly random numbers by measuring the time interval between the arrival of a single photon at a photodetector. The arrival time of photons follows a Poisson distribution according to quantum mechanics, and its randomness stems from the inherent uncertainty of quantum measurement. The beneficial effect of this technique is that the generated random numbers are completely unpredictable; even an attacker with unlimited computing power cannot predict the value of the next random number.

[0024] In another alternative implementation, the quantum random number generator can also employ a quantum tunneling noise source. Random numbers are generated by measuring the quantum tunneling current noise in a reverse-biased diode. Quantum tunneling is a purely quantum phenomenon, where the probability of an electron passing through a potential barrier exhibits quantum randomness. The advantage of this approach is its relatively simple device structure and low cost, while still ensuring good randomness quality.

[0025] The key derivation unit receives raw random data generated by a quantum random number generator and converts it into a key format that conforms to the requirements of a specific encryption algorithm through a key derivation function. The key derivation unit supports multiple international standard KDF algorithms, including HKDF and PBKDF2, and also supports the key derivation function of the domestic cryptographic algorithm SM3. Preferably, the key derivation unit uses the HKDF algorithm, which has good security proofs and high computational efficiency.

[0026] The key management unit is responsible for assigning independent keys to different files, with each file corresponding to a different key. Even if the key for one file is compromised, the security of other files will not be affected, greatly reducing the scope of security risk propagation. The key management unit assigns a unique identifier to each key and maintains the key-file mapping. Furthermore, the key management unit can also record the number of times each key is used, its creation time, and its expiration date, supporting key lifecycle management.

[0027] The key area 200 employs hardware-level secure storage technology, making it completely invisible to users and ordinary applications. Its primary function is to securely store quantum keys and related security metadata, ensuring that the keys are not accessed or tampered with without authorization. The key area 200 stores the quantum keys generated by the main quantum key generation module 100, a file-key mapping table, key usage counts and expiration information, file security level identifiers, and operation audit logs. Access to the key area 200 is controlled by a dedicated security controller; only the processor 300 can access the data in the key area 200 through a predetermined security protocol. The advantage of this design is that even if other parts of the quantum-safe USB drive are attacked, the keys remain protected.

[0028] The processor 300 is the control center of the quantum-safe USB flash drive, responsible for core functions such as file security level determination, encryption and decryption operations, and system security policy management. The processor 300 classifies files based on their security level characteristics. For example, security levels can be divided into Level 1 and Level 2. Level 1 represents a normal security level, suitable for public or low-sensitivity files; Level 2 represents a high security level, suitable for confidential or sensitive files.

[0029] The Processor 300's file feature analysis can include at least one of the following: file extension analysis, file size determination, and keyword scanning. Different types of files have different levels of sensitivity. For example, office documents such as .docx, .pdf, and .xls typically contain important information and are classified as Level 2; plain text files such as .txt and .log are typically classified as Level 1. Large files may contain important databases or media content, and files exceeding a preset size threshold will receive special attention. The Processor 300 has a built-in sensitive word database, including keywords such as "confidential," "internal," "secret," "confidential," and "secret." Files containing these keywords will automatically have their security level increased.

[0030] For files classified as Level 2, the processor 300 automatically initiates the encryption process. First, it obtains a dedicated quantum key from the master quantum key generation module 100, and then selects a suitable encryption algorithm to encrypt the file. Supported encryption algorithms include international and domestic standard algorithms such as AES-256 and SM4. Preferably, for government and enterprise users, the system prioritizes the domestic SM4 algorithm to meet compliance requirements.

[0031] The secure storage area 400 is dedicated to storing files encrypted with quantum keys. Preferably, this area uses a special file system format that is invisible to the operating system and can only be accessed through a dedicated management program on the quantum-secure USB flash drive. The advantage of this design is that even if malware infects the host system, it cannot directly access the encrypted files. The general storage area 500 is used to store first-level ordinary files, which can use the standard FAT32 or exFAT file system, and is used in the same way as a regular USB flash drive. Users can directly access these files through the operating system's file manager, providing good compatibility and ease of use.

[0032] Example 2 Building upon Embodiment 1, the processor 300 also possesses a trusted computer assessment function to ensure that quantum-safe files are only decrypted and accessed in a secure environment. The processor 300 determines whether a computer is trusted through multiple dimensions.

[0033] For example, at the hardware level, processor 300 checks whether the host is equipped with a Trusted Platform Module (TPM) chip. A TPM is a dedicated security chip that provides hardware-level security functions. Processor 300 verifies the host's hardware integrity by reading the TPM's authentication key and platform configuration registers. Furthermore, processor 300 also generates a unique hardware fingerprint by analyzing hardware parameters such as the host's CPU characteristics, memory features, and motherboard information. The advantage of this method is that it can identify specific physical devices, preventing virtual machine spoofing or hardware impersonation attacks.

[0034] For example, at the software level, processor 300 calculates the hash values ​​of the operating system kernel and critical system files and compares them with a trusted baseline database. If files are found to have been tampered with, it indicates that the system may be infected with malware. Processor 300 also verifies whether the host has trusted antivirus software installed, checking its running status, virus definition version, and other information. Preferably, processor 300 also checks the digital signatures of critical system components to ensure their trustworthy origin.

[0035] For example, regarding the network environment, processor 300 analyzes the host's network configuration, including IP address, DNS settings, proxy configuration, etc., to determine whether it is in a secure network environment. Processor 300 also matches the host's network behavior with a known threat intelligence database to identify potential security threats.

[0036] When a computer is deemed a trusted computer, processor 300 executes a decryption control process. First, the user may be prompted to enter a PIN code or undergo biometric verification to confirm the user's legitimacy. Then, it checks whether the user has permission to access specific quantum-safe files. To improve user experience, files can be decrypted before the user interacts with them, shortening the time between clicking and opening the file. The corresponding quantum key is retrieved from the key area 200, and the file is decrypted using this key, generating a plaintext file for the user to access. Furthermore, during file access, processor 300 continuously monitors the system status; if a security threat is detected, access is immediately stopped and temporary files are cleared. This multi-layered security control mechanism ensures reliable protection of quantum-safe files even in complex network environments. When the computer is untrusted, and the quantum-safe USB drive is connected to the computer, a locking operation is performed. This locking operation prohibits copying or cutting quantum-safe files stored in the secure storage area, and also prohibits decryption of quantum-safe files, preventing unauthorized access to files on the quantum-safe USB drive and ensuring the security of the quantum-safe files.

[0037] When the quantum-safe USB drive detects that an untrusted computer is connected to the internet, it sends a security request to a designated network address. If the USB drive does not receive a security indication from the designated network address within a preset time period (e.g., 10 minutes), it performs a second encryption on the quantum-safe file using a second encryption algorithm. Upon receiving a security indication from the designated network address within the preset time period, the drive unlocks the file. It's important to note that when the network platform corresponding to the designated network address verifies that the untrusted computer is trusted, it will return a security indication to the quantum-safe USB drive. The USB drive then attempts to remove the restriction based on the security request, thus flexibly ensuring cross-computer operability while maintaining security in unauthorized situations.

[0038] In other words, please see Figure 2 This is a schematic diagram of a data processing flow provided in an embodiment of this application. In this embodiment, the processor 300 executes the following flow: Step S601: When the quantum-safe USB flash drive is connected to the computer, determine whether the computer is a trusted computer.

[0039] If the computer is a trusted computer, proceed to step S6021; if the computer is an untrusted computer, proceed to step S6022.

[0040] Step S6021: Decrypt the quantum-safe file stored in the secure storage area before the user operates on it.

[0041] Step S6022: Perform a locking operation and check whether the untrusted computer connected to the quantum-safe USB flash drive is connected to the network.

[0042] If the untrusted computer connected to the quantum-safe USB flash drive is not connected to the network, execute step S6031: maintain the lock operation; if the untrusted computer connected to the quantum-safe USB flash drive is connected to the network, execute step S6032.

[0043] Step S6032: Send a security request message to the specified network address.

[0044] If no security indication is received from the specified network address within a preset time period after sending the security request information, step S6041 is executed: the quantum-safe file stored in the secure storage area is encrypted again using the second encryption algorithm. If a security indication is received from the specified network address within a preset time period after sending the security request information, step S6042 is executed: the locking operation is released.

[0045] Example 3 Based on the aforementioned embodiment one, the quantum-safe USB flash drive also includes a positioning module for enabling geolocation-based security control. The positioning module can integrate one or more positioning technologies.

[0046] In one implementation, in outdoor environments, the positioning module determines precise geographic coordinates by receiving GPS satellite signals. GPS positioning accuracy can reach 3-5 meters, meeting the needs of most security area assessments. As a supplement to GPS, the positioning module also supports China's independent BeiDou Navigation Satellite System, providing better positioning services within China. In an optional implementation, the positioning module also supports the European Galileo system and the Russian GLONASS system, providing global positioning coverage.

[0047] In another implementation, in indoor environments or environments with weak GPS signals, the positioning module 600 determines its location by scanning surrounding WiFi hotspots and using WiFi fingerprinting technology. This technology is based on a database of geographic coordinates of known WiFi hotspots and calculates the device's location through signal strength triangulation. Preferably, the positioning module also utilizes signals from mobile phone base stations for coarse positioning. Although the accuracy is lower, the coverage is wide, and it can serve as a supplement to other positioning methods.

[0048] In another implementation, the quantum-safe USB drive can be configured with an administrator mode, allowing the administrator to set the geographical boundaries of the secure area using a dedicated configuration tool. The secure area can be circular, defined by the coordinates of its center point and radius, or polygonal, defined by the coordinates of multiple vertices. Typical secure areas include company office buildings and surrounding areas, government compounds, R&D centers and laboratories, residential homes, designated meeting rooms or office areas, etc.

[0049] Furthermore, for mobile office scenarios, the system supports dynamic security zone functionality. For example, when a user is traveling, they can temporarily set up hotels, client offices, etc., as temporary security zones and set an expiration date. The system also supports multi-level security zone settings, with different security zone requirements corresponding to different file levels. High-secret files may only be accessible in the core security zone, while general confidential files can be accessed in the extended security zone.

[0050] The processor 300 acquires the location information obtained by the positioning module 600. When the location information indicates that the quantum-safe USB drive is within a preset secure area, the processor 300 allows normal decryption and access operations on quantum-safe files. In a controlled physical environment, the risk of data leakage is relatively low. When the quantum-safe USB drive is in an insecure area, the processor 300 will prohibit decryption operations on quantum-safe files, but will still allow access to unencrypted files in the ordinary storage area 500. The beneficial effect of this mechanism is to prevent accidental leakage of sensitive information in public places or insecure environments, reduce the risk of data leakage when the device is lost or stolen, and meet the requirements of certain industry regulations regarding the geographical location of data.

[0051] Furthermore, to improve user experience and shorten the time from clicking on a quantum-safe file to opening it, the file can be pre-decrypted within a preset security area before the user performs any operations on it.

[0052] To prevent GPS spoofing attacks, the positioning module employs a multi-factor authentication mechanism. Multiple positioning technologies are used simultaneously for cross-verification to detect the rationality of location changes; for example, large-distance movement within a short period is considered abnormal. Preferably, the positioning module combines timestamp verification with time synchronization via a network time protocol to prevent timestamp forgery.

[0053] Furthermore, when the location information indicates that the quantum-safe USB drive is in an insecure area, and the quantum-safe USB drive is connected to the computer, a locking operation is performed. The locking operation prohibits copying or cutting quantum-safe files, and also prohibits decryption of quantum-safe files. Then, it is determined whether the computer is a trusted computer. If the computer is untrusted, the system checks whether it is connected to the internet. If it is not connected, the quantum-safe file is deleted directly. If it is connected, the system sends the quantum-safe file to a designated network address and deletes it from the secure storage area. If a security instruction containing the quantum-safe file is received from the designated network address within a preset time period after sending the quantum-safe file, the quantum-safe file is then re-stored in the secure storage area. The advantage of this design is that when the computer is not in a secure area or on a secure computer, and cannot be connected to the internet, it is highly likely to be stolen. Activating the self-deletion function directly prevents file leakage. If the computer is connected to the internet, the quantum file is first sent to the designated network before deletion. Upon receiving a security instruction from the designated network address, the quantum-safe file is then re-stored, further reducing the possibility of accidental deletion due to security issues while ensuring the security of the quantum-safe file.

[0054] In other words, please see Figure 3 This is a schematic diagram of another data processing flow provided in an embodiment of this application. In this embodiment, the processor 300 executes the following flow: Step S701: Obtain location information.

[0055] Based on the location information, determine whether the quantum-safe USB flash drive is in a safe area. If the location information indicates that the quantum-safe USB flash drive is in a safe area, execute step S7021. If the location information indicates that the quantum-safe USB flash drive is in a non-safe area, execute step S7022.

[0056] Step S7021: When the quantum-safe USB flash drive is connected to the computer, the quantum-safe file stored in the secure storage area is decrypted before the user operates on the quantum-safe file.

[0057] Pre-decrypting quantum-safe files saves users time waiting for decryption and improves the user experience.

[0058] Step S7022: When the quantum-safe USB flash drive is connected to the computer, a locking operation is performed, and then it is determined whether the computer is a trusted computer. For a method on how to determine whether a computer is a trusted computer, please refer to the aforementioned Embodiment 2.

[0059] The locking operation prevents copying or cutting of quantum-safe files, and also prevents decryption of quantum-safe files.

[0060] If the computer is a trusted computer, proceed to step S7031: unlock operation.

[0061] If the computer is an untrusted computer, proceed to step S7032: detect whether the untrusted computer is connected to the network.

[0062] If not connected to the network, proceed to step S7041: directly delete the quantum-safe file. If connected to the network, proceed to step S7042: send the quantum-safe file to the designated network address and delete the quantum-safe file stored in the secure storage area. If a security instruction including the quantum-safe file is received from the designated network address within a preset time period after sending the quantum-safe file, proceed to step S7051: restore the quantum-safe file in the secure storage area. If no security instruction including the quantum-safe file is received from the designated network address within a preset time period after sending the quantum-safe file, proceed to step S7052: Maintain the deletion status of quantum-safe files in the secure storage area.

[0063] Example 4 Based on any one of the aforementioned embodiments one to three, the specific implementation of the processor 300 in determining the security level based on the feature information of the file to be stored includes the analysis of file name information, text information, image information, author information, and security level identification information.

[0064] Regarding filename information analysis, the processor 300 has a built-in file type security level mapping table that automatically determines the potential sensitivity of a file based on its file extension. For example, highly sensitive types may include .docx, .pptx, .xlsx, .pdf, .dwg, .zip, .rar, .sql, .db, .key, .p12, .pfx, etc.; moderately sensitive types include .jpg, .png, .mp4, .avi, .mp3, .wav, etc.; and low-sensitivity types include .txt, .log, .html, .xml, .css, .js, etc. The processor 300 also analyzes whether the filename contains sensitive keywords such as "finance," "salary," "contract," "password," "backup," and "confidential." Files containing these keywords will have their security level automatically increased.

[0065] For text information content analysis, the processor 300 uses natural language processing technology to analyze document content. First, it scans the document for predefined sensitive words. For example, the sensitive word database includes personal privacy words such as ID card numbers, mobile phone numbers, bank card numbers, and credit card numbers; trade secret words such as business plans, marketing strategies, financial data, and customer lists; technical secret words such as source code, algorithms, patents, and technical specifications; and legal-related words such as contracts, agreements, legal documents, and litigation materials.

[0066] Furthermore, the processor 300 determines the subject and content nature of a document through semantic analysis. For example, a document containing a large number of financial terms may be a financial statement, while a document containing technical terms may be a technical document. The processor 300 also analyzes the document's format and structural features; formal business documents typically have specific format features, such as headers, signatures, and seal placement.

[0067] For image information recognition, processor 300 employs image recognition technology to analyze image content. It performs optical character recognition (OCR) on the text in the image and then applies text information analysis methods, which is particularly effective for images such as screenshots and scanned documents. For example, processor 300 can also detect whether an image contains faces; images containing multiple people or ID card photos are considered to have high privacy sensitivity. Preferably, processor 300 identifies the shooting scene of the image; images from scenes such as offices, meeting rooms, and laboratories may contain sensitive information. Processor 300 also analyzes the image's EXIF ​​metadata, including shooting time, location, and device information, which may leak sensitive location and time information.

[0068] Regarding author information verification, the processor 300 extracts information such as author, creator, and last modifier from the document's metadata. This information helps determine the document's origin and importance. The processor 300 checks whether the document contains a digital signature; signed documents typically have higher importance and legal validity. The processor 300 can also check whether the document contains copyright notices, trademarks, or other intellectual property-related information.

[0069] For security level identification information, the system supports users or administrators to add custom security level tags to files, such as "Confidential," "Internal," and "Public." The system also supports recognizing security level identifiers that conform to industry standards, such as military standard classification identifiers and commercial confidentiality level identifiers. In an optional implementation, the system embeds the security level identifier in the file's metadata, so that the security level information is retained even if the file is renamed or modified.

[0070] Example 5 Based on any one of the aforementioned embodiments one to four, the main quantum key generation module 100 further includes a random number quality detection unit for real-time quality detection of the random numbers generated by the quantum random number generator. Random number quality detection is based on statistical hypothesis testing theory; for a truly random number sequence, its statistical properties should conform to a theoretical random distribution. By calculating various statistics and performing hypothesis testing, the randomness quality of the random number sequence can be evaluated.

[0071] The p-value is a core concept in hypothesis testing in statistics, defined as the probability of observing the current test statistic or a more extreme result given that the null hypothesis is true. In random number quality testing, the null hypothesis H0 states that the tested sequence of numbers is completely random, and the alternative hypothesis H1 states that the tested sequence of numbers is not completely random. The p-value is calculated as the probability of observing the current statistic or a more extreme value given that the null hypothesis is true. The interpretation criteria for the p-value are: a p-value greater than or equal to 0.01 indicates that there is insufficient evidence to suggest that the sequence is not random, and the sequence passes the randomness test; a p-value less than 0.01 indicates that there is statistical evidence that the sequence may not be random, and the random number sequence should be rejected. In some more stringent applications, 0.001 can also be used as a judgment threshold.

[0072] Random number quality testing includes several methods. The frequency test examines whether the ratio of 0s to 1s in a random number sequence is close to 1:1. The test method involves counting the number of 1s (S) in an n-bit random number sequence, calculating a statistic, and then calculating a p-value. For a 10,000-bit random number sequence, if it contains 5050 1s and 4950 0s, the calculated statistic is approximately 1, and the corresponding p-value is approximately 0.317, indicating that the sequence passes the frequency test. However, if it contains 5200 1s and 4800 0s, the calculated statistic is approximately 4, and the corresponding p-value is approximately 0.00006, indicating that the sequence fails the frequency test and has a significant frequency deviation.

[0073] The intra-block frequency test is used to examine whether the proportion of 0s and 1s is uniformly distributed within a fixed-length data block. The test method involves dividing an n-bit sequence into N blocks of length M, calculating the proportion of 1s in each block, and then calculating the chi-square statistic. The beneficial effect of this test is its ability to detect local non-randomness; even if the overall frequency is normal, local biases may exist.

[0074] The runs test is used to detect whether the distribution of consecutive identical positions conforms to the expected randomness. The test method involves counting the total number of runs in the sequence and comparing it to the theoretical expected value. If the random number generator exhibits periodicity or correlation, it will show an anomalous runs distribution.

[0075] The longest run test is used to examine the length distribution of the longest consecutive sequence of 1s in a data block. The test involves dividing the sequence into several blocks, counting the longest sequence of 1s in each block, and calculating the chi-square statistic of its distribution. This test can detect flaws in certain types of pseudo-random number generators.

[0076] The random number quality detection unit employs a real-time detection pipeline architecture. The output of the quantum random number generator is first stored in a high-speed buffer. A complete test is performed every 10,000 bits of data generated, with multiple tests conducted simultaneously to improve detection efficiency. The overall quality score is then calculated by combining the p-values ​​of all tests. When the p-value of any test falls below a preset threshold, the main quantum key generation module 100 immediately outputs a warning signal to the processor 300. The preset threshold is typically set to 0.01, ensuring security while avoiding false alarms caused by overly strict thresholds.

[0077] Example 6 Based on any one of the aforementioned embodiments one to five, the main quantum key generation module 100 further includes an entropy source monitoring unit for real-time monitoring of the physical parameters of the quantum random number generator. The photon count rate is one of the most important physical parameters of the quantum random number generator, directly affecting the generation rate and quality of random numbers. The entropy source monitoring unit evaluates the operating state of the quantum entropy source by counting the number of photons detected by the photodetector per unit time. Under normal operating conditions, the photon count rate should be stable near the design value, typically between 10⁶ and 10⁸ photons per second.

[0078] A low count rate may indicate decreased laser power, optical path misalignment, or reduced detector sensitivity; a high count rate may indicate external optical interference or detector saturation; an unstable count rate may indicate power instability, temperature fluctuations, or mechanical vibration. The entropy source monitoring unit records the baseline photon count rate when the device is first put into operation, and then sets a normal range of ±15%. As the device is used over time, the normal range is dynamically adjusted based on historical data to accommodate the normal aging process of the device.

[0079] Noise power spectral density analysis assesses the quality of random numbers by analyzing the frequency characteristics of quantum noise signals. True quantum noise should exhibit white noise characteristics at all frequencies, meaning its power spectral density remains flat across the entire frequency band. Measurement methods include performing a Fast Fourier Transform on the quantum noise signal, calculating the power spectral density at each frequency point, and analyzing the flatness of the power spectrum and the presence of anomalous peaks. Low-frequency enhancement may indicate the presence of 1 / f noise in the system, affecting randomness; specific frequency peaks may indicate power supply interference or electromagnetic interference; harmonic distortion may indicate distortion introduced by nonlinear devices.

[0080] Signal-to-noise ratio (SNR) is defined as the ratio of useful signal power to noise power. In a quantum random number generator, quantum noise is the useful signal, while circuit noise, thermal noise, etc., are interference noise. A high SNR indicates sufficient quantum signal strength and high-quality generated random numbers; a low SNR may indicate degraded quantum device performance or increased external interference; the trend of SNR changes can predict the remaining lifetime of the device. Preferably, the system sets different SNR thresholds according to different operating modes, requiring a higher SNR in high-security mode and appropriately reducing the SNR requirement in high-speed mode to increase the generation rate.

[0081] When physical parameters deviate from the preset normal range, the main quantum key generation module 100 outputs a warning signal to the processor 300. Upon receiving the warning signal, the processor 300 stops using the current random number generator to generate quantum keys, starts the backup random number generator, re-evaluates the security of the generated keys, and records the warning event in the security log.

[0082] Example 7 Based on any one of the aforementioned embodiments one to six, the quantum-safe USB flash drive also includes an environmental monitoring module for real-time monitoring of environmental parameters affecting the operation of the quantum random number generator. The environmental monitoring module incorporates multiple temperature sensors within the quantum-safe USB flash drive to monitor the operating temperature of the quantum device, the laser temperature, the temperature of critical locations on the circuit board, and the surface temperature of the outer casing, respectively.

[0083] Through long-term data collection and analysis, the system establishes a mathematical correlation model between temperature and random number quality. Typical correlations include: excessively high temperatures lead to decreased device performance and reduced random number quality; rapid temperature changes cause thermal stress in devices, affecting stability; different devices have different temperature sensitivities, requiring separate modeling. Based on temperature monitoring results, the system can adjust device operating power to reduce heat generation, activate built-in cooling fans, provide cooling suggestions to users, and automatically enter protection mode under extreme temperatures.

[0084] Regarding humidity monitoring, high humidity may cause circuit board corrosion and decreased insulation performance, while low humidity may cause electrostatic interference with precise quantum measurements. Humidity changes may also cause mechanical stress that affects the stability of the optical path. The system uses desiccant materials inside the device and employs a well-sealed casing design. When high humidity is detected, users are advised to use dehumidification equipment.

[0085] Electromagnetic field strength monitoring targets various electromagnetic interference sources, including wireless communication devices such as mobile phones and WiFi devices, high-frequency interference from power adapters and switching power supplies, nearby high-voltage electrical equipment such as motors and transformers, and household appliances such as microwave ovens and induction cookers. The environmental monitoring module employs broadband spectrum analysis technology to monitor the electromagnetic environment from a few kHz to a few GHz. Key frequency bands of focus include the 50 / 60Hz power frequency and its harmonics, mobile communication bands, WiFi bands, and industrial, scientific, and medical bands.

[0086] Vibration sources identified by mechanical vibration monitoring include the operational vibration of vehicles, structural vibration of buildings, mechanical vibration of equipment such as air conditioners and fans, and human-caused impacts or drops. Mechanical vibration can cause optical path deviation, affecting photon detection accuracy; strong vibrations can damage delicate optical components; and low-frequency vibrations can introduce low-frequency noise, affecting the quality of random numbers. The system installs vibration damping pads on key components, employs redundant optical path design to reduce vibration sensitivity, and suspends quantum key generation when strong vibration is detected.

[0087] The processor 300 obtains environmental assessment results based on a correlation model between environmental parameters and random number quality. The environmental monitoring module uses machine learning algorithms to establish a complex nonlinear correlation model between environmental parameters and random number quality. Specifically, this includes multiple linear regression to establish the linear relationship between various environmental parameters and quality indicators, a neural network model to handle the complex interactions of multiple environmental factors, time series analysis to consider the temporal correlation of environmental changes, and anomaly detection algorithms to identify abnormal environmental-quality patterns.

[0088] Based on the changing trends of current environmental parameters, the model can predict changes in random number quality over the next 30 minutes to 2 hours. The beneficial effects of this predictive capability include early detection of potential quality issues, optimization of device operating strategies, and reduction of service interruptions caused by environmental changes. When the environmental assessment indicates that the quantum-safe USB drive is in an unstable environment, the processor 300 controls the drive to output prompts to the user to switch to a different environment, such as "The current temperature is high; it is recommended to move it to a cool place," "Strong electromagnetic interference detected; it is recommended to keep it away from wireless devices," and "The ambient humidity is too high; it is recommended to use it in a dry environment."

[0089] Example 8 Based on any one of the aforementioned embodiments one through seven, the quantum-safe USB flash drive also includes a backup quantum key generation module. The backup quantum key generation module employs the same technical principles as the main module, but is physically independent, ensuring that both modules have the same performance indicators and output quality. The two modules are powered by independent power supplies and are isolated from each other to prevent the failure of one module from affecting the normal operation of the other. The beneficial effects of this dual-redundancy architecture include: even if the main module completely fails, the backup module can still ensure normal system operation; seamless switching to the backup module is possible when the main module encounters a problem; the backup module has the same performance indicators as the main module; and physical isolation between the two modules prevents fault propagation.

[0090] The backup quantum key generation module is in a hot standby state under normal circumstances. Its laser is maintained in a preheated state close to the threshold, and the signal processing circuit remains powered on but does not output data. When the processor 300 receives the warning signal output by the main quantum key generation module 100 as described in Embodiment 7, it instructs the backup quantum key generation module to generate random numbers. The switching trigger conditions include the failure of the main module's random number quality detection, the main module's physical parameters exceeding the normal range, environmental conditions causing the main module to malfunction, and hardware failure or communication interruption of the main module.

[0091] Optionally, the processor 300 employs a multi-factor decision-making algorithm to determine whether to switch to the backup module. The switching score equals the weight of quality anomalies multiplied by α, the weight of physical parameter anomalies multiplied by β, and the weight of environmental anomalies multiplied by γ. When the switching score exceeds a threshold, the backup module is activated. α, β, and γ are configurable weighting coefficients that can be adjusted according to the actual application scenario. The triggering conditions for the warning signal include not only real-time anomaly detection but also trend prediction based on historical data, ensuring that the system can initiate backup module preparation before a failure occurs.

[0092] In some implementations, the coordinated operation of the two modules during the firmware upgrade process is a core innovation of the system. When the processor 300 receives a firmware upgrade request signal for the main quantum key generation module, it first sends a start command to the backup quantum key generation module, activating its complete random number generation function. Upon receiving the command, the backup quantum key generation module immediately switches the laser from the preheating state to the normal operating state, starts the complete signal processing and post-processing algorithms, and begins to output high-quality random number sequences. Simultaneously, the processor sends a pause command to the main quantum key generation module, which, after ensuring that the current task is completed, gradually shuts down each functional module and adjusts the laser to a safe low-power state or shuts it off.

[0093] After waiting for the backup quantum key generation module to return a start confirmation signal and the main quantum key generation module to return a pause confirmation signal, the processor 300 begins upgrading the control firmware of the main quantum key generation module. For example, the upgrade process includes steps such as downloading and verifying the firmware file, securely erasing the old firmware, writing and installing the new firmware, integrity verification, and functional testing. Throughout the upgrade process, the backup quantum key generation module continues to operate, ensuring that the system's quantum random number generation service is uninterrupted. After the upgrade operation is completed, the processor 300 first verifies that the new firmware of the main quantum key generation module is working correctly, then sends a pause command to the backup quantum key generation module to restore it to a hot backup state, and sends a start command to the main quantum key generation module to restore its normal operation.

[0094] The switchover process management includes pre-activating the backup quantum key generation module for warm-up when potential problems are detected, ensuring the continuity of key generation services during the switchover process, synchronizing the operating status and configuration parameters of the primary quantum key generation module to the backup module, and immediately performing quality testing and verification on the backup quantum key generation module after the switchover is completed. The status synchronization process ensures that the backup quantum key generation module can seamlessly take over the work of the primary quantum key generation module, including transmitting key information such as current operating parameters, calibration data, and quality thresholds to the backup quantum key generation module before the switchover.

[0095] In one optional implementation, the system also supports a dual-module load balancing mode. The two modules work in turn, automatically switching after a certain period. This balances the lifespan of the two modules, continuously verifies the availability of the backup module, and improves the overall random number generation rate. Preferably, under high load conditions, the two modules can work simultaneously, each generating an independent random number sequence. These sequences are then combined using XOR operations or other cryptographic methods to further improve the quality and generation rate of the random numbers. When both modules work simultaneously, the system implements an intelligent task allocation algorithm to evenly distribute random number generation requests between the two modules, avoiding overload on any single module.

[0096] Furthermore, the quantum-safe USB flash drive system possesses automatic fault diagnosis capabilities, capable of identifying the specific type and location of faults. Device aging is identified through long-term performance monitoring, environmental impacts through environmental parameter correlation analysis, hardware faults through built-in self-test programs, and software issues through error logs and status checks. The diagnostic system employs machine learning algorithms to analyze historical fault patterns, establishing a fault feature database to improve the accuracy and timeliness of fault identification. When the system detects an abnormal pattern, it automatically performs in-depth diagnosis to determine the root cause of the fault and provide corresponding solutions.

[0097] This application embodiment also supports remote maintenance functionality. Authorized technicians can remotely view device status and diagnostic information, remotely adjust device parameters and configurations, remotely trigger self-test and calibration programs, and remotely update firmware and algorithms. The remote maintenance process employs end-to-end quantum-secure encryption to ensure the security of maintenance communications. Remote operation permissions utilize multi-factor authentication, including digital certificate verification, biometric recognition, and dynamic password verification, to prevent unauthorized access.

[0098] Based on long-term monitoring data, the system can predict the remaining lifespan of components and schedule maintenance in advance. This includes component performance trend analysis, failure probability prediction models, calculation of optimal maintenance time points, and spare parts demand forecasting. The prediction model uses big data analytics, combining multi-dimensional information such as the equipment's operating environment, workload, and historical performance to establish an accurate lifespan prediction algorithm. The system can also automatically adjust its operating mode based on the prediction results, reducing workload and extending equipment lifespan as components approach the end of their lifespan. The beneficial effects of this predictive maintenance method are a significant reduction in the incidence of unexpected failures and improved overall system availability and reliability.

[0099] The dual quantum key generation module system also implements intelligent lifetime management. The system periodically rotates the roles of the primary and backup modules to ensure a relatively balanced usage time for both modules, avoiding premature failure caused by overuse of a single module. The rotation cycle can be dynamically adjusted according to actual usage, shortening it under high load and extending it under light load. This intelligent rotation mechanism significantly extends the overall lifespan of the equipment, improving the system's economy and sustainability.

[0100] Example 9 Building upon the aforementioned embodiments, this embodiment implements a complete data camouflage storage process. This process transforms sensitive data in the secure storage area into camouflaged data distributed across ordinary storage areas. For example, a user needs to camouflage a 2048-byte spreadsheet file containing financial information, including the company's quarterly financial statements and sensitive financial data. The system first reads the complete content of this file from the secure storage area, while simultaneously recording the file's metadata information, including filename, creation time, modification time, and file type. This information is essential for subsequent complete recovery.

[0101] After data acquisition, the processor sends a noise generation request to the quantum random number generator based on the file's 2048-byte length, requesting the generation of a noise sequence of 16384 random bits. Upon receiving the request, the quantum random number generator begins continuously acquiring quantum shot noise signals. The raw noise signal is extracted using a high-quality post-processing algorithm to ensure that each bit of the output has near-perfect randomness. During the generation process, the system continuously monitors the noise quality, performing multiple quality checks on the output sequence, including frequency testing, autocorrelation testing, and entropy testing. Only noise sequences that pass all tests are used for subsequent spoofing processing.

[0102] After obtaining a high-quality quantum noise sequence, the system performs a core mixing operation, XORing the original financial data with the noise sequence. Taking the first 8 bytes of the file as an example, the original data is 0x50 0x4B 0x03 0x04 0x140x00 0x00 0x00, and the corresponding noise bytes are 0xA7 0x2F 0x85 0xC9 0x6B 0x3E 0x91 0x5D. The XOR result is 0xF7 0x64 0x86 0xCD 0x7F 0x3E 0x91 0x5D. This mixing result is statistically identical to purely random data. Even if an attacker obtains the mixed data, they cannot obtain any information about the original financial data without knowing the corresponding noise sequence. The entire 2048-byte file, after XOR mixing, forms a disguised data of the same size.

[0103] After the masquerading data is generated, the system divides it into multiple data blocks for distributed storage according to a preset block size. Assuming the block size is set to 64 bytes, the 2048 bytes of masquerading data are divided into 32 data blocks, each requiring an independent storage location. The system sends a location calculation seed generation request to the quantum random number generator, obtaining a high-quality 256-bit random seed. This seed serves as the input parameter for the location calculation algorithm, ensuring the randomness and unpredictability of location allocation.

[0104] For example, the location calculation process uses cryptographically secure methods to ensure the randomness of the location sequence. For example, the system uses a obtained 256-bit seed as the key for the AES-256 algorithm, generating a storage location for each data block using a counter pattern. The location of the first data block is calculated using the AES encrypted input 0x00000001, and the modulo operation of the encryption result maps to the available address range of the ordinary storage area. Assuming the ordinary storage area contains 1,000,000 available 64-byte storage blocks, the first data block is assigned to location 234567. The second data block is calculated using the AES encrypted input 0x00000002, and is assumed to be assigned to location 789123. Storage locations are calculated for all 32 data blocks in this manner.

[0105] Of course, those skilled in the art can also calculate the storage location of the data block based on the location seed using other algorithms, and this application does not limit this.

[0106] During the location calculation process, the system checks for duplicate address conflicts. Assuming the calculated location 234567 for the 10th data block is the same as the location of the 1st data block, the system detects this conflict and initiates an alternative address allocation process. Starting from the conflicting location 234567, the system searches forward, checking if location 234568 is available. If it's already occupied, it continues checking 234569, until a free location is found. Assume that the 10th data block is ultimately allocated to location 234571. This process ensures that each data block has a unique storage location, avoiding data overwriting issues.

[0107] After location allocation, the system performs a distributed storage operation to write 32 masquerading data blocks to their corresponding storage locations. The system creates multiple parallel write threads to improve storage efficiency, with each thread responsible for writing a portion of the data blocks. During the write process, the system rigorously monitors the execution status of each operation to ensure that all data blocks are correctly written to their designated locations. Immediately after each data block is written, a verification operation is performed, reading the data back from the storage location and comparing it with the original masquerading data to confirm the data's integrity and correctness.

[0108] After all the disguised data blocks are successfully stored and verified, the system executes the final critical step: securely deleting the original financial data from the secure storage area. Furthermore, the deletion process is not a simple file deletion operation; instead, it uses military-grade security deletion standards to randomly overwrite the storage space occupied by the original data multiple times. First, the original data area is completely overwritten using quantum random numbers. Then, multiple rounds of overwriting are performed using a fixed pattern (0x00, 0xFF, 0xAA, 0x55). Finally, a new set of quantum random numbers is used for the final overwrite. This process ensures that the original data cannot be recovered by any technical means, completing the complete disguise of the data.

[0109] After the entire data camouflage and storage process is completed, the original financial statement files have completely disappeared, replaced by camouflaged data blocks scattered across 32 random locations in the ordinary storage area. These data blocks are indistinguishable from random noise and cannot be identified as meaningful information. Only authorized users with the corresponding quantum keys and index information can reassemble these data blocks and use the corresponding quantum noise sequence to recover the original financial data. The system encrypts and stores the key information required for recovery (including quantum seeds, location mapping tables, file metadata, etc.) in a dedicated area of ​​the secure storage area, providing reliable technical support for subsequent data recovery.

[0110] It should be noted that Embodiments 2 through 9 are all further implementations based on Embodiment 1, and any at least two embodiments from Embodiments 2 to 9 can be combined to form new embodiments. Through the detailed description of the above embodiments, the quantum-safe USB flash drive provided by the present invention forms a complete security system, from quantum key generation, intelligent file classification, multi-factor authentication to environmental adaptive control, ensuring reliable data security protection in various usage scenarios.

[0111] The above description is merely a preferred embodiment of this application and is not intended to limit the invention. Various modifications and variations can be made to this invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A quantum-safe USB flash drive, characterized in that, include: The master quantum key generation module is used to generate quantum keys; The key area is used to store the quantum keys generated by the main quantum key generation module. The processor is used to determine whether the security level of the file to be stored is level one or level two based on the feature information of the file to be stored, and to encrypt the file to be stored with a security level of level two using a first encryption algorithm based on the quantum key generated by the master quantum key generation module, so as to obtain a quantum-safe file. A secure storage area is used to store the quantum-safe files; The general storage area is used to directly store files with a security level of Level 1.

2. The quantum-safe USB flash drive according to claim 1, characterized in that, The processor is further configured to determine whether the computer is a trusted computer when the quantum-safe USB flash drive is in a communicative connection with the computer. When the computer is a trusted computer, the quantum-safe file stored in the secure storage area is decrypted before the user operates on the quantum-safe file; When the computer is untrusted, a locking operation is performed when the quantum-safe USB flash drive is connected to the computer. The operation also detects whether the untrusted computer connected to the quantum-safe USB flash drive is connected to the internet. The locking operation prohibits copying or cutting quantum-safe files stored in the secure storage area, and also prohibits decryption of quantum-safe files. If the untrusted computer connected to the quantum-safe USB flash drive is detected to be connected to the internet, a security request is sent to a designated network address. If no security indication is received from the designated network address within a preset time period after sending the security request, the quantum-safe files stored in the secure storage area are encrypted again using a second encryption algorithm. If a security indication is received from the designated network address within a preset time period after sending the key request, the locking operation is released.

3. The quantum-safe USB flash drive according to claim 1, characterized in that, The quantum-safe USB flash drive also includes: a positioning module, used to locate the geographical location of the quantum-safe USB flash drive and obtain positioning information; The processor is also configured to acquire the location information, and when the location information indicates that the quantum-safe USB flash drive is in a secure area, and the quantum-safe USB flash drive is connected to a computer, decrypt the quantum-safe files stored in the secure storage area before the user operates on the quantum-safe files.

4. The quantum-safe USB flash drive according to claim 1, characterized in that, The quantum-safe USB flash drive also includes: a positioning module, used to locate the geographical location of the quantum-safe USB flash drive and obtain positioning information; The processor is further configured to, when the positioning information indicates that the quantum-safe USB drive is in an insecure area and the quantum-safe USB drive is connected to a computer, perform a locking operation. The locking operation prohibits copying or cutting quantum-safe files and also prohibits decryption of quantum-safe files. Then, it determines whether the computer is a trusted computer. If the computer is an untrusted computer, it is checked whether the untrusted computer is connected to the network. If it is not connected to the network, the quantum-safe file is deleted directly. If it is connected to the network, the quantum-safe file is sent to the designated network address, and the quantum-safe file stored in the secure storage area is deleted. If a security instruction including the quantum-safe file is received from the designated network address within a preset time period after sending the quantum-safe file to the designated network address, the quantum-safe file is re-stored in the secure storage area.

5. The quantum-safe USB flash drive according to claim 1, characterized in that, The characteristic information of the file to be stored includes at least one of the following: file name information, text information, image information, author information, and security level identification information.

6. The quantum-safe USB flash drive according to claim 1, characterized in that, The main quantum key generation module includes: a quantum random number generator, used to generate quantum random numbers for generating quantum keys; The random number quality detection unit is used to perform real-time quality detection on the random numbers generated by the quantum random number generator. The quality detection includes at least one of frequency testing, intra-block frequency testing, run testing, and longest run testing. When the p-value of the detection result is lower than a preset threshold, the main quantum key generation module outputs a warning signal to the processor.

7. The quantum-safe USB flash drive according to claim 1, characterized in that, The master quantum key generation module also includes: An entropy source monitoring unit is used to monitor the physical parameters of the quantum random number generator in real time, the physical parameters including at least one of photon count rate, noise power spectral density and signal-to-noise ratio; When the physical parameters deviate from the preset normal range, the master quantum key generation module outputs a warning signal to the processor.

8. The quantum-safe USB flash drive according to claim 1, characterized in that, The quantum-safe USB flash drive also includes: An environmental monitoring module is used to monitor environmental parameters that affect the operation of the quantum random number generator in real time. The environmental parameters include at least one of temperature, humidity, electromagnetic field strength, and mechanical vibration. The processor is also used to obtain an environment determination result based on the correlation model between the environmental parameters and the quality of random numbers. When the environment determination result indicates that the quantum-safe USB flash drive is in an unstable environment, the processor controls the quantum-safe USB flash drive to output a prompt message to the user to switch the usage environment.

9. The quantum-safe USB flash drive according to any one of claims 6-7, characterized in that, The quantum-safe USB flash drive also includes a backup quantum key generation module; The processor is further configured to instruct the backup quantum key generation module to generate random numbers when it receives an early warning signal output by the main quantum key generation module; The processor is further configured to, upon receiving a firmware upgrade request signal, send a start command to the backup quantum key generation module to enable the backup quantum key generation module to start the quantum key generation function, and send a pause command to the main quantum key generation module to enable the main quantum key generation module to pause the quantum key generation function; Based on the start confirmation signal returned by the backup quantum key generation module and the pause confirmation signal returned by the main quantum key generation module, an upgrade operation is performed on the control firmware corresponding to the main quantum key generation module. When the upgrade operation is completed, a pause command is sent to the backup quantum key generation module to make the backup quantum key generation module pause the quantum key generation function, and a start command is sent to the main quantum key generation module to make the main quantum key generation module start the quantum key generation function.

10. The quantum-safe USB flash drive according to claim 1, characterized in that, The master quantum key generation module includes a quantum random number generator, and the processor is further configured to: execute the data spoofing and storage process of the quantum-secure file; The data masquerading and storage process includes: Retrieve the data stored in the secure storage area; Based on the length of the data, a noise generation request is sent to the quantum random number generator to obtain a quantum noise sequence of the corresponding length; Based on the quantum noise sequence, a mixing operation is performed on the data to obtain disguised data; The spoofed data is divided into multiple data blocks according to a preset block size; Send a position calculation seed generation request to the quantum random number generator to obtain the position calculation seed; Based on the location, a seed is calculated to generate a candidate location sequence, wherein the candidate location sequence is mapped to the available storage addresses in the ordinary storage area; Detect whether there are duplicate addresses in the candidate location sequence. If a duplicate address is detected, replace the duplicate address with another available storage address until there are no duplicate addresses in the candidate location sequence. Based on the location candidate sequence, the spoofed data is distributed and stored in the ordinary storage area, and the data in the secure storage area is deleted.

Images