Communication method and related device, storage medium and computer program product

Abstract

The invention discloses a communication method, a related device, a storage medium and a computer program product. The communication method applied to first equipment comprises the following steps: determining one or more first keys in a key pool; sending the first message to the first entity; wherein the first message is used for requesting to charge a key, and the first message carries an identifier of one or more first keys; receiving a second message sent by the first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and in particular to a communication method and related devices, storage media, and computer program products. Background Technology

[0002] In quantum secure communication systems, the quantum key management platform (also known as a quantum cryptography service platform, quantum communication service platform, etc.) typically pre-configures a certain number of quantum keys (e.g., thousands or tens of thousands) in the secure medium / secure storage space of the terminal through offline loading. This quantum key is a pre-shared symmetric key between the quantum key management platform and the secure terminal, and can be used for operations such as authentication, encryption, integrity protection, and message source authentication. The terminal can securely access the quantum key management platform using the pre-loaded quantum key to complete relevant business processing. To ensure the security of the quantum secure communication system, the pre-loaded quantum key is disposable and destroyed after use.

[0003] In terminal devices, secure media are used to store pre-charged quantum keys. Hardware-based secure media include Subscriber Identity Module (SIM) cards, USB keys, TransFlash cards, chip cards, and security chips. Software-based secure media include software cryptographic modules. Both provide a certain amount of secure storage space for storing quantum keys.

[0004] In a quantum secure communication system, the terminal securely communicates with the quantum key management platform using a quantum key configured offline to complete business operations. To enhance system security, the terminal selects and uses a new quantum key for each communication, which places high demands on the number of quantum keys pre-loaded into the security medium. If the number of quantum keys stored in the security medium is insufficient, the user will be unable to continue using the quantum secure communication service due to the depletion of quantum keys. In this case, the user would need to frequently visit a quantum key service station to offline recharge quantum keys, which is extremely inconvenient.

[0005] Currently, to meet the security requirements of one-time use of quantum keys and the business needs of long-term availability for secure communication applications, one solution is to use high-capacity security media to store a sufficient number of quantum keys offline through pre-filling. For example, a customized high-capacity security media can store hundreds of thousands of quantum keys. However, high-capacity security media greatly increases the implementation cost of terminals and is not conducive to widespread deployment. Another solution is to use the traditional online key update method to update quantum keys. Specifically, the quantum key management platform and the security media obtain the key protection key for key updates through pre-configuration or negotiation based on digital certificates. When it is necessary to update the quantum keys in the security media, the quantum key management platform uses this key protection to issue new quantum keys. Since the pre-configured key protection key or the digital certificate used to negotiate the key protection key remains unchanged for a long time and is repeatedly used, the security of the cryptographic "root" is weak. Once the repeatedly used key protection key or digital certificate is leaked, all quantum keys updated in this way will be cracked, resulting in low security for quantum key updates / supplementation. Summary of the Invention

[0006] This application provides a communication method and related devices, storage media, and computer program products.

[0007] The technical solution of this application is implemented as follows: This application provides a communication method applied to a first device, the method comprising: Determine one or more first keys in the key pool; Send a first message to a first entity; wherein the first message is used to request a key to be charged, and the first message carries an identifier of one or more of the first keys; Receive a second message sent by a first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0008] In the above method, the first entity obtains one or more first keys based on the identifier of one or more first keys, and the one or more first keys are used to generate one or more second keys, thereby generating one or more first protection keys and / or second protection keys, or used to generate one or more first protection keys and / or second protection keys. One or more of the third keys are used for encryption and / or integrity protection based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

[0009] The above method also includes: One or more second keys are generated based on one or more of the first keys, and then one or more first protection keys and / or second protection keys are generated; or one or more first protection keys and / or second protection keys are generated based on one or more of the first keys. Based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys, decrypt and / or verify the integrity of one or more of the third keys after encryption and / or integrity protection to obtain one or more of the third keys.

[0010] In the above method, determining one or more first keys in the key pool includes: One or more of the first keys are determined from all or part of the keys in the key pool.

[0011] In the above method, determining one or more first keys in the key pool includes: In the key pool, identify one or more of the first keys whose algebra is less than or equal to the first threshold.

[0012] In the above method, the first message also carries the algebra of the first key; and / or, the second message also carries the algebra of the third key updated by the first entity.

[0013] The above method also includes: Store the third key and / or update the algebra of the third key.

[0014] In the above method, the first message also carries the amount of the third key being filled; and / or, the amount of the third key carried in the second message is related to the amount of the third key being filled.

[0015] In the above method, the first message also carries the type of the third key; and / or, the third key carried in the second message is generated by the first entity based on the type of the third key.

[0016] In the above method, the first message also carries the location of the third key, and the method further includes: The third key is stored according to its location.

[0017] In the above method, the first message also carries a cryptographic module identifier, so that the first entity generates one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

[0018] In the above method, for each first key, or each second key, or each first protection key and / or each second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to a second threshold.

[0019] In the above method, the second message also carries first information for encryption and / or integrity protection; The first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

[0020] In the above method, when the first condition is met, the first key is determined and / or the first message is sent; The first condition includes: The number of keys used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

[0021] In the above method, the third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

[0022] In the above method, the key type is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

[0023] The above method also includes: While processing the first business transaction, determine whether the first condition is met.

[0024] The above method also includes: Store the algebra of the keys in the key pool.

[0025] In the above method, the key configured offline in the key pool is the first-generation key.

[0026] In the above method, the next-generation key is encrypted and / or protected for integrity using the previous-generation key.

[0027] In the above method, the first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

[0028] The above method also includes: If the first key is not determined from the key pool, a prompt message is output; The prompt message is used to suggest configuring the key offline.

[0029] This application provides a communication method applied to a first entity, the method comprising: Receive a first message sent by a first device; wherein the first message is used to request a key to be charged, and the first message carries an identifier of one or more first keys; Send a second message to the first device; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0030] The above method also includes: One or more of the first keys are obtained from the key pool based on the identifier of one or more of the first keys.

[0031] The above method also includes: Check whether the algebra of the first key is less than or equal to the first threshold.

[0032] The above method also includes: If the algebra of the first key is less than or equal to the first threshold, generate one or more of the third keys and send a second message to the first device; If the algebra of the first key is greater than the first threshold, a third message is sent to the first device; wherein the third message is used to indicate that key filling has failed.

[0033] In the above method, the first message also carries the charge quantity of the third key and / or the type of the third key, and the method further includes: One or more third keys are generated based on the amount of the third key filled and / or the type of the third key.

[0034] The above method also includes: One or more second keys are generated based on one or more of the first keys, and then one or more first protection keys and / or second protection keys are generated; or one or more first protection keys and / or second protection keys are generated based on one or more of the first keys. Encryption and / or integrity protection of one or more of the third keys based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

[0035] In the above method, the first device generates one or more second keys based on one or more first keys, and then generates one or more first protection keys and / or second protection keys, or generates one or more first protection keys and / or second protection keys based on one or more first keys; One or more of the third keys are used for decryption and / or integrity verification based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

[0036] In the above method, the first message also carries the algebra of the first key; and / or, the second message also carries the algebra of the third key updated by the first entity.

[0037] The above method also includes: Store the third key and / or update the algebra of the third key.

[0038] In the above method, the first message also carries the location of the third key, and the method further includes: The third key is stored according to its location.

[0039] In the above method, the first message also carries a cryptographic module identifier, and the method further includes: Generate one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

[0040] In the above method, for each first key, or each second key, or each first protection key and / or each second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to a second threshold.

[0041] In the above method, the second message also carries first information for encryption and / or integrity protection; The first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

[0042] In the above method, the first key is determined by the first device when the first condition is met, and / or the first message is sent by the first device when the first condition is met; The first condition includes: The number of keys already used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

[0043] In the above method, the third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

[0044] In the above method, the key type is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

[0045] In the above method, the first condition is determined while the first device is processing the first service.

[0046] The above method also includes: Store the algebra of the keys in the key pool.

[0047] In the above method, the key configured offline in the key pool is the first-generation key.

[0048] In the above method, the next-generation key is encrypted and / or protected for integrity using the previous-generation key.

[0049] In the above method, the first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

[0050] This application provides a first device, including a first processor, a first memory, and a first communication bus; The first communication bus is used to establish a communication connection between the first processor and the first memory; The first processor is configured to execute one or more computer programs stored in the first memory to implement a communication method applied to the first device.

[0051] This application provides a first entity, including: a second processor, a second memory, and a second communication bus; The second communication bus is used to establish a communication connection between the second processor and the second memory; The second processor is configured to execute one or more computer programs stored in the second memory to implement a communication method applied to the first entity.

[0052] This application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a communication method applied to a first device, or a communication method applied to a first entity.

[0053] This application provides a computer program product, including a computer program that, when executed by a processor, implements a communication method applied to a first device, or a communication method applied to a first entity.

[0054] This application provides a communication method and related apparatus, storage medium, and computer program product. The communication method applied to a first device includes: determining one or more first keys in a key pool; sending a first message to a first entity; wherein the first message is used to request key replenishment and carries identifiers of one or more first keys; receiving a second message sent by the first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection. The technical solution provided by this application can replenish keys for the first device online without increasing the storage space of the security medium, effectively reducing the implementation cost of the device. The first entity uses the first keys determined in the key pool to derive keys to protect the keys replenished for the first device, and destroys them immediately after use. This solves the problem of pre-configured key protection keys or digital certificates used for negotiating key protection keys remaining unchanged for a long time in traditional methods, thus improving system security. Attached Figure Description

[0055] Figure 1 A schematic diagram of a quantum secure communication system architecture provided in this application embodiment. Figure 1 ; Figure 2 A schematic diagram of a quantum secure communication system architecture provided in this application embodiment. Figure 2 ; Figure 3 A schematic diagram of a key system for a quantum secure communication system provided in this application embodiment; Figure 4 A flowchart illustrating a communication method provided in an embodiment of this application. Figure 1 ; Figure 5 A schematic diagram of key management based on key algebra provided for embodiments of this application; Figure 6 A flowchart illustrating a communication method provided in an embodiment of this application. Figure 2 ; Figure 7 A business processing flow diagram provided for an embodiment of this application Figure 1 ; Figure 8 A business processing flow diagram provided for an embodiment of this application Figure 2 ; Figure 9 A schematic diagram of the structure of a first device provided in an embodiment of this application. Figure 1 ; Figure 10 A schematic diagram of the structure of a first device provided in an embodiment of this application. Figure 2 ; Figure 11 A schematic diagram of the structure of a first entity provided in an embodiment of this application. Figure 1; Figure 12 A schematic diagram of the structure of a first entity provided in an embodiment of this application. Figure 2 . Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] The technical solutions of this application and how they solve the aforementioned technical problems will be described in detail below through embodiments and in conjunction with the accompanying drawings. The embodiments below can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0058] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0059] In the embodiments of this application, the quantum cryptography service center is modularly designed, resulting in a system architecture as follows: Figure 1 As shown. See also Figure 1 Unlike existing technologies, the core network element quantum cryptography service platform in the quantum cryptography service center of this application is divided into level one and level two, which can realize "separation of management and service", solve the problems of flexibility, scalability and security of existing solutions, and improve the business service capabilities of the quantum cryptography service center.

[0060] The following is an explanation of the Quantum Cryptography Service Center.

[0061] In the embodiments of this application, the quantum cryptography service primary platform can also be called a key management platform, cryptography service platform, etc. It focuses on key management and cryptography services, is responsible for general key management, cryptographic business processing, and provides cryptographic security services. At the same time, it fills and manages cryptographic modules, supports docking with multiple quantum cryptography service secondary platforms, and provides unified basic key management and cryptographic security services for different quantum cryptography service secondary platforms.

[0062] In the embodiments of this application, the quantum cryptography service secondary platform can also be referred to as a business service platform, application service platform, etc. It focuses on business services, is responsible for interfacing with quantum secure communication business applications, and provides cryptographic security services for different types of business applications or those operated by different entities, thereby supporting flexible adaptation of quantum, cryptography, and communication services. Simultaneously, the quantum cryptography service secondary platform can also have certain session key management capabilities. In practical applications, the system can deploy dedicated quantum cryptography service secondary platforms for different quantum secure communication applications, interfacing and adapting with the applications to achieve plug-and-play functionality and rapid deployment. Alternatively, the system can combine the functions of the quantum cryptography service primary platform and the quantum cryptography service secondary platform as needed, reducing the hardware resource requirements for platform deployment. The combined platform can be referred to as a quantum cryptography service platform, quantum key management platform, quantum communication service platform, quantum business service platform, etc. The combined system architecture is as follows: Figure 2 As shown.

[0063] In the embodiments of this application, the quantum key offline injection platform pre-injects a certain number of quantum entropy source keys into the cryptographic module of the quantum secure communication application device offline in a physically secure environment. When injecting quantum random number keys, the quantum random number keys are provided by the quantum cryptography service primary platform through the Af interface. When injecting quantum keys, both the quantum cryptography service primary platform and the quantum key offline injection platform obtain quantum keys from the quantum key distribution (QKD) node through the Ak interface. The obtained quantum keys are symmetric keys distributed by the two nodes through the QKD network. By configuring keys offline, the quantum cryptography service primary platform and the cryptographic module pre-configure several symmetric keys, and each establishes a shared symmetric key resource pool, i.e., a key pool, locally.

[0064] It should be noted that in the embodiments of this application, the platform may also be referred to as an entity, device, function, unit, component, module, network element, etc., and the embodiments of this application do not limit it.

[0065] The following is an explanation of quantum secure communication application equipment.

[0066] In the embodiments of this application, the quantum secure communication application device is a network device, terminal device, platform device, etc., which includes cryptographic applications, cryptographic middleware, cryptographic modules, etc., to realize quantum secure communication applications.

[0067] In the embodiments of this application, the cryptographic application is a software and hardware module on the device that implements secure communication functions, and calls cryptographic services based on quantum entropy source keys through cryptographic middleware.

[0068] In the embodiments of this application, the cryptographic middleware is software located between the cryptographic application and the cryptographic module that implements cryptographic service functions. It is compatible with various types of cryptographic modules and provides a unified cryptographic service interface for the application. Cryptographic services include, but are not limited to, encryption, decryption, security authentication, and key management.

[0069] In the embodiments of this application, the cryptographic module is a secure medium with cryptographic computation capabilities that stores a pre-charged quantum entropy source key. It can take various forms, including hardware (such as a USB key, cryptographic card, SIM card, security chip, etc.) and software. The quantum cryptography service platform manages the cryptographic module online through cryptographic middleware, including on-demand updates and supplements.

[0070] It should be noted that the technical solution provided in this application is applicable to various forms of cryptographic modules (i.e., secure media), including hardware, software, high-capacity, low-capacity, and so on. Furthermore, the cryptographic middleware can be a standalone software module or a software module integrated with a cryptographic module or quantum secure communication application. The implementation method within the application device does not affect the implementation of the technical solution provided in this application.

[0071] The following explains other relevant information.

[0072] In the embodiments of this application, the quantum entropy source key is a key obtained based on the principles of quantum mechanics, including quantum keys, quantum random number keys, etc., which theoretically possess true randomness and are used for encryption protection and security authentication of classical information. The quantum cryptography service primary platform interfaces with the QKD network through the Ak interface to obtain and manage the quantum keys generated by the QKD network, and interfaces with the quantum random number generator (QRNG) device through the Ar interface to obtain and manage keys generated based on quantum random numbers.

[0073] In the embodiments of this application, different types of business applications are included, such as encrypted audio or video calls, encrypted conferences, encrypted SMS or instant messaging, encrypted walkie-talkies, encrypted emails, encrypted cloud storage, and encrypted leased lines. Different categories of business applications are also included, such as real-time secure communication applications and non-real-time secure communication applications. Furthermore, business applications operated by different entities are also included, for example, the same secure communication application provided by different operators.

[0074] In the embodiments of this application, the QRNG is a device for generating random numbers based on the principles of quantum mechanics, which can provide quantum random numbers to a quantum cryptography service primary platform via an Ar interface. The quantum cryptography service primary platform can generate quantum random number keys based on quantum random numbers.

[0075] Corresponding to quantum secure communication systems, Figure 3A schematic diagram of a key system for a quantum secure communication system provided in this application embodiment. See also... Figure 3 In this system, there can be many quantum entropy source keys (e.g., tens of thousands or hundreds of thousands), which are shared by the cryptographic modules in the quantum cryptography service primary platform and the quantum secure communication application equipment, forming a quantum service base key (QSBK) resource pool.

[0076] In the embodiments of this application, the QSBK in the QSBK resource pool and the Quantum Refilling as Used Protection Key (QRUPK) derived from it are all single-use and destroyed after use. This ensures that the keys in the system are frequently changed, increasing the difficulty of the system being cracked and improving the overall security of the system.

[0077] QSBK: A pool of quantum entropy source keys shared between the primary quantum cryptography service platform and the cryptographic modules of quantum secure communication application equipment. These keys are pre-configured and securely stored within the cryptographic modules through offline, online, or other injection methods, forming a QSBK resource pool. This pool can be used to derive various other keys, such as quantum on-demand supplementary protection keys, security authentication keys, secure channel protection keys, and session key protection keys. QSBKs are for one-time use and are destroyed after use. The term "derive" can be used to describe the process of derivation, generation, or creation.

[0078] QRUPK: A key shared between the primary quantum cryptography service platform and the cryptographic modules of quantum secure communication application devices, including the encryption protection key QRUPK. enc and integrity protection key QRUPK int QRUPK enc and QRUPK int It can be directly derived from QSBK (see...) Figure 3 In addition, an intermediate key QRUPK can be derived from QSBK, and further derived from QRUPK. This QRUPK is then used during updates / supplements to encrypt and protect the integrity of sensitive information such as the online-injected quantum random number key (i.e., the supplementary quantum service base key QSBK). QRUPK enc and QRUPK int It is for single use only and should be destroyed after the filling process is completed.

[0079] Based on the above, the technical solutions of this application are described in detail from the perspectives of the first device and the first entity. The first device can be a quantum secure communication application device in the aforementioned quantum secure communication system, that is, it can be a network device, terminal device, platform device, or other device that needs to perform secure communication, including cryptographic applications, cryptographic middleware, and cryptographic modules. The first device can also be the cryptographic middleware of the quantum secure communication application device. The first entity can be a quantum cryptographic service primary platform or a quantum cryptographic service platform in the aforementioned quantum secure communication system, and can also be referred to as a device, function, unit, component, module, network element, etc.

[0080] Figure 4 A flowchart illustrating a communication method provided in an embodiment of this application. Figure 1 .like Figure 4 As shown, the communication method applied to the first device mainly includes the following steps: S101. Determine one or more first keys in the key pool.

[0081] S102. Send a first message to the first entity; wherein the first message is used to request key charging, and the first message carries the identifier of one or more first keys.

[0082] S103, Receive a second message sent by the first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0083] In the embodiments of this application, the key pool is a QSBK resource pool, and the first key is a QSBK key already stored in the QSBK resource pool. As services occur, the keys in the QSBK resource pool are continuously consumed. When the consumption (used amount) and / or remaining amount (unused amount) of QSBK keys reach the corresponding threshold, the first device can determine one or more first keys (QSBK) in the key pool (QSBK resource pool), and then derive one or more second keys (QRUPK) to protect a new batch of third keys (QSBK*) issued by the first entity. Essentially, both the first key and the third key can be QSBK keys stored in the QSBK resource pool. The difference is that the first key (QSBK) is an existing, older key in the pool, while the third key (QSBK*) is newly generated and issued by the first entity, which can replenish the keys in the pool. To distinguish between the two, the first key is represented by QSBK, and the third key is represented by QSBK*.

[0084] In embodiments of this application, during the key update / supplementation process, the first device and the first entity may negotiate and determine one or more available first keys (QSBK) to generate a second key (QRUPK) or a first protection key (QRUPK) required for the update / supplementation process. enc) or second protection key (QRUPK) int This process encrypts and / or protects the integrity of the new third key (QSBK*) to be issued, ensuring the security of the third key (QSBK*) during online transmission. Once the accompanying key update / supplementation process is complete, the negotiated first key (QSBK) and the derived second key (QRUPK) are destroyed.

[0085] In embodiments of this application, the first entity obtains one or more first keys (QSBK) based on the identifiers of one or more first keys. These one or more first keys are used to generate one or more second keys (QRUPK), which in turn generate one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int ), or used to generate one or more first protection keys (QRUPK) enc ) and / or a second protection key (QRUPK) int One or more third keys (QSBK*) are based on one or more first keys (QSBK), or on one or more second keys (QRUPK), or on one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int Encryption and / or integrity protection are performed. Correspondingly, the first device can perform the following steps: generate one or more second keys (QRUPK) based on one or more first keys (QSBK), and then generate one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int ), or generate one or more first protection keys (QRUPK) based on one or more first keys (QSBK). enc ) and / or a second protection key (QRUPK) int Based on one or more first keys (QSBK), or based on one or more second keys (QRUPK), or based on one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int Decrypt and / or verify the integrity of one or more third keys (QSBK*) after encryption and / or integrity protection to obtain one or more third keys (QSBK*).

[0086] It should be noted that, in the embodiments of this application, as described above, the method by which the first device decrypts and / or verifies the integrity of the third key (QSBK*) corresponds to the method by which the first entity encrypts and / or protects the integrity of the third key (QSBK*). The first protection key (QRUPK)enc ) and / or a second protection key (QRUPK) int The key can be generated directly based on the first key (QSBK), or it can be generated based on the first key (QSBK already in the pool) to generate the second key (QRUPK) and then further generated. The specific generation method is not limited in the embodiments of this application.

[0087] It should be noted that, in the embodiments of this application, as described above, the encryption and / or integrity protection third key (QSBK*) and the decryption and / or integrity verification third key (QSBK*) can both be based on the first key (QSBK), the second key (QRUPK), and the first protection key (QRUPK). enc Second protection key (QRUPK) int The implementation of the key in the application is not limited to the specific key used in this embodiment.

[0088] It should be noted that, in the embodiments of this application, a second threshold KP can also be set to further improve the security of the system. max The maximum number of keys that a key can protect is limited. Specifically, this applies to each first key (QSBK), or each second key (QRUPK), or each first protection key (QRUPK). enc ) and / or each second protection key (QRUPK) int The number of third keys (QSBK*) for encryption and / or integrity protection is less than or equal to the second threshold.

[0089] For example, in an embodiment of this application, the second threshold is 100, limiting each QRUPK key to protecting a maximum of 100 QSBK keys. During on-demand updates / supplementation, when the number of QSBK keys issued online by the quantum key management primary platform exceeds the allowed protection key threshold of 100, multiple QRUPK keys are required. The required number of QRUPK keys is equal to the number of QSBK keys to be protected divided by the threshold, rounded up. For example, to encrypt and protect 1000 newly generated QSBK keys, 10 QRUPK keys are required; to encrypt and protect 1050 newly generated QSBK keys, 11 QRUPK keys are required.

[0090] In the embodiments of this application, each key in the key pool not only has two basic pieces of information—an identifier (QSBK ID) and a key value—but also adds a key generation (KG) information, which indicates which generation of QSBK key the first entity issued to the first device. Specifically, the key configured offline in the key pool is the first-generation key. The next-generation key uses the previous-generation key for direct or indirect encryption and / or integrity protection. The first key (QSBK) can be the previous generation key of the third key (QSBK*), and the third key (QSBK*) can be the next-generation key of the first key (QSBK). For example, the QSBK pre-configured offline to the cryptographic module of the first device is the first-generation QSBK. Based on the first-generation QSBK, the QRUPK derived and protected QSBK is the second-generation QSBK. Based on the second-generation QSBK, the QRUPK derived and protected QSBK is the third-generation QSBK, and so on.

[0091] In the embodiments of this application, the first device can store the algebra of the keys in the key pool. There are multiple ways to store the key algebra. For example, each key in the key pool is configured with an algebra, and the algebra of each key in the key pool can be stored separately. Alternatively, some keys in the key pool are configured with algebra, and only some keys' algebras can be stored. Or, each batch of keys in the key pool is configured with the same algebra, and the algebra of each batch of keys can be stored. The embodiments of this application do not limit this.

[0092] In embodiments of this application, step S101, which determines one or more first keys in the key pool, may include determining one or more first keys from all or part of the keys in the key pool.

[0093] It should be noted that, in the embodiments of this application, a portion of the keys in the key pool (QSBK resource pool) can be pre-allocated from the offline-filled keys (keys configured offline) as candidate keys. Then, one or more first keys (QSBKs) are determined from these candidate keys. For example, the QSBK resource pool includes 10,000 offline-filled QSBK keys, from which 1,000 offline-filled QSBK keys are allocated as candidate keys, and then first keys are determined from these 1,000 offline-filled QSBK keys. When one or more first keys (QSBKs) are determined from a portion of the keys in the key pool, after the first device subsequently receives one or more supplementary third keys (QSBK*), it can, according to actual circumstances or needs, choose to also include one or more third keys (QSBK*) as candidate keys, storing them together with the allocated candidate keys in the key pool. These third keys can then be selected as new first keys when key filling is required. Of course, the third key (QSBK*) can also be stored separately from the divided candidate keys in the key pool, and the third key (QSBK*) can be prohibited from being selected as the new first key when key filling is required. The new first key can only be determined from the pre-divided candidate keys. In this case, combined with the definition of key algebra above, it can also be understood that the key as a candidate key must satisfy KG=1.

[0094] In embodiments of this application, step S101, which determines one or more first keys in the key pool, may further include: determining one or more first keys in the key pool whose algebra is less than or equal to a first threshold.

[0095] It should be noted that, in the embodiments of this application, the first device can set an upper limit of the key generation (KG). max This first threshold is used to prevent the quantum service base key from being used indefinitely as a key protection key. In other words, once the quantum service base key in the key pool (QSBK resource pool) reaches its generation limit, it can no longer be used as a key protection key to encrypt and / or protect the integrity of the issued third key (QSBK*), thereby reducing the impact of forward attacks and improving security.

[0096] For example, such as Figure 5As shown, assuming that initially, the quantum cryptography service platform pre-configures four QSBK keys (QSBK ID=1~QKID=4) into the cryptographic module of the terminal (first device) via offline pre-configuration. These are all first-generation ordinary keys (ordinary keys, i.e., not last-generation keys). Ordinary keys can be used directly or derived as key protection keys (i.e., QRUPK) during the update / supplementation process, or directly or derived as other working keys in the quantum secure communication system (e.g., secure channel protection keys, session key protection keys, etc.). Ordinary keys are destroyed after use.

[0097] As the regular keys are consumed during use, the terminal needs to replenish the QSBK key. Suppose that key number 2, corresponding to QSBK ID=2 of the first-generation regular key, is selected as the QRUPK key, and the second-generation regular keys QSBK ID=5~QSBK ID=8 are securely obtained. Subsequently, key number 2, corresponding to QSBK ID=2, is destroyed.

[0098] After a period of time, the terminal needed to replenish the quantum service basic key again. Therefore, it selected the 5th and 8th keys corresponding to the second-generation ordinary keys QSBK ID=5 and QSBK ID=8 as QRUPK keys (orange) and securely obtained the third-generation ordinary keys QKID=9~QKID=16. After that, the 5th and 8th keys corresponding to QKID=5 and QKID=8 were destroyed.

[0099] In this way, the original four quantum service base keys can be expanded to 16. Excluding the three used as QRUPK keys, 13 are actually available as other working keys in the quantum secure communication system, thus increasing the number of usable QSBK keys.

[0100] On the other hand, this example sets an algebraic upper limit of KG. max The first threshold is 3, meaning the third-generation QSBK key is the last key. The last key can no longer be used as a QRUPK key to prevent adverse effects from forward attacks. However, the last key can still be used directly or derived as other working keys in the quantum secure communication system, and is destroyed after use. Thus, assuming the second-generation QSBK key corresponding to QSBK ID=5 is leaked, the keys corresponding to the third-generation keys QSBK IDs=9 to QSBK ID=12 are no longer secure. However, since QSBK IDs=9 to QSBK ID=12 are the last keys and are no longer used to protect the issuance of new QSBK keys, the possibility of using the keys corresponding to QSBK IDs=9 to QSBK ID=12 as QRUPK keys to protect the issuance of new QSBK keys is interrupted, thereby preventing subsequent attacks and limiting the impact of forward attacks.

[0101] It should be noted that, in the embodiments of this application, the key pool (QSBK resource pool) may also lack a first key whose generation meets the first threshold. That is, no QSBK whose generation meets the first threshold has been determined from the key pool (QSBK resource pool), and there is no ordinary key that can be used for key protection. In this case, the first device needs to reacquire the QSBK offline and cannot reacquire the QSBK online through on-demand update / supplement. The first device may output a prompt message if the first key is not determined from the key pool; the prompt message is used to prompt the user to configure the key, i.e., the QSBK, offline. The first device marks the QSBK key refilled offline as the first-generation key.

[0102] In embodiments of this application, step 101 and / or step S102 may be performed upon fulfillment of a first condition, i.e., upon fulfillment of the first condition, determining the first key (QSBK) and / or sending the first message, wherein the first condition includes: The number of keys used in the key pool (QSBK resource pool) is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool (QSBK resource pool) is less than or equal to the fourth threshold.

[0103] It should be noted that, in the embodiments of this application, a threshold number of keys is set for the keys stored in the key pool (QSBK resource pool). When the number of used keys reaches the threshold and / or the number of unused keys reaches the threshold, i.e., when there are too many used keys and / or too few unused keys, the first device can activate the quantum key on-demand update / replenishment mechanism and send a first message requesting the first entity to replenish the keys. On-demand update / replenishment can also be referred to as on-demand replenishment, online replenishment, online update, online supplementation, etc.

[0104] It should be noted that, in the embodiments of this application, the third threshold and the fourth threshold can be represented as KN. max The third and / or fourth thresholds are set for the total number of keys, or for the number of keys of each type. Key types are distinguished based on one or more of the following: key length, function, purpose, role, and time. The key's time can include its generation time, lifespan, validity period, expiration time, etc. The third and fourth thresholds can be the same or different, and can be set according to actual needs or application scenarios; this application does not limit this.

[0105] It should be noted that, in the embodiments of this application, the first device can determine whether the first condition is met while processing the first service (any service or a specified service), that is, the on-demand update / supplementation of the key can occur alongside the first service. Specifically, the first service can be a secure communication-related service, such as interacting with a key management platform, changing the user's service status, or requesting to obtain the session key required for secure communication. Furthermore, the first device can also determine whether the first condition is met at a specific time, distinguishing it from other services, and determine whether the first condition is met separately; this embodiment of the application does not limit this.

[0106] In the embodiments of this application, in step S102, the first device sends a first message to the first entity. The first message is used to request key refilling. Key refilling can be described as supplementing, updating, or loading keys online. The first message can carry not only the identifier of the first key (QSBK) but also other information. Similarly, the second message sent by the first entity and received by the first device in step S103 can carry not only the third key (QSBK*) for encryption and / or integrity protection but also other information.

[0107] In embodiments of this application, the first message may also carry the algebra of the first key (QSBK); and / or, the second message may also carry the algebra of the third key (QSBK*) updated by the first entity.

[0108] It should be noted that, in the embodiments of this application, the algebra of the third key (QSBK*) can also be updated by the first entity and provided to the first device. Here, the algebra of the third key (QSBK*) updated by the first entity is the value of the algebra of the first key (QSBK) determined by the first device plus one.

[0109] In embodiments of this application, the first entity may also store a third key (QSBK*) and / or update the generation of the third key (QSBK*). The generation of the updated third key (QSBK*) refers to setting its generation to the next generation of the first key (QSBK).

[0110] In embodiments of this application, the first message may also carry the amount of the third key (QSBK*) charged; and / or, the amount of the third key (QSBK*) carried in the second message is related to the amount of the third key (QSBK*) charged.

[0111] It should be noted that, in the embodiments of this application, the first message may also carry the type of the third key (QSBK*); and / or, the third key (QSBK*) carried in the second message is generated by the first entity according to the type of the third key (QSBK*).

[0112] In embodiments of this application, the first message may also carry the location of the third key (QSBK*), and the first device may also store the third key (QSBK*) at that location.

[0113] In the embodiments of this application, the keys in the key pool (QSBK resource pool) are symmetric keys shared between the first device and the first entity. Both the first device and the first entity need to establish a key pool to store the shared keys. The first device sends the location of the third key (QSBK*) to the first entity, so that the first entity can store it in the corresponding location according to the location of the third key (QSBK*), ensuring that the keys shared by the first device and the first entity are the same, and that the key storage location and number are consistent, ensuring correct use. In implementation, the location information can be a pointer, array number, etc., which is not limited in the embodiments of this application.

[0114] In the embodiments of this application, combined with Figures 1-3 The first message may also carry a Secure Element Identifier, or SEID, so that the first entity can generate one or more third keys (QSBK*) for the Secure Element Identifier.

[0115] In embodiments of this application, the second message may also carry first information for encryption and / or integrity protection; wherein the first information is related to a third key (QSBK*), and the first information and the third key (QSBK*) use the same key (first key (QSBK), or second key (QRUPK), or first protection key (QRUPK). enc ) and / or a second protection key (QRUPK) int Encryption and / or integrity protection.

[0116] It should be noted that, in the embodiments of this application, the first information may include the algebra of the third key (QSBK*) updated by the first entity, and may also include other information related to the third key (QSBK*), such as the identifier of the third key (QSBK*), the number of third keys (QSBK*), etc. Furthermore, the first information may be integrated with or merged with the third key (QSBK*) using the same key (first key (QSBK), or second key (QRUPK), or first protection key (QRUPK)). enc ) and / or a second protection key (QRUPK) int Encryption and / or integrity protection can also be separated from the third key (QSBK*) and performed independently, forming two independent pieces of information: the third key (QSBK*) for encryption and / or integrity protection, and the first information for encryption and / or integrity protection. This application does not limit the specific implementation.

[0117] Figure 6 A flowchart illustrating a communication method provided in an embodiment of this application. Figure 2 .like Figure 6 As shown, the communication method applied to the first entity mainly includes the following steps: S201. Receive a first message sent by the first device; wherein the first message is used to request key charging, and the first message carries the identifier of one or more first keys; S202, Send a second message to the first device; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0118] In the embodiments of this application, in step S101, the first message carries the identifiers of one or more first keys (QSBKs). Based on this, the first entity can obtain one or more first keys (QSBKs) from the key pool according to the identifiers of the one or more first keys (QSBKs). Furthermore, referring to the first device-side method described above, the first device determines one or more first keys (QSBKs) in the key pool whose algebra is less than or equal to a first threshold. Based on this, the first entity can also check whether the algebra of the first key (QSBK) is less than or equal to the first threshold after obtaining the first key (QSBK) to ensure correct key usage. Specifically, if the algebra of the first key is less than or equal to the first threshold, the first entity can generate one or more third keys and send a second message to the first device; if the algebra of the first key is greater than the first threshold, a third message is sent to the first device; wherein the third message is used to indicate key filling failure.

[0119] In the embodiments of this application, in step S201, the first message may carry not only the identifier of the first key (QSBK), but also the amount of third key (QSBK*) and / or the type of third key (QSBK*). The first entity may generate one or more third keys (QSBK*) based on the amount of third key (QSBK*) and / or the type of third key (QSBK*), thereby further encrypting and / or protecting the integrity of one or more third keys (QSBK*), and then execute step S202 to send a second message carrying one or more third keys (QSBK*) with encryption and / or integrity protection to the first device.

[0120] In embodiments of this application, a first entity can obtain one or more first keys (QSBK) based on the identifier of one or more first keys (QSBK); generate one or more second keys (QRUPK) based on the one or more first keys (QSBK), and then generate one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK)int ), or generate one or more first protection keys (QRUPK) based on one or more first keys (QSBK). enc ) and / or a second protection key (QRUPK) int Based on one or more first keys (QSBK), or based on one or more second keys (QRUPK), or based on one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int ), to encrypt and / or protect the integrity of one or more third keys (QSBK*).

[0121] In embodiments of this application, the first device generates one or more second keys (QRUPK) based on one or more first keys (QSBK), and then generates one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int ), or generate one or more first protection keys (QRUPK) based on one or more first keys (QSBK). enc ) and / or a second protection key (QRUPK) int One or more third keys (QSBK*) are based on one or more first keys (QSBK), or on one or more second keys (QRUPK), or on one or more first protection keys (QRUPK). enc ) and / or a second protection key (QRUPK) int (This is used for decryption and / or integrity verification.)

[0122] In the embodiments of this application, each first key (QSBK), or each second key (QRUPK), or each first protection key (QRUPK) enc ) and / or each second protection key (QRUPK) int The number of third keys (QSBK*) for encryption and / or integrity protection is less than or equal to the second threshold.

[0123] In embodiments of this application, the first message also carries the algebra of the first key (QSBK); and / or, the second message also carries the algebra of the third key (QSBK*) updated by the first entity.

[0124] In embodiments of this application, the first entity may also store a third key (QSBK*) and / or update the algebra of the third key (QSBK*).

[0125] In embodiments of this application, the first message may also carry the location of the third key (QSBK*), and the first entity may also store the third key (QSBK*) according to the location of the third key (QSBK*).

[0126] In embodiments of this application, the first message may also carry a cryptographic module identifier, and the first entity may also generate one or more third keys (QSBK*) for the cryptographic module identified by the cryptographic module identifier.

[0127] In embodiments of this application, the second message may also carry first information for encryption and / or integrity protection; wherein the first information is associated with a third key (QSBK*), and the first information and the third key (QSBK*) are encrypted and / or protected for integrity using the same key.

[0128] It should be noted that, in the embodiments of this application, the first information may include the algebra of the third key (QSBK*) updated by the first entity. Of course, it may also include other information related to the third key (QSBK*), such as the identifier of the third key (QSBK*), the number of third keys (QSBK*), etc. Furthermore, the first information may be integrated with or merged with the third key (QSBK*) using the same key (first key (QSBK), or second key (QRUPK), or first protection key (QRUPK)). enc ) and / or a second protection key (QRUPK) int Encryption and / or integrity protection can also be separated from the third key (QSBK*) and performed independently, forming two independent pieces of information: the third key (QSBK*) for encryption and / or integrity protection, and the first information for encryption and / or integrity protection. This application does not limit the specific implementation.

[0129] In the embodiments of this application, the first key (QSBK) is determined by the first device when the first condition is met, and / or the first message is sent by the first device when the first condition is met; The first condition includes: The number of keys used in the key pool (QSBK resource pool) is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool (QSBK resource pool) is less than or equal to the fourth threshold.

[0130] In embodiments of this application, the third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

[0131] In embodiments of this application, the type of key is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

[0132] In the embodiments of this application, the first condition is determined while the first device is processing the first service.

[0133] In embodiments of this application, the first entity may also store the algebra of the keys in the key pool.

[0134] In the embodiments of this application, the keys configured offline in the key pool are first-generation keys.

[0135] In embodiments of this application, the next-generation key is encrypted and / or protected for integrity using the previous-generation key.

[0136] In the embodiments of this application, the first key (QSBK) is the previous generation key of the third key (QSBK*), and the third key (QSBK*) is the next generation key of the first key (QSBK).

[0137] It should be noted that, in the embodiments of this application, the explanations of the first message, the second message, and each key are detailed in the relevant content on the first device side mentioned above, and will not be repeated here.

[0138] The following are combined with Figure 1 and Figure 2 The system architecture shown illustrates the business processing flow of the technical solution of this application.

[0139] Figure 7 A business processing flow diagram provided for an embodiment of this application Figure 1 Applicable to Figure 1 The system architecture is shown below. Figure 7 As shown, the main steps include: 0. In the operation of quantum secure communication application equipment, the cryptographic middleware or cryptographic application uses QSBK to securely exchange business information with the quantum cryptographic service primary or secondary platform, which normally consumes QSBK keys.

[0140] 1. During operation, the cryptographic middleware of the quantum secure communication application device queries the QSBK status from the cryptographic module.

[0141] 2. The cryptographic module of the quantum secure communication application device responds to the QSBK status, which carries QSBK information (the number of QSBK consumed or the number of QSBK remaining).

[0142] 3. The cryptographic middleware of the quantum secure communication application device determines whether the number of used QSBKs or the remaining number of QSBKs has reached a preset threshold. If the threshold is reached, the on-demand injection process is initiated; otherwise, the on-demand injection process is not initiated.

[0143] 4. The cryptographic middleware of quantum secure communication application equipment indicates that the cryptographic module allocates QSBK for use as needed.

[0144] 5. The cryptographic module of the quantum secure communication application device allocates a usable QSBK for this on-demand charging process and obtains a QSBK ID. A usable QSBK key means that its algebraic QSBK KG should be less than or equal to the upper limit of algebraic numbers KG. max .

[0145] It should be noted that the generation KG refers to the generation of QSBK. The original QSBK filled by the cryptographic module is the first generation QSBK, the QSBK filled with protection using the first generation QSBK is the second generation QSBK, the QSBK filled with protection using the second generation QSBK is the third generation QSBK, and so on.

[0146] It should be noted that the system can allocate a certain number of QSBK keys in the QSBK resource pool specifically for on-demand refilling. In this case, KG max It can be set to 1.

[0147] 6. If the QSBK allocation is successful, the cryptographic module of the quantum secure communication application device will derive the QRUPK based on the allocated QSBK. enc and QRUPK int .

[0148] 7. The cryptographic module of the quantum secure communication application device returns a QSBK allocation response, indicating the QSBK ID, QSBK KG, and other information used for allocation.

[0149] 8. The cryptographic middleware of the quantum secure communication application equipment sends an on-demand refill request message to the quantum cryptographic service primary platform, which carries information such as SEID, QSBK ID, QSBK KG, and QSBK refill quantity.

[0150] 9. The quantum cryptography service platform retrieves a QSBK from the QSBK resource pool based on the QSBK ID, and derives a QRUPK based on the QSBK. enc and QRUPK int .

[0151] 10. The quantum cryptography service platform generates a new batch of QSBKs based on the QSBK charging quantity requirement in the request message, updates the QSBK KG value to the next generation (i.e., the received QSBK KG value is incremented by 1), and updates the QSBK status information.

[0152] 11. The quantum cryptography service platform is based on QRUPK. enc and QRUPK intEncrypt and protect the integrity of the new generation QSBK and related information (QSBK ID, QSBK quantity, QSBK KG, etc.).

[0153] 12. The quantum cryptography service primary platform sends a ready-to-use injection response message to the cryptographic middleware of the quantum secure communication application equipment, which carries the SEID, the protected QSBK and related information.

[0154] 13. The cryptographic middleware of the quantum secure communication application device sends the protected QSBK and related information to the cryptographic module, instructing the cryptographic module to fill the QSBK.

[0155] 14. The cryptographic module of quantum secure communication application equipment is based on QRUPK. int Verify the integrity of the QSBK and related information. After successful verification, use QRUPK. enc Decrypt to obtain a new batch of QSBKs and related information, securely store the QSBKs, and update the QSBK KG and QSBK status information.

[0156] 15. The cryptographic module of the quantum secure communication application device returns a QSBK charging response, indicating the charging process result.

[0157] 16. Optionally, the cryptographic middleware of the quantum secure communication application device sends an on-demand injection response message to the quantum cryptographic service primary platform and returns the on-demand injection processing result.

[0158] Figure 8 A business processing flow diagram provided for an embodiment of this application Figure 2 Applicable to Figure 2 The system architecture is shown below. Figure 8 As shown, the main steps include: 1. After the quantum secure communication application device is started, the cryptographic middleware establishes a secure channel with the quantum cryptography service platform for the secure transmission of key management-related business information. The cryptographic middleware in the application device sets a QSBK key quantity threshold (e.g., Key Number Max, KN). max ), the upper limit of the "generation" value (e.g., KG) max And the threshold for the number of QSBK keys allowed to be protected (e.g., Key Protection Max, KP) max ).

[0159] 2. When a certain secure communication application on the application device initiates an encrypted communication service, it sends a request to the cryptographic middleware to obtain the QSBK key.

[0160] 3. The cryptographic middleware sends a request to the cryptographic module to allocate a QSBK key.

[0161] 4. The cryptographic module selects an available QSBK key from the quantum service basic key resource pool and assigns it to the secure communication application. This key is identified by its QSBK ID. The cryptographic module returns a QSBK key allocation response to the cryptographic middleware, which includes the QSBK ID. Here, the available QSBK key can be any generation key, that is, it can be a regular key or a last-generation key, used to derive various other keys (such as security authentication keys, secure channel protection keys, session key protection keys, etc.) to realize quantum secure communication services.

[0162] 5. The cryptographic middleware returns the QSBK key handle and QSBK ID ​​to the quantum secure communication application.

[0163] 6. After obtaining the QSBK key, quantum secure communication applications can use the QSBK key to conduct secure communication-related business (such as interacting with the key management platform, changing user business status, or requesting the session key required for secure communication). The operation and processing methods here are varied.

[0164] 7. While processing secure communication related services (i.e., step 6) (in any order), the cryptographic middleware sends a QSBK key status query request to the cryptographic module to obtain information such as the type and quantity of available QSBK keys in the cryptographic module. QSBK key types can be distinguished by different key lengths, different key states (e.g., ordinary keys, last-generation keys, etc.), or different times when the keys were generated, etc.

[0165] 8. The cryptographic module returns a QSBK key status response, providing the cryptographic middleware with information such as the type and quantity of QSBK keys.

[0166] 9. The cryptographic middleware is pre-configured with a QSBK key quantity threshold KN. max When the number of used QSBK keys reaches a threshold or the number of unused QSBK keys in the cryptographic module reaches a threshold KN. max At that time, the cryptographic middleware initiates the quantum key update / replenishment process. The threshold KN for the number of QSBK keys... max This setting can be applied to the total number of QSBK keys or to the number of QSBK keys for each type. If the number of QSBK keys being updated / supplemented in this process exceeds the QRUPK key protection threshold KP... max Then the cryptographic middleware calculates the number of QRUPKs required for this processing.

[0167] 10. When the quantum key update / supplementation mechanism is activated, the cryptographic middleware sends a request to the cryptographic module to allocate a QSBK key. The request specifies that the purpose is to update / supplement the QSBK key as needed.

[0168] If multiple QRUPK keys are required, the request must also include the required number of QRUPK keys.

[0169] 11. The cryptographic module selects available QSBK keys from the quantum service basic key resource pool and allocates them for use in this on-demand update / supplementation process. Here, available QSBK keys refer to ordinary keys in the cryptographic module, i.e., keys smaller than the algebraic limit in KG. max The QSBK key is used for quantum key replenishment / update, with preference given to QSBK keys with smaller algebraic values. If a QSBK key exists, the QSBK ID ​​is returned; otherwise, allocation failure is returned, and the operation is terminated.

[0170] When multiple QRUPK keys are required, multiple QSBK keys need to be allocated according to the quantity requested in the request to derive multiple QRUPK keys. In this case, the returned QSBK ID ​​can be multiple values ​​or a range of values. Here, the QSBK ID ​​also serves as an identifier for the QRUPK.

[0171] 12. If the QSBK key allocation is successful, the cryptographic module generates one or more QRUPK keys based on one or more QSBK keys. The QRUPK key is equivalent to the aforementioned second key, and its generation method is described in the relevant content, which will not be repeated here.

[0172] 13. The cryptographic module returns a QSBK key allocation response to the cryptographic middleware, which includes information such as the QSBK ID, algebra KG, and other information of the allocated QSBK key. When using multiple QRUPK keys, the QSBK ID ​​can be multiple values ​​or a range of values.

[0173] 14. The cryptographic middleware sends a key update / supplementation request message to the quantum cryptography service platform, carrying information such as QSBK ID, QSBK KG, the number, type, and update location of the updated / supplemented QSBK keys. When using a single QRUPK key, the QSBK ID ​​is a single value; when using multiple QRUPK keys, the QSBK ID ​​is multiple values ​​or a range of values. The QSBK KG is equal to the QSBK KG value received in step 13. The type indicates the length of the QSBK key being updated / supplemented. The update location indicates the identification range or interval of the new batch of QSBK keys being updated / supplemented, or a pointer to the location of the QSBK keys, to ensure consistency between the application device and the cryptographic service platform regarding the QSBK update identifiers or locations in the quantum service basic key resource pool, preventing misalignment.

[0174] 15. The quantum cryptography service platform obtains the corresponding QSBK key based on the QSBK ID, and generates one or more QRUPKs based on one or more QSBKs. The QRUPK is equivalent to the aforementioned second key, and its generation method is described in relevant content, which will not be repeated here.

[0175] 16. The quantum cryptography service platform generates a new batch of QSBK keys based on the quantity and type information in the request message. The KG of the new key is the received QSBK KG value plus 1, and the platform updates the key content in the corresponding QSBK identifier range. Subsequently, one or more QRUPKs (including QRUPKs) are used. enc and QRUPK int Encryption and / or integrity protection are applied to a new batch of QSBK keys and related information (such as QSBK ID, new QSBK KG, QSBK quantity, etc.). Each QRUPK key must protect no more than the allowed threshold of the number of QSBK keys that can be protected, KP. max .

[0176] 17. The quantum cryptography service platform returns a key update / supplement response message to the cryptographic middleware, which carries the ciphertext of the new batch of protected QSBK keys and related information, QSBK KG and other information.

[0177] 18. The cryptographic middleware sends an import QSBK key request to the cryptographic module, which includes the ciphertext of a new batch of QSBK keys and related information, QSBK KG, etc. The request may also include a QSBK ID, which specifies one or more QRUPKs used for key protection.

[0178] 19. The cryptographic module uses one or more QRUPKs to decrypt and / or verify the integrity of the ciphertext of the QSBK key, then securely stores the newly added QSBK key in the corresponding range of the quantum service basic key resource pool, and updates the QSBK KG value.

[0179] 20. The cryptographic module returns a QSBK key import response and returns the result of key update / supplementation to the cryptographic middleware. It may also include information such as the type and quantity of the current QSBK key.

[0180] 21. After a successful key update / supplement, the cryptographic middleware can return a key update / supplementation response message to the quantum cryptography service platform, indicating that the transaction was successful. Both parties can then activate a new batch of QSBK keys.

[0181] Based on the above, the technical solution provided in this application has the following advantages: First, it can replenish the QSBK key online when the pre-configured QSBK key in the cryptographic module (i.e., the security medium) is consumed. Second, compared to solutions using customized large-capacity security media (such as SIM cards), this solution does not require increasing the storage space of the security medium and can be implemented using a regular SIM card from the existing network, effectively reducing the implementation cost of the device. Third, compared to traditional online key update methods, this solution uses the QSBK key stored in the security medium to derive the key protection key (i.e., QRUPK), which is destroyed immediately after use, enabling frequent and varied key protection key changes. This solves the problem of the pre-configured key protection key or the digital certificate used to negotiate the key protection key remaining unchanged for a long time in traditional methods, thus improving system security. Simultaneously, by setting an upper limit on the number of iterations for the QSBK key, the number of times the key is used is limited, effectively controlling the impact range when a forward attack occurs. By setting an upper limit on the number of protected keys for the QRUPK key, the number of QSBK keys that one QRUPK key can protect is limited, further improving system security and making it more suitable for quantum secure communication scenarios.

[0182] This application provides a first device. Figure 9 A schematic diagram of the structure of a first device provided in an embodiment of this application. Figure 1 .like Figure 9 As shown, in an embodiment of this application, the first device 1 includes: The first processing module 11 is used to determine one or more first keys in the key pool; The first sending module 12 is used to send a first message to a first entity; wherein the first message is used to request a key to be charged, and the first message carries an identifier of one or more of the first keys; The first receiving module 13 is configured to receive a second message sent by the first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0183] In one embodiment of this application, the first entity obtains one or more first keys based on the identifier of one or more first keys, and the one or more first keys are used to generate one or more second keys to generate one or more first protection keys and / or second protection keys, or to generate one or more first protection keys and / or second protection keys. One or more of the third keys are used for encryption and / or integrity protection based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

[0184] In one embodiment of this application, the first processing module 11 is further configured to generate one or more second keys based on one or more first keys, thereby generating one or more first protection keys and / or second protection keys, or to generate one or more first protection keys and / or second protection keys based on one or more first keys; to decrypt and / or verify the integrity of one or more third keys after encryption and / or integrity protection based on one or more first keys, or based on one or more second keys, or based on one or more first protection keys and / or second protection keys, to obtain one or more third keys.

[0185] In one embodiment of this application, the first processing module 11 is used to determine one or more of the first keys from all or part of the keys in the key pool.

[0186] In one embodiment of this application, the first processing module 11 is configured to determine one or more of the first keys in the key pool whose algebra is less than or equal to a first threshold.

[0187] In one embodiment of this application, the first message further carries the algebra of the first key; and / or, the second message further carries the algebra of the third key updated by the first entity.

[0188] In one embodiment of this application, the first processing module 11 is further configured to store the third key and / or update the algebra of the third key.

[0189] In one embodiment of this application, the first message further carries the amount of the third key being filled; and / or, the amount of the third key carried in the second message is related to the amount of the third key being filled.

[0190] In one embodiment of this application, the first message further carries the type of the third key; and / or, the third key carried in the second message is generated by the first entity based on the type of the third key.

[0191] In one embodiment of this application, the first message also carries the location of the third key, and the first processing module 11 is used to store the third key according to the location of the third key.

[0192] In one embodiment of this application, the first message further carries a cryptographic module identifier, so that the first entity generates one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

[0193] In one embodiment of this application, for each first key, or each second key, or each first protection key and / or each second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to a second threshold.

[0194] In one embodiment of this application, the second message further carries first information for encryption and / or integrity protection; wherein the first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

[0195] In one embodiment of this application, the first processing module 11 is used to determine the first key when a first condition is met, and / or the first sending module 12 is used to send the first message when the first condition is met; The first condition includes: The number of keys used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

[0196] In one embodiment of this application, the third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

[0197] In one embodiment of this application, the type of key is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

[0198] In one embodiment of this application, the first processing module 11 is used to determine whether the first condition is met while processing the first service.

[0199] In one embodiment of this application, the first processing module 11 is used to store the algebra of the keys in the key pool.

[0200] In one embodiment of this application, the key configured offline in the key pool is a first-generation key.

[0201] In one embodiment of this application, the next-generation key is encrypted and / or protected for integrity using the previous-generation key.

[0202] In one embodiment of this application, the first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

[0203] In one embodiment of this application, the first processing module 11 is configured to output a prompt message when the first key is not determined from the key pool; wherein the prompt message is used to prompt the user to configure the key offline.

[0204] Based on the same inventive concept Figure 10 A schematic diagram of the structure of a first device provided in an embodiment of this application. Figure 2 .like Figure 10 As shown, the first device 1 includes: a first processor 14, a first memory 15, and a first communication bus 16; The first communication bus 16 is used to realize the communication connection between the first processor 14 and the first memory 15; The first processor 14 is configured to execute one or more computer programs stored in the first memory 15 to implement a communication method applied to the first device 1.

[0205] In a specific embodiment, the first processing module 11, the first transmitting module 12, and the first receiving module 13 can be implemented by a first processor 14 located on the first device 1. The first processor 14 can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), controller, microcontroller, or microprocessor. It is understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other types; this embodiment does not specifically limit this.

[0206] This application provides a first entity. Figure 11 A schematic diagram of the structure of a first entity provided in an embodiment of this application. Figure 1 .like Figure 11 As shown, the first entity 2 includes: The second receiving module 21 is used to receive a first message sent by the first device; wherein the first message is used to request a key to be charged, and the first message carries the identifier of one or more first keys; The second sending module 22 is used to send a second message to the first device; wherein the second message carries one or more third keys for encryption and / or integrity protection.

[0207] In one embodiment of this application, the first entity 2 further includes a second processing module (not shown in the figure), which is used to obtain one or more first keys from a key pool based on the identifier of one or more first keys.

[0208] In one embodiment of this application, the second processing module is used to check whether the algebra of the first key is less than or equal to a first threshold.

[0209] In one embodiment of this application, the second processing module is configured to generate one or more of the third keys if the algebra of the first key is less than or equal to the first threshold, and send a second message to the first device through the second sending module 22; if the algebra of the first key is greater than the first threshold, send a third message to the first device; wherein the third message is used to indicate that key filling has failed.

[0210] In one embodiment of this application, the first message further carries the amount of the third key and / or the type of the third key, and the second processing module is used to generate one or more of the third keys based on the amount of the third key and / or the type of the third key.

[0211] In one embodiment of this application, the second processing module is configured to obtain one or more first keys based on the identifiers of one or more first keys; generate one or more second keys based on one or more first keys, and then generate one or more first protection keys and / or second protection keys, or generate one or more first protection keys and / or second protection keys based on one or more first keys; and encrypt and / or protect the integrity of one or more third keys based on one or more first keys, or based on one or more second keys, or based on one or more first protection keys and / or second protection keys.

[0212] In one embodiment of this application, the first device generates one or more second keys based on one or more first keys, and then generates one or more first protection keys and / or second protection keys, or generates one or more first protection keys and / or second protection keys based on one or more first keys; the one or more third keys are used for decryption and / or integrity verification based on one or more first keys, or based on one or more second keys, or based on one or more first protection keys and / or second protection keys.

[0213] In one embodiment of this application, the first message further carries the algebra of the first key; and / or, the second message further carries the algebra of the third key updated by the first entity.

[0214] In one embodiment of this application, the second processing module is used to store the third key and / or update the algebra of the third key.

[0215] In one embodiment of this application, the first message also carries the location of the third key, and the second processing module is used to store the third key according to the location of the third key.

[0216] In one embodiment of this application, the first message further carries a cryptographic module identifier, and the second processing module is configured to generate one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

[0217] In one embodiment of this application, for each first key, or each second key, or each first protection key and / or each second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to a second threshold.

[0218] In one embodiment of this application, the second message further carries first information for encryption and / or integrity protection; wherein the first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

[0219] In one embodiment of this application, the first key is determined by the first device when the first condition is met, and / or the first message is sent by the first device when the first condition is met; The first condition includes: The number of keys used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

[0220] In one embodiment of this application, the third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

[0221] In one embodiment of this application, the type of key is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

[0222] In one embodiment of this application, the first condition is determined while the first device is processing the first service.

[0223] In one embodiment of this application, the second processing module is used to store the algebra of the keys in the key pool.

[0224] In one embodiment of this application, the key configured offline in the key pool is a first-generation key.

[0225] In one embodiment of this application, the next-generation key is encrypted and / or protected for integrity using the previous-generation key.

[0226] In one embodiment of this application, the first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

[0227] Based on the same inventive concept Figure 12 A schematic diagram of the structure of a first entity provided in an embodiment of this application. Figure 2 .like Figure 12 As shown, the first entity 2 includes: a second processor 23, a second memory 24, and a second communication bus 25; The second communication bus 25 is used to realize the communication connection between the second processor 23 and the second memory 24; The second processor 23 is used to execute one or more computer programs stored in the second memory 24 to implement the communication method applied to the first entity 2.

[0228] In a specific embodiment, the second receiving module 21, the second transmitting module 22, and the second processing module can be implemented by a second processor 23 located on the first entity 2. The second processor 23 can be at least one of an ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, or microprocessor. It is understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other types, and this embodiment does not impose specific limitations.

[0229] This application provides a computer program product, including a computer program that, when executed by a processor, implements a communication method applied to a first device, or a communication method applied to a first entity.

[0230] This application provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a communication method applied to a first device, or a communication method applied to a first entity. The computer-readable storage medium may be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or it may be a device including one or any combination of the above-mentioned memories, such as a mobile phone, computer, tablet device, personal digital assistant, etc.

[0231] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0232] This application is described with reference to schematic and / or block diagrams of implementations of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the schematic and / or block diagrams can be implemented by computer program instructions, and combinations of blocks in the schematic and / or block diagrams can be implemented. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the schematic and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0233] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the implementation flow diagram. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0234] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0235] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication method, characterized in that, Applied to a first device, the method includes: Determine one or more first keys in the key pool; Send a first message to a first entity; wherein the first message is used to request a key to be charged, and the first message carries an identifier of one or more of the first keys; Receive a second message sent by a first entity; wherein the second message carries one or more third keys for encryption and / or integrity protection.

2. The method according to claim 1, characterized in that, The first entity obtains one or more first keys based on the identifier of one or more first keys, and the one or more first keys are used to generate one or more second keys, thereby generating one or more first protection keys and / or second protection keys, or are used to generate one or more first protection keys and / or second protection keys; One or more of the third keys are used for encryption and / or integrity protection based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

3. The method according to claim 1 or 2, characterized in that, The method further includes: One or more second keys are generated based on one or more of the first keys, and then one or more first protection keys and / or second protection keys are generated; or one or more first protection keys and / or second protection keys are generated based on one or more of the first keys. Based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys, decrypt and / or verify the integrity of one or more of the third keys after encryption and / or integrity protection to obtain one or more of the third keys.

4. The method according to claim 1, characterized in that, The step of determining one or more first keys in the key pool includes: One or more of the first keys are determined from all or part of the keys in the key pool.

5. The method according to claim 1, characterized in that, The step of determining one or more first keys in the key pool includes: In the key pool, identify one or more of the first keys whose algebra is less than or equal to the first threshold.

6. The method according to claim 5, characterized in that, The first message also carries the algebra of the first key; and / or, the second message also carries the algebra of the third key updated by the first entity.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: Store the third key and / or update the algebra of the third key.

8. The method according to claim 1, characterized in that, The first message also carries the amount of the third key that has been injected; and / or, the amount of the third key carried in the second message is related to the amount of the third key that has been injected.

9. The method according to claim 1, characterized in that, The first message also carries the type of the third key; and / or, the third key carried in the second message is generated by the first entity based on the type of the third key.

10. The method according to claim 1, characterized in that, The first message also carries the location of the third key, and the method further includes: The third key is stored according to its location.

11. The method according to claim 1, characterized in that, The first message also carries a cryptographic module identifier, so that the first entity generates one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

12. The method according to claim 2 or 3, characterized in that, For each of the first key, or each of the second key, or each of the first protection key and / or each of the second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to the second threshold.

13. The method according to claim 1, characterized in that, The second message also carries first information for encryption and / or integrity protection; The first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

14. The method according to claim 1, characterized in that, The method further includes: Upon fulfillment of the first condition, the first key is determined and / or the first message is sent: The first condition includes: The number of keys used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

15. The method according to claim 14, characterized in that, The third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

16. The method according to claim 15, characterized in that, The type of key is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

17. The method according to claim 14, characterized in that, The method further includes: While processing the first business transaction, determine whether the first condition is met.

18. The method according to claim 5, characterized in that, The method further includes: Store the algebra of the keys in the key pool.

19. The method according to claim 5 or 18, characterized in that, The keys configured offline in the key pool are first-generation keys.

20. The method according to claim 5 or 18, characterized in that, Next-generation keys use the previous generation keys for encryption and / or integrity protection.

21. The method according to claim 20, characterized in that, The first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

22. The method according to claim 1, characterized in that, The method further includes: If the first key is not determined from the key pool, a prompt message is output; The prompt message is used to suggest configuring the key offline.

23. A communication method, characterized in that, Applied to a first entity, the method includes: Receive a first message sent by a first device; wherein the first message is used to request a key to be charged, and the first message carries an identifier of one or more first keys; Send a second message to the first device; wherein the second message carries one or more third keys for encryption and / or integrity protection.

24. The method according to claim 23, characterized in that, The method further includes: One or more of the first keys are obtained from the key pool based on the identifier of one or more of the first keys.

25. The method according to claim 23, characterized in that, The method further includes: Check whether the algebra of the first key is less than or equal to the first threshold.

26. The method according to claim 25, characterized in that, The method further includes: If the algebra of the first key is less than or equal to the first threshold, generate one or more of the third keys and send a second message to the first device; If the algebra of the first key is greater than the first threshold, a third message is sent to the first device; wherein the third message is used to indicate that key filling has failed.

27. The method according to claim 23, characterized in that, The first message also carries the amount of the third key injected and / or the type of the third key, and the method further includes: One or more third keys are generated based on the amount of the third key filled and / or the type of the third key.

28. The method according to claim 23, characterized in that, The method further includes: One or more second keys are generated based on one or more of the first keys, and then one or more first protection keys and / or second protection keys are generated; or one or more first protection keys and / or second protection keys are generated based on one or more of the first keys. Encryption and / or integrity protection of one or more of the third keys based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

29. The method according to claim 23 or 27, characterized in that, The first device generates one or more second keys based on one or more first keys, thereby generating one or more first protection keys and / or second protection keys, or generates one or more first protection keys and / or second protection keys based on one or more first keys; One or more of the third keys are used for decryption and / or integrity verification based on one or more of the first keys, or based on one or more of the second keys, or based on one or more of the first protection keys and / or the second protection keys.

30. The method according to claim 25, characterized in that, The first message also carries the algebra of the first key; and / or, the second message also carries the algebra of the third key updated by the first entity.

31. The method according to any one of claims 23-30, characterized in that, The method further includes: Store the third key and / or update the algebra of the third key.

32. The method according to claim 23, characterized in that, The first message also carries the location of the third key, and the method further includes: The third key is stored according to its location.

33. The method according to claim 23, characterized in that, The first message also carries a cryptographic module identifier, and the method further includes: Generate one or more of the third keys for the cryptographic module identified by the cryptographic module identifier.

34. The method according to claim 28 or 29, characterized in that, For each of the first key, or each of the second key, or each of the first protection key and / or each of the second protection key, the number of the third keys for encryption and / or integrity protection is less than or equal to the second threshold.

35. The method according to claim 23, characterized in that, The second message also carries first information for encryption and / or integrity protection; The first information is related to the third key, and the first information and the third key are encrypted and / or protected for integrity using the same key.

36. The method according to claim 23, characterized in that, The first key is determined by the first device when the first condition is met, and / or the first message is sent by the first device when the first condition is met; The first condition includes: The number of keys already used in the key pool is greater than or equal to the third threshold; And / or, the number of unused keys in the key pool is less than or equal to a fourth threshold.

37. The method according to claim 36, characterized in that, The third threshold and / or the fourth threshold are set for the total number of keys, or for the number of keys of each type.

38. The method according to claim 37, characterized in that, The type of key is distinguished based on one or more of the following: key length, function, purpose, effect, and time.

39. The method according to claim 36, characterized in that, The first condition is determined while the first device is processing the first service.

40. The method according to claim 25, characterized in that, The method further includes: Store the algebra of the keys in the key pool.

41. The method according to claim 25 or 40, characterized in that, The keys configured offline in the key pool are first-generation keys.

42. The method according to claim 25 or 40, characterized in that, Next-generation keys use the previous generation keys for encryption and / or integrity protection.

43. The method according to claim 42, characterized in that, The first key is the previous generation key of the third key, and the third key is the next generation key of the first key.

44. A first device, characterized in that, It includes a first processor, a first memory, and a first communication bus; The first communication bus is used to establish a communication connection between the first processor and the first memory; The first processor is configured to execute one or more computer programs stored in the first memory to implement the communication method according to any one of claims 1-22.

45. A first entity, characterized in that, include: Second processor, second memory, and second communication bus; The second communication bus is used to establish a communication connection between the second processor and the second memory; The second processor is configured to execute one or more computer programs stored in the second memory to implement the communication method according to any one of claims 23-43.

46. ​​A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the communication method as described in any one of claims 1-43.

47. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the communication method as described in any one of claims 1-43.

Images