Unmanned seal system and unmanned seal method based on unmanned seal system

Abstract

The invention discloses an unmanned seal using system, an unmanned seal using method based on the unmanned seal using system, and the field of information security and Internet of Things cross technology, and the method comprises the steps: a management platform carries out the verification of a seal using application, obtains a quantum session key from a key generation center if the verification is passed, generates first encrypted data, and carries out the verification of the seal using application; sending the first encrypted data and the quantum session key identifier to an access control; the entrance guard verifies the identity of the user, verifies the first encrypted data if the verification is passed, generates second encrypted data if the verification is passed, and sends the second encrypted data and the quantum session key identifier to the seal container; the seal container verifies the second encrypted data, if the verification is passed, third encrypted data is generated, and the third encrypted data and the quantum session key identifier are sent to the seal device; and the seal equipment verifies the third encrypted data, and if the verification is passed, seal using operation is executed. According to the method, the intelligence and the safety in the unmanned seal using process are improved.

Description

Unmanned Seal System and Unmanned Seal Method Based on Unmanned Seal System Technical Field

[0001] This application belongs to the field of information security and Internet of Things technology, specifically relating to an unmanned seal system and an unmanned seal method based on the unmanned seal system. Background Technology

[0002] With the development of e-government, smart office, and intelligent manufacturing, official seals, as important legal credentials for organizations' daily management and external affairs, are gradually transforming from traditional manual management to intelligent and unmanned operation. While existing unmanned seal-using solutions can achieve partial automation through access control systems, smart cabinets, and other devices, they still suffer from the following problems: 1. Complex identity authentication and difficulty in establishing trust: Traditional systems rely on device certificates or centralized key management, making it difficult to establish trusted relationships directly between devices, resulting in a cumbersome and inefficient authentication process.

[0003] 2. Insufficient data credibility: During the issuance and transmission of equipment instructions, they are susceptible to tampering, forgery, or man-in-the-middle attacks, affecting the credibility of the seal instructions.

[0004] 3. Lack of forward security: In the existing scheme, once the key is leaked, historical communication data will be at risk of decryption, and forward confidentiality cannot be guaranteed.

[0005] 4. Unclear device permission boundaries: The permission division between devices in the existing system is not clear, which can easily lead to security risks such as unauthorized use and illegal access.

[0006] Therefore, there is an urgent need for a safe and reliable unmanned seal-using solution to improve the intelligence and security of the unmanned seal-using process. Summary of the Invention

[0007] In view of the above problems, embodiments of this application are proposed to provide an unmanned stamping system and an unmanned stamping method based on the unmanned stamping system to overcome or at least partially solve the above problems.

[0008] To address the aforementioned technical problems, this application provides the following: Firstly, this application provides an unmanned seal-using system, comprising: a management platform, configured to respond to a user's seal-using application, review the application, and if the review is successful, obtain a quantum session key from a key generation center, generate first encrypted data based on the quantum session key, and send the first encrypted data and a quantum session key identifier to an access control system; the first encrypted data includes first encrypted business data and first encrypted instruction data; the access control system is configured to authenticate the user, and if the authentication is successful, verify the first encrypted data based on the quantum session key identifier; ... A second encrypted data is generated using a session key, and the second encrypted data and the quantum session key identifier are sent to a seal container. The second encrypted data includes second encrypted business data and second encrypted instruction data. The seal container is used to verify the second encrypted data based on the quantum session key identifier. If the verification is successful, a third encrypted data is generated based on the quantum session key, and the third encrypted data and the quantum session key identifier are sent to a seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data. The seal device is used to verify the third encrypted data based on the quantum session key identifier. If the verification is successful, a seal application operation is performed.

[0009] Secondly, this application provides a method for unmanned seal use based on an unmanned seal system, comprising: a management platform responding to a user's seal application, reviewing the application, and if the review is successful, obtaining a quantum session key from a key generation center, generating first encrypted data based on the quantum session key, and sending the first encrypted data and a quantum session key identifier to an access control system; the first encrypted data includes first encrypted business data and first encrypted instruction data; the access control system authenticates the user, and if the authentication is successful, verifies the first encrypted data based on the quantum session key identifier, and if the authentication is successful, generates a quantum session key based on the quantum session key identifier. The second encrypted data, including second encrypted business data and second encrypted instruction data, is sent to the seal container along with the quantum session key identifier. The seal container verifies the second encrypted data based on the quantum session key identifier. If the verification is successful, a third encrypted data is generated based on the quantum session key, and the third encrypted data, along with the quantum session key identifier, is sent to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data. The seal device verifies the third encrypted data based on the quantum session key identifier. If the verification is successful, the seal application operation is performed.

[0010] In one or more embodiments, generating the first encrypted data based on the quantum session key includes: a management platform generating initial business data and first initial instruction data, and signing the initial business data and the first initial instruction data using a preset management platform private key to obtain target business data and first target instruction data; performing key negotiation with the access control system based on the quantum session key to derive a first data encryption key; encrypting the target business data and the first target instruction data using the first data encryption key to obtain the first encrypted data; the first encrypted data includes the first encrypted business data and the first encrypted instruction data.

[0011] In one or more embodiments, the verification of the first encrypted data based on the quantum session key identifier includes: the access control system obtaining the quantum session key from the key generation center using the quantum session key identifier; using the quantum session key to negotiate a key with the management platform to derive a first data encryption key; using the first data encryption key to decrypt the first encrypted data to obtain target business data and first target instruction data; and using a preset system public key to verify the signature in the first target instruction data.

[0012] In one or more embodiments, generating second encrypted data based on the quantum session key includes: the access control system generating second initial instruction data and signing the second initial instruction data using a preset access control private key to obtain second target instruction data; using the quantum session key to perform key negotiation with the seal container to derive a second data encryption key; using the second data encryption key to encrypt the target business data and the second target instruction data to obtain second encrypted data; the second encrypted data includes second encrypted business data and second encrypted instruction data.

[0013] In one or more embodiments, the seal container verifies the second encrypted data based on the quantum session key identifier, including: the seal container obtaining the quantum session key from the key generation center using the quantum session key identifier; using the quantum session key to perform key negotiation with the access control to derive a second data encryption key; using the second data encryption key to decrypt the second encrypted data to obtain target business data and second target instruction data; and using a preset system public key to verify the signature in the second target instruction data.

[0014] In one or more embodiments, generating third encrypted data based on the quantum session key includes: the seal container generating third initial instruction data and signing the second initial instruction data using a preset seal container private key to obtain third target instruction data; using the quantum session key to perform key negotiation with the seal device to derive a third data encryption key; using the third data encryption key to encrypt the target business data and the third target instruction data to obtain third encrypted data; the third encrypted data includes third encrypted business data and the third encrypted instruction data.

[0015] In one or more embodiments, the stamping device verifies the third encrypted data based on the quantum session key identifier, including: the stamping device obtaining the quantum session key from the key generation center using the quantum session key identifier; using the quantum session key to perform key negotiation with the stamping device to derive a third data encryption key; using the third data encryption key to decrypt the third encrypted data to obtain target business data and third target instruction data; using a preset system public key to verify the signature in the third target instruction data; if the verification is successful, then using the system public key to verify the signature in the target business data.

[0016] In one or more embodiments, before the management platform responds to a user's seal application, the method further includes: the key generation center establishing a connection with the management platform, the access control system, the seal container, and the seal device; the key generation center generating a system key pair and sending the system public key in the system key pair to the management platform, the access control system, the seal container, and the seal device respectively; the key generation center generating a management platform private key, an access control system private key, a seal container private key, and a seal device private key based on the system private key in the system key pair, and sending the management platform private key to the management platform, the access control system private key to the access control system, the seal container private key to the seal container, and the seal device private key to the seal device.

[0017] In one or more embodiments, the key generation center generates a management platform private key, an access control private key, a seal container private key, and a seal device private key based on the system private key in the system key pair, including: the management platform generating a first private key request based on a management platform identifier and sending the first private key request to the key generation center; the access control generating a second private key request based on an access control identifier and sending the second private key request to the key generation center; the seal container generating a third private key request based on a seal container identifier and sending the third private key request to the key generation center; and the seal device generating a fourth private key request based on a seal device identifier and sending the fourth private key request to the key generation center; the key generation center uses the management platform identifier and the system private key to generate a management platform private key, uses the access control identifier and the system private key to generate an access control private key, uses the seal container identifier and the system private key to generate a seal container private key, and uses the seal device identifier and the system private key to generate a seal device private key.

[0018] The embodiments of this application include the following advantages: the management platform uses quantum key encryption to enable instruction data and business data to be verified and forwarded level by level between access control, seal container and seal device, ensuring the integrity and confidentiality of data in the entire link transmission.

[0019] Furthermore, the temporary data encryption key is generated through SM9 key negotiation combined with quantum session key between the access control and the seal container, and between the seal container and the seal device. This key is valid within the current authorization period, which not only avoids the risk of key leakage caused by long-term use, but also saves key consumption by using the same quantum session key for each process.

[0020] Furthermore, the management platform is responsible for approval and one-time authorization, with subsequent secure calls completed between devices. This architectural approach defines the responsibilities of the management platform and other devices, forming clear permission boundaries. Even if historical keys are leaked, previous communication content cannot be decrypted, ensuring forward security. At the same time, the verification and signature chain between devices prevents instructions from being tampered with or forged.

[0021] In this way, through centralized review by the management platform and a hierarchical security trust mechanism between devices, the problems of cumbersome identity authentication between multiple devices, difficulty in establishing trust relationships, insufficient data credibility, lack of forward security, and unclear device permission boundaries in unattended environments are effectively solved. Attached Figure Description

[0022] Figure 1 is a schematic diagram of the overall architecture of an unmanned seal system according to this application; Figure 2 is a flowchart of the steps of an embodiment of an unmanned seal method according to this application; Figure 3 is a flowchart of the steps of an embodiment of an unmanned seal method according to this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0025] The embodiments of this application will be described in detail below with reference to the accompanying drawings and specific examples and application scenarios.

[0026] One of the core concepts of this application is that the management platform uses quantum key encryption to enable instruction data and business data to be verified and forwarded level by level between access control, seal container and seal device, ensuring the integrity and confidentiality of data in the entire link transmission.

[0027] Furthermore, the temporary data encryption key is generated through SM9 key negotiation combined with quantum session key between the access control and the seal container, and between the seal container and the seal device. This key is valid within the current authorization period, which not only avoids the risk of key leakage caused by long-term use, but also saves key consumption by using the same quantum session key for each process.

[0028] Furthermore, the management platform is responsible for approval and one-time authorization, with subsequent secure calls completed between devices. This architectural approach defines the responsibilities of the management platform and other devices, forming clear permission boundaries. Even if historical keys are leaked, previous communication content cannot be decrypted, ensuring forward security. At the same time, the verification and signature chain between devices prevents instructions from being tampered with or forged.

[0029] Referring to Figure 1, a schematic diagram of the overall architecture of an unmanned seal-using system according to this application is shown. Specifically, it includes: a management platform, used to respond to user seal-using applications, review the applications, and if the review is successful, obtain a quantum session key from a key generation center, generate first encrypted data based on the quantum session key, and send the first encrypted data and a quantum session key identifier to an access control system; the first encrypted data includes first encrypted business data and first encrypted instruction data; the access control system is used to authenticate the user, and if the authentication is successful, verify the first encrypted data based on the quantum session key identifier. If the authentication is successful, generate a quantum session key identifier based on the quantum session key. The second encrypted data, including second encrypted business data and second encrypted instruction data, is sent to the seal container along with the quantum session key identifier. The seal container verifies the second encrypted data based on the quantum session key identifier. If the verification is successful, it generates third encrypted data based on the quantum session key and sends the third encrypted data and the quantum session key identifier to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data. The seal device verifies the third encrypted data based on the quantum session key identifier. If the verification is successful, it performs a seal application operation.

[0030] Furthermore, the key generation center, management platform, and unmanned stamping room can all be interconnected via a quantum-secure authentication channel. This quantum-secure authentication channel is a highly reliable communication channel built on a secure medium, ensuring the confidentiality, integrity, and authentication of data transmission.

[0031] In this embodiment, the management platform uses quantum key encryption to enable instruction data and business data to be verified and forwarded level by level between access control, seal container and seal device, ensuring the integrity and confidentiality of data in the entire link transmission.

[0032] Furthermore, the generation of temporary data encryption keys between the access control system and the seal container, and between the seal container and the seal device, is achieved through quantum session keys, which are valid within the current authorization period. This not only avoids the risk of key leakage caused by long-term use, but also saves key consumption by using the same quantum session key for each process.

[0033] Furthermore, the management platform is responsible for approval and one-time authorization, with subsequent secure calls completed between devices. This architectural approach defines the responsibilities of the management platform and other devices, forming clear permission boundaries. Even if historical keys are leaked, previous communication content cannot be decrypted, ensuring forward security. At the same time, the verification and signature chain between devices prevents instructions from being tampered with or forged.

[0034] In this way, through centralized review by the management platform and a hierarchical security trust mechanism between devices, the problems of cumbersome identity authentication between multiple devices, difficulty in establishing trust relationships, insufficient data credibility, lack of forward security, and unclear device permission boundaries in unattended environments are effectively solved.

[0035] Referring to Figure 2, a flowchart of a step-by-step method for unmanned stamping according to an embodiment of this application is shown, which may include the following steps: Step 201, the management platform responds to the user's stamping application, reviews the stamping application, and if the review is approved, obtains a quantum session key from the key generation center, generates first encrypted data based on the quantum session key, and sends the first encrypted data and the quantum session key identifier to the access control; the first encrypted data includes first encrypted business data and first encrypted instruction data.

[0036] Users who need to use a seal can initiate a seal application in the management platform. After receiving the application, the management platform can review it. If the review is approved, the management platform can generate business data (denoted as "initial business data") and instruction data (denoted as "first initial instruction data"). Then, it uses the management platform's private key stored in the management platform to sign the business data, obtaining the signed business data (denoted as "target business data"). Additionally, it uses the management platform's private key to sign the first initial instruction data, obtaining the signed instruction data (denoted as "first target instruction data").

[0037] Meanwhile, the management platform can send a request to the key generation center to obtain a quantum session key. Once the key generation center receives the request, it can generate a quantum session key and send it to the management platform.

[0038] After obtaining the quantum session key, the management platform can use the quantum session key to negotiate the SM9 key with the access control system, thereby deriving the data encryption key (denoted as the "first data encryption key").

[0039] Then, the target business data and the first target instruction data are encrypted using the first data encryption key, respectively, to obtain encrypted business data (denoted as "first encrypted business data") and encrypted instruction data (denoted as "first encrypted instruction data"). The first encrypted business data and the first encrypted instruction data are then integrated to obtain integrated encrypted data (denoted as "first encrypted data"). Finally, the first encrypted data and the identifier of the quantum session key (denoted as "quantum session key identifier") are sent to the access control system.

[0040] The instruction data generated by the management platform is used to execute the stamping process.

[0041] Furthermore, after generating the quantum session key, the key generation center can encrypt the quantum session key using the charging key already stored in the secure medium to obtain the encrypted quantum session key, and then send the encrypted quantum session key to the management platform. After obtaining the encrypted quantum session key, the management platform can decrypt it using the same charging key to obtain the quantum session key. Of course, in practical applications, whether or not encryption is required during the transmission of the quantum session key can be set according to actual needs, and this application embodiment does not impose any restrictions on this.

[0042] Step 202: The access control system authenticates the user. If the authentication is successful, the first encrypted data is authenticated based on the quantum session key identifier. If the authentication is successful, the second encrypted data is generated based on the quantum session key, and the second encrypted data and the quantum session key identifier are sent to the seal container. The second encrypted data includes second encrypted business data and second encrypted instruction data.

[0043] When a user arrives at the access control system, the system can authenticate the user, such as through facial recognition or fingerprint recognition. Once authentication is successful, the access control system can use the acquired quantum session key identifier to initiate a request to the key generation center to obtain the quantum session key. Upon receiving the request, the key generation center can then send the corresponding quantum session key to the access control system.

[0044] The access control system uses a quantum session key to negotiate an SM9 key with the management platform, thereby deriving a first data encryption key. The first encrypted data is then decrypted using this first data encryption key to obtain the target business data and the first target instruction data.

[0045] The access control system uses the stored system public key to verify the signature in the first target instruction data. If the verification is successful, the access control system can generate instruction data (denoted as "second initial instruction data") and use the stored access control private key to sign the second initial instruction data to obtain the signed instruction data (denoted as "second target instruction data").

[0046] Then, the quantum session key is used to negotiate an SM9 key with the seal container to derive a data encryption key (denoted as the "second data encryption key"). The second data encryption key is then used to encrypt the target business data and the second target instruction data, respectively, resulting in encrypted business data (denoted as the "second encrypted business data") and encrypted instruction data (denoted as the "second encrypted instruction data"). The second encrypted business data and the second encrypted instruction data are then integrated to obtain the integrated encrypted data (denoted as the "second encrypted data"). Finally, the second encrypted data and the quantum session key identifier are sent to the seal container.

[0047] Among them, a seal container is a container for holding seals, such as a seal cabinet.

[0048] Step 203: The seal container verifies the second encrypted data based on the quantum session key identifier. If the verification is successful, it generates third encrypted data based on the quantum session key and sends the third encrypted data and the quantum session key identifier to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data.

[0049] After obtaining the second encrypted data and the identifier of the quantum session key, the seal container can use the obtained quantum session key identifier to initiate a quantum session key acquisition request to the key generation center. After receiving the acquisition request, the key generation center can send the corresponding quantum session key to the seal container.

[0050] The seal container uses a quantum session key to negotiate an SM9 key with the access control system, thereby deriving a second data encryption key. The second encrypted data is then decrypted using this second data encryption key to obtain the target business data and the second target instruction data.

[0051] The seal container uses the stored system public key to verify the signature in the second target instruction data. If the verification is successful, the seal container can generate instruction data (denoted as "third initial instruction data") and use the stored seal container private key to sign the third initial instruction data to obtain the signed instruction data (denoted as "third target instruction data").

[0052] Then, the quantum session key is used to negotiate an SM9 key with the seal device to derive a data encryption key (denoted as the "third data encryption key"). This third data encryption key is then used to encrypt both the target business data and the third target instruction data, resulting in encrypted business data (denoted as the "third encrypted business data") and encrypted instruction data (denoted as the "third encrypted instruction data"). These three encrypted data are then integrated to obtain the integrated encrypted data (denoted as the "third encrypted data"). Finally, the third encrypted data and the quantum session key identifier are sent to the seal container.

[0053] Among them, the seal equipment is the equipment used for stamping and sealing.

[0054] Step 204: The stamping device verifies the third encrypted data based on the quantum session key identifier. If the verification is successful, the stamping operation is performed.

[0055] After obtaining the third encrypted data and the identifier of the quantum session key, the seal device can use the obtained quantum session key identifier to initiate a quantum session key acquisition request to the key generation center. After receiving the acquisition request, the key generation center can send the corresponding quantum session key to the seal device.

[0056] The seal device uses a quantum session key to negotiate an SM9 key with the seal container, thereby deriving a third data encryption key. This third data encryption key is then used to decrypt the third encrypted data, yielding the target business data and the third target instruction data.

[0057] The stamping device uses the stored system public key to verify the signature in the third-party target instruction data. If the verification passes, the system public key can then be used to verify the signature in the target business data. If the verification also passes, the stamping operation can then be performed.

[0058] In this embodiment, the management platform uses quantum key encryption to enable instruction data and business data to be verified and forwarded level by level between access control, seal container and seal device, ensuring the integrity and confidentiality of data in the entire link transmission.

[0059] Furthermore, the temporary data encryption key is generated through SM9 key negotiation combined with quantum session key between the access control and the seal container, and between the seal container and the seal device. This key is valid within the current authorization period, which not only avoids the risk of key leakage caused by long-term use, but also saves key consumption by using the same quantum session key for each process.

[0060] Furthermore, the management platform is responsible for approval and one-time authorization, with subsequent secure calls completed between devices. This architectural approach defines the responsibilities of the management platform and other devices, forming clear permission boundaries. Even if historical keys are leaked, previous communication content cannot be decrypted, ensuring forward security. At the same time, the verification and signature chain between devices prevents instructions from being tampered with or forged.

[0061] In this way, through centralized review by the management platform and a hierarchical security trust mechanism between devices, the problems of cumbersome identity authentication between multiple devices, difficulty in establishing trust relationships, insufficient data credibility, lack of forward security, and unclear device permission boundaries in unattended environments are effectively solved.

[0062] Referring to Figure 3, a flowchart of a second embodiment of the unmanned seal-using method of the present invention is shown, which may specifically include the following steps: Step 301, the key generation center establishes a connection with the management platform, the access control system, the seal container and the seal device.

[0063] Step 302: The key generation center generates a system key pair and sends the system public key in the system key pair to the management platform, the access control system, the seal container, and the seal device, respectively.

[0064] Step 303: The key generation center generates a management platform private key, an access control private key, a seal container private key, and a seal device private key based on the system private key in the system key pair, and sends the management platform private key to the management platform, the access control private key to the access control system, the seal container private key to the seal container, and the seal device private key to the seal device.

[0065] Specifically, during the system initialization phase, the key generation center can establish connections with the management platform, access control system, seal container, and seal device, respectively. Each of these components—key generation center, management platform, access control system, seal container, and seal device—contains a secure medium pre-stored with multiple charging keys. The secure medium can be a SIM (Subscriber Identification Module) card or a TF card, etc., and can be configured according to actual needs in practical applications; this embodiment does not impose any limitations on this.

[0066] Once the connection is successfully established, the key generation center can generate a system key pair, which includes a system private key and a system public key. The system private key can be generated using a quantum random number generator. The system key is then broken down and sent to the management platform, access control system, seal container, and seal device respectively.

[0067] After the management platform, access control, seal container, and seal device obtain the system public key, each device can select a refill key from its local refill key, and then generate a device private key request by combining it with the device identifier, and send it to the key generation center.

[0068] Specifically, the management platform selects a charging key locally, combines the identifier of the charging key with the device identifier of the management platform (denoted as "management platform identifier") to generate a private key request (denoted as "first private key request"), and sends the first private key request to the key generation center; the access control system selects a charging key locally, combines the identifier of the charging key with the device identifier of the access control system (denoted as "access control identifier") to generate a private key request (denoted as "second private key request"), and sends the second private key request to the key generation center; the seal container selects a charging key locally, combines the identifier of the charging key with the device identifier of the seal container (denoted as "seal container identifier") to generate a private key request (denoted as "third private key request"), and sends the third private key request to the key generation center; and the seal device selects a charging key locally, combines the identifier of the charging key with the device identifier of the seal device (denoted as "seal device identifier") to generate a private key request (denoted as "fourth private key request"), and sends the fourth private key request to the key generation center.

[0069] After receiving each private key request, the key generation center generates the corresponding device private key using each device identifier and the system private key.

[0070] That is, the device private key of the management platform (denoted as "management platform private key") is generated using the management platform identifier and the system private key; the device private key of the access control system (denoted as "access control private key") is generated using the access control identifier and the system private key; the device private key of the seal container (denoted as "seal container private key") is generated using the seal container identifier and the system private key; and the device private key of the seal device (denoted as "seal device private key") is generated using the seal device identifier and the system private key.

[0071] Then, the management platform private key is sent to the management platform, the access control private key is sent to the access control system, the seal container private key is sent to the seal container, and the seal device private key is sent to the seal device.

[0072] It should be noted that when the key generation center sends the device private key to each device, it can encrypt the device private key using the corresponding charging key for each device, thus obtaining the device private key for each device. After each device obtains its corresponding encrypted device private key, it decrypts it using the charging key to obtain the device private key. In practical applications, whether or not encryption is required for transmitting the device private key can be set according to actual needs, and this application embodiment does not impose any restrictions on this.

[0073] Step 304: The management platform responds to the user's seal application, reviews the seal application, and if the review is approved, obtains the quantum session key from the key generation center, generates first encrypted data based on the quantum session key, and sends the first encrypted data and the quantum session key identifier to the access control system; the first encrypted data includes first encrypted business data and first encrypted instruction data.

[0074] Step 305: The access control system authenticates the user. If the authentication is successful, the first encrypted data is authenticated based on the quantum session key identifier. If the authentication is successful, second encrypted data is generated based on the quantum session key, and the second encrypted data and the quantum session key identifier are sent to the seal container. The second encrypted data includes second encrypted business data and second encrypted instruction data.

[0075] Step 306: The seal container verifies the second encrypted data based on the quantum session key identifier. If the verification is successful, it generates third encrypted data based on the quantum session key and sends the third encrypted data and the quantum session key identifier to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data.

[0076] Step 307: The stamping device verifies the third encrypted data based on the quantum session key identifier. If the verification is successful, the stamping operation is performed.

[0077] Steps 304 to 307 are essentially the same as steps 201 to 204, and will not be repeated here to avoid repetition.

[0078] In this embodiment, the user, management platform, access control, seal container, and seal device all use identification information as public keys, avoiding the complex management of traditional certificate systems and achieving fast and reliable identity authentication.

[0079] Moreover, the management platform uses quantum key encryption to ensure that instruction data and business data are verified and forwarded step by step between access control, seal containers and seal devices, thus ensuring the integrity and confidentiality of data during the entire transmission chain.

[0080] Furthermore, between the access control system and the seal container, and between the seal container and the seal device, temporary data encryption keys are generated through SM9 key negotiation combined with quantum session keys, thus remaining valid within the current authorization period. This not only avoids the risk of key leakage caused by long-term use, but also saves key consumption by using the same quantum session key for each process.

[0081] Furthermore, the management platform is responsible for approval and one-time authorization, with subsequent secure calls completed between devices. This architectural approach defines the responsibilities of the management platform and other devices, forming clear permission boundaries. Even if historical keys are leaked, previous communication content cannot be decrypted, ensuring forward security. At the same time, the verification and signature chain between devices prevents instructions from being tampered with or forged.

[0082] In this way, through centralized review by the management platform and a hierarchical security trust mechanism between devices, the problems of cumbersome identity authentication between multiple devices, difficulty in establishing trust relationships, insufficient data credibility, lack of forward security, and unclear device permission boundaries in unattended environments are effectively solved.

[0083] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0084] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable terminal equipment, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0089] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0090] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0091] The embodiments provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An unmanned stamping system, characterized in that, include: The management platform responds to user applications for seal use, reviews the applications, and if approved, obtains a quantum session key from the key generation center, generates first encrypted data based on the quantum session key, and sends the first encrypted data and a quantum session key identifier to the access control system. The first encrypted data includes first encrypted business data and first encrypted instruction data. The access control system authenticates the user; if authentication is successful, it verifies the first encrypted data based on the quantum session key identifier. If authentication is successful, it generates second encrypted data based on the quantum session key and sends the second encrypted data and the quantum session key identifier to the seal container. The second encrypted data includes second encrypted business data and second encrypted instruction data. The seal container verifies the second encrypted data based on the quantum session key identifier. If authentication is successful, it generates third encrypted data based on the quantum session key and sends the third encrypted data and the quantum session key identifier to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data. The seal device verifies the third encrypted data based on the quantum session key identifier. If authentication is successful, it executes the seal application.

2. A method for unmanned stamping based on an unmanned stamping system, characterized in that, include: The management platform responds to a user's seal application, reviews the application, and if approved, obtains a quantum session key from the key generation center. Based on the quantum session key, it generates first encrypted data and sends the first encrypted data and a quantum session key identifier to the access control system. The first encrypted data includes first encrypted business data and first encrypted instruction data. The access control system authenticates the user. If authentication is successful, it verifies the first encrypted data based on the quantum session key identifier. If successful, it generates second encrypted data based on the quantum session key and sends the second encrypted data and the quantum session key identifier to the seal container. The second encrypted data includes second encrypted business data and second encrypted instruction data. The seal container verifies the second encrypted data based on the quantum session key identifier. If successful, it generates third encrypted data based on the quantum session key and sends the third encrypted data and the quantum session key identifier to the seal device. The third encrypted data includes third encrypted business data and third encrypted instruction data. The seal device verifies the third encrypted data based on the quantum session key identifier. If successful, it executes the seal application.

3. The unmanned stamping method according to claim 2, characterized in that, The step of generating the first encrypted data based on the quantum session key includes: the management platform generating initial business data and first initial instruction data, and signing the initial business data and the first initial instruction data using a preset management platform private key to obtain target business data and first target instruction data; performing key negotiation with the access control system based on the quantum session key to derive a first data encryption key; and encrypting the target business data and the first target instruction data using the first data encryption key to obtain the first encrypted data; the first encrypted data includes the first encrypted business data and the first encrypted instruction data.

4. The unmanned stamping method according to claim 2, characterized in that, The verification of the first encrypted data based on the quantum session key identifier includes: the access control system obtaining the quantum session key from the key generation center using the quantum session key identifier; using the quantum session key to negotiate a key with the management platform to derive a first data encryption key; using the first data encryption key to decrypt the first encrypted data to obtain target business data and first target instruction data; and using a preset system public key to verify the signature in the first target instruction data.

5. The unmanned stamping method according to claim 2, characterized in that, The step of generating second encrypted data based on the quantum session key includes: the access control system generating second initial instruction data and signing the second initial instruction data using a preset access control private key to obtain second target instruction data; using the quantum session key to perform key negotiation with the seal container to derive a second data encryption key; using the second data encryption key to encrypt the target business data and the second target instruction data to obtain second encrypted data; the second encrypted data includes second encrypted business data and second encrypted instruction data.

6. The unmanned stamping method according to claim 2, characterized in that, The seal container verifies the second encrypted data based on the quantum session key identifier, including: the seal container obtaining the quantum session key from the key generation center using the quantum session key identifier; using the quantum session key to negotiate a key with the access control system to derive a second data encryption key; using the second data encryption key to decrypt the second encrypted data to obtain target business data and second target instruction data; and using a preset system public key to verify the signature in the second target instruction data.

7. The unmanned stamping method according to claim 2, characterized in that, The step of generating third encrypted data based on the quantum session key includes: the seal container generating third initial instruction data and signing the second initial instruction data using a preset seal container private key to obtain third target instruction data; using the quantum session key to perform key negotiation with the seal device to derive a third data encryption key; and using the third data encryption key to encrypt the target business data and the third target instruction data to obtain third encrypted data; the third encrypted data includes third encrypted business data and the third encrypted instruction data.

8. The unmanned stamping method according to claim 2, characterized in that, The stamping device verifies the third encrypted data based on the quantum session key identifier, including: the stamping device obtaining the quantum session key from the key generation center using the quantum session key identifier; negotiating a key with the stamping device using the quantum session key to derive a third data encryption key; decrypting the third encrypted data using the third data encryption key to obtain target business data and third target instruction data; verifying the signature in the third target instruction data using a preset system public key; and if the verification passes, verifying the signature in the target business data using the system public key.

9. The unmanned stamping method according to claim 2, characterized in that, Before the management platform responds to a user's seal application, the process includes: the key generation center establishing a connection with the management platform, the access control system, the seal container, and the seal device; the key generation center generating a system key pair and sending the system public key from the system key pair to the management platform, the access control system, the seal container, and the seal device respectively; the key generation center generating a management platform private key, an access control system private key, a seal container private key, and a seal device private key based on the system private key from the system key pair, and sending the management platform private key to the management platform, the access control system private key to the access control system, the seal container private key to the seal container, and the seal device private key to the seal device.

10. The unmanned stamping method according to claim 9, characterized in that, The key generation center generates a management platform private key, an access control private key, a seal container private key, and a seal device private key based on the system private key in the system key pair. This includes: the management platform generating a first private key request based on a management platform identifier and sending the first private key request to the key generation center; the access control system generating a second private key request based on an access control identifier and sending the second private key request to the key generation center; the seal container generating a third private key request based on a seal container identifier and sending the third private key request to the key generation center; and the seal device generating a fourth private key request based on a seal device identifier and sending the fourth private key request to the key generation center. The key generation center uses the management platform identifier and the system private key to generate a management platform private key, uses the access control identifier and the system private key to generate an access control private key, uses the seal container identifier and the system private key to generate a seal container private key, and uses the seal device identifier and the system private key to generate a seal device private key.

Images