A configurable multi-mode hybrid key agreement system and method

Abstract

The application relates to network security and cryptography, in particular to a configurable multi-mode hybrid key agreement system and method, which comprises a local end, a peer end, a QKD network and a communication link, a hardware cryptographic device integrating a classical random number generator, a quantum random number generator and a QKD interface, and supporting generation of three types of keys; a business system can select working mode parameters through manual input or scene automatic mapping, the parameters control key enabling states through bit fields, and correspond to five modes of pure classic, pure quantum random number, full fusion, classic+QKD and quantum random number+QKD; the enabled keys are differentially packaged by using a classic national cryptographic algorithm / NIST PQC algorithm, the disabled keys are filled with zero value ciphertexts, and the peer end generates a final business key through exclusive or operation after decryption; the application realizes flexible trade-off of security strength, compliance requirements and performance cost, supports dynamic selection of key combination strategies by the business system according to scene requirements, is suitable for multiple industries and multiple scenes, and gives consideration to compatibility and foresight.

Description

Technical Field

[0001] This invention relates to network security and cryptography, specifically to a configurable multi-mode hybrid key negotiation system and method. Background Technology

[0002] With the rapid development of quantum computing technology, traditional public-key cryptography algorithms based on large number factorization and discrete logarithms face the risk of being cracked by quantum computers. Meanwhile, key industries are placing higher demands on key randomness, distribution security, resistance to quantum attacks, and flexibility in adapting to different scenarios. Existing key negotiation schemes have the following shortcomings:

[0003] 1) Relying solely on a single key type or fixed encryption strategy cannot defend against quantum computing attacks and is difficult to adapt to different security level requirements;

[0004] 2) The integration of quantum key distribution (QKD) networks, quantum random number devices and traditional cryptographic devices is mostly customized, resulting in long system deployment cycles, complex solutions, and high deployment and maintenance costs;

[0005] 3) The key encapsulation and decryption processes lack differentiated strategies, making it impossible to achieve a dynamic balance between security, compliance, and performance;

[0006] 4) The key generation and negotiation latency is relatively high, making it difficult to meet the requirements of high real-time business scenarios (such as high-frequency trading, edge computing, etc.);

[0007] 5) It lacks a unified parameter configuration and scenario adaptation mechanism, and cannot automatically match the optimal key combination according to the scenario identifier of the business system, resulting in insufficient compatibility and scalability.

[0008] Therefore, there is an urgent need for a hybrid key negotiation architecture that supports dynamic configuration of multiple modes, so as to achieve a flexible balance between security strength, compliance requirements, performance and cost, and adapt to the diverse needs of multiple industries and scenarios. Summary of the Invention

[0009] (a) Technical problems to be solved

[0010] In view of the above-mentioned shortcomings of the existing technology, the present invention provides a configurable multi-mode hybrid key negotiation system and method, which can effectively overcome the shortcomings of the existing technology that cannot achieve a flexible trade-off between security strength, compliance requirements, performance and cost, and is difficult to adapt to the diverse needs of multiple industries and multiple scenarios.

[0011] (II) Technical Solution

[0012] To achieve the above objectives, the present invention provides the following technical solution:

[0013] A configurable multi-mode hybrid key negotiation system includes a local end and a peer end, wherein the local end includes the following functional units:

[0014] The first business system, the system that actually processes business, achieves secure storage and transmission of important and sensitive data by calling the first hardware cryptographic device.

[0015] The first hardware cryptographic device is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms and NIST PQC algorithms, and the key management supports quantum keys, classical keys, and quantum keys distributed by QKD.

[0016] The first QKD device is a quantum secure communication device that achieves quantum key synchronization based on the principles of quantum undetectability and non-copyability.

[0017] The counterpart includes the following functional units:

[0018] The second business system is the system that actually processes data interaction, synchronization, uploading, and downloading with the first business system. It achieves secure storage and transmission of important and sensitive data by calling the second hardware cryptographic device.

[0019] The second hardware cryptographic device has the same structure and function as the first hardware cryptographic device. It is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms and NIST PQC algorithms. The key management supports quantum keys, classical keys and quantum keys distributed by QKD.

[0020] The second QKD device works in conjunction with the first QKD device to achieve synchronous generation of quantum keys.

[0021] Preferably, both the first hardware cryptographic device and the second hardware cryptographic device include the following functional modules:

[0022] The key encapsulation module provides a key negotiation interface to the business system, receives and parses the working mode parameters from the business system, generates corresponding enable signals, and receives the key / key offset from the key generation module. It then selects the appropriate cryptographic algorithm according to the enable signals for differentiated encapsulation to generate ciphertext.

[0023] The key generation module receives the enable signal from the key encapsulation module and generates the corresponding key / key offset according to the enable signal.

[0024] The key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects the appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key.

[0025] The key synthesis module receives keys from the key decryption and synthesis module and integrates them to generate the final business key.

[0026] Preferably, the key generation module receives an enable signal from the key encapsulation module and generates a corresponding key / key offset according to the enable signal, including:

[0027] The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by the key encapsulation module via QKD, and generates the corresponding key / key offset according to the enable signal:

[0028] When the quantum key offset of QKD distribution is enabled (Mask_QB=1), it connects to the QKD network, obtains the quantum key Kb distributed by QKD from the QKD network, and obtains the currently available key offset Offset_B as required. When disabled, it outputs a zero value.

[0029] When the classic key is enabled (Mask_C=1), the built-in WNG random source is started to generate the classic key Kc; when disabled, zero value is output.

[0030] When the quantum key is enabled (Mask_A=1), the built-in QRNG random source is activated to generate the quantum key Ka; when disabled, a zero value is output.

[0031] Preferably, the key encapsulation module receives the key / key offset from the key generation module, and selects an appropriate cryptographic algorithm for differentiated encapsulation according to the enable signal to generate ciphertext, including:

[0032] S11. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enabled Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A distributed by QKD:

[0033] For the key offset Offset_B, if the quantum key offset enabled Mask_QB=1 for QKD distribution, the NIST PQC algorithm is used for encapsulation to generate the key offset ciphertext C(Offset_B). Otherwise, the key offset ciphertext C(Offset_B) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent.

[0034] For the classic key Kc, if the classic key is enabled Mask_C=1, then the classic national cryptographic algorithm is used for encapsulation to generate the classic key ciphertext C(Kc); otherwise, the classic key ciphertext C(Kc) is filled with zero values ​​of a fixed length to ensure that the final ciphertext format is uniform.

[0035] For the quantum key Ka, if the quantum key enable Mask_A=1, the NIST PQC algorithm is used for encapsulation to generate the quantum key ciphertext C(Ka); otherwise, the quantum key ciphertext C(Ka) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent.

[0036] S12. Combining the key offset ciphertext C(Offset_B), the classical key ciphertext C(Kc), and the quantum key ciphertext C(Ka), generate ciphertext C:

[0037] C=M||C(Offset_B)||C(Kc)||C(Ka);

[0038] Where M is the pattern identifier field, which serves as the header identifier for the ciphertext C and is used to control the enabling / disabling of three different types of source keys. || represents the bit string concatenation operation.

[0039] Preferably, the key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects an appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key, including:

[0040] S21. The key decryption and synthesis module receives the ciphertext C and performs differential encapsulation using the corresponding cryptographic algorithms according to the quantum key offset enabled by QKD, enabling Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A:

[0041] For the key offset C(Offset_B) in ciphertext C, if the quantum key offset enabled Mask_QB=1 in QKD distribution, then the NIST PQC algorithm is used to decapsulate and restore the key offset Offset_B; otherwise, the key offset Offset_B is zero after decapsulation.

[0042] For the classical key ciphertext C(Kc) in the ciphertext C, if the classical key is enabled Mask_C=1, then the classical Chinese cryptographic algorithm is used to decapsulate and recover the classical key Kc; otherwise, the decapsulated classical key Kc is zero.

[0043] For the quantum key ciphertext C(Ka) in the ciphertext C, if the quantum key enable Mask_A=1, then the NIST PQC algorithm is used to decapsulate and generate the quantum key Ka; otherwise, the decapsulated quantum key Ka is zero.

[0044] S22. If the quantum key offset of QKD distribution is enabled (Mask_QB=1), then the complete QKD distributed quantum key Kb is obtained from the local QKD network according to the key offset (Offset_B). Otherwise, the QKD distributed quantum key Kb is set to zero, thereby extracting the QKD distributed quantum key Kb, classical key Kc, and quantum key Ka.

[0045] Preferably, the key synthesis module receives a key from the key decryption and synthesis module, and integrates them to generate the final business key, including:

[0046] The key synthesis module receives the quantum key Kb, classical key Kc, and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operations to generate the final business key K_final, which is used by the business system for subsequent symmetric encryption.

[0047] K_final=Kb⊕Kc⊕Ka;

[0048] Here, ⊕ represents the XOR operation. When a certain type of key is disabled, the XOR result is equivalent to using only the enabled key.

[0049] Preferably, it also includes a quantum key communication link, which is established between the first QKD device and the second QKD device and interconnected by optical fiber to achieve synchronous generation of quantum keys through physical transmission.

[0050] Preferably, it also includes a business data communication link, which is a conventional communication network connecting the servers of the first business system and the second business system, used to transmit business data and ciphertext. The business data communication link can share a fiber with the quantum key communication link to achieve secure data interaction using cryptographic technology based on mathematical principles.

[0051] A configurable multi-mode hybrid key negotiation method includes the following steps:

[0052] S1. The first business system on the local end sends working mode parameters to the key encapsulation module of the first hardware cryptographic device;

[0053] S2. The key encapsulation module receives and parses the working mode parameters from the first business system, generates a corresponding enable signal and sends it to the key generation module of the first hardware cryptographic device.

[0054] S3. The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C and quantum key enable Mask_A distributed by the key encapsulation module via QKD, generates the corresponding key offset Offset_B, classical key Kc and quantum key Ka according to the enable signals, and sends them to the key encapsulation module.

[0055] S4. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by QKD. Combining the key offset ciphertext C(Offset_B), classical key ciphertext C(Kc), and quantum key ciphertext C(Ka), it generates ciphertext C and sends it to the first business system.

[0056] S5. The first business system sends the encrypted text C to the second business system on the other end through the business data communication link.

[0057] S6. The key decryption and synthesis module of the second hardware cryptographic device receives the ciphertext C and selects the corresponding cryptographic algorithm for differential encapsulation according to the local QKD distributed quantum key offset enabling Mask_QB, classical key enabling Mask_C, and quantum key enabling Mask_A. At the same time, it decides whether to obtain the complete QKD distributed quantum key Kb from the local QKD network according to the quantum key offset enabling Mask_QB, and sends the quantum key Kb, classical key Kc, and quantum key Ka to the key synthesis module of the second hardware cryptographic device.

[0058] S7. The key synthesis module receives the quantum key Kb, classical key Kc and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operation to generate the final business key K_final.

[0059] (III) Beneficial Effects Compared with the prior art, the configurable multi-mode hybrid key negotiation system and method provided by the present invention have the following advantages: 1) Full-scenario coverage: Through 5 predefined working modes and reserved extension bits, it covers the entire spectrum of scenarios from pure classical compliance to full quantum security, adapting to the multi-industry and multi-scenario security level requirements; 2) Flexible configuration and adaptive: Supports both manual working mode parameter configuration and automatic scenario mapping modes, enabling working mode switching without modifying the business system, thus reducing operation and maintenance costs; 3) Balancing quantum security and compliance: The pure classical mode is fully compatible with existing national cryptographic standards, while the fully integrated mode balances compliance and resistance to quantum attacks, addressing the pain point that "compliance and security cannot be achieved simultaneously." 4) Resource optimization and cost control: Avoid unnecessary consumption of quantum resources (e.g., select working mode parameters 1 and 2 when there is no QKD network), and reduce deployment and operation costs; 5) High performance and low latency: Pure quantum random number mode does not require QKD network interaction, meeting the needs of high real-time services; 6) Strong compatibility and scalability: Supports the mixed use of national cryptographic algorithms and NIST PQC algorithms, and reserves working mode parameter bits to support future addition of key types, protecting the technological foresight and existing investments; 7) High security and reliability: Through pattern consistency verification, XOR / MAC operation, and unified ciphertext format, the security and stability of key negotiation are ensured, and the risk of configuration errors is reduced. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0061] Figure 1 This is a schematic diagram of the system of the present invention; Figure 2 This is a schematic diagram of the hardware cryptographic device in this invention; Figure 3 This is a schematic diagram of the system deployment of the present invention under the direct bank connection business. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0063] The following describes the specific architecture of the configurable multi-mode hybrid key negotiation system provided by this invention, using concrete examples (such as...). Figure 1 (as shown) and technical effects.

[0064] The system architecture includes a local end and a remote end. The local end includes the following functional units: The first business system, the system that actually processes business, achieves secure storage and transmission of important and sensitive data by calling the first hardware cryptographic device. The first hardware cryptographic device is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms (such as SM2) and NIST PQC algorithms (Kyber series, etc.). The key management supports quantum keys, classical keys, and quantum keys distributed by QKD. The first QKD device is a quantum secure communication device that achieves quantum key synchronization based on the principles of quantum undetectability and non-copyability. The peer end includes the following functional units: The second business system is the system that actually processes data interaction, synchronization, uploading, and downloading with the first business system. It achieves secure storage and transmission of important and sensitive data by calling the second hardware cryptographic device. The second hardware cryptographic device has the same structure and function as the first hardware cryptographic device. It is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms (such as SM2) and NIST PQC algorithms (Kyber series, etc.). The key management supports quantum keys, classical keys and quantum keys distributed by QKD. The second QKD device works in conjunction with the first QKD device to achieve synchronous generation of quantum keys.

[0065] In the technical solution of this application, the first hardware cryptographic device and the second hardware cryptographic device are the core execution units of the local end and the peer end, respectively. The first hardware cryptographic device and the second hardware cryptographic device will be described in detail below.

[0066] like Figure 2 As shown, both the first hardware cryptographic device and the second hardware cryptographic device include the following functional modules: The key encapsulation module provides a key negotiation interface to the business system, receives and parses the working mode parameters from the business system, generates corresponding enable signals, and receives the key / key offset from the key generation module. It then selects the appropriate cryptographic algorithm according to the enable signals for differentiated encapsulation to generate ciphertext. The key generation module receives the enable signal from the key encapsulation module and generates the corresponding key / key offset according to the enable signal. The key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects the appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key. The key synthesis module receives keys from the key decryption and synthesis module and integrates them to generate the final business key.

[0067] 1) Key generation module The key generation module receives an enable signal from the key encapsulation module and generates the corresponding key / key offset according to the enable signal, including: The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by the key encapsulation module via QKD, and generates the corresponding key / key offset according to the enable signal: When the quantum key offset of QKD distribution is enabled (Mask_QB=1), it connects to the QKD network, obtains the quantum key Kb distributed by QKD from the QKD network, and obtains the currently available key offset Offset_B as required. When disabled, it outputs a zero value. When the classic key is enabled (Mask_C=1), the built-in WNG random source is started to generate the classic key Kc; when disabled, zero value is output. When the quantum key is enabled (Mask_A=1), the built-in QRNG random source is activated to generate the quantum key Ka; when disabled, a zero value is output.

[0068] 2) Key Encapsulation Module The key encapsulation module receives the key / key offset from the key generation module and selects the appropriate cryptographic algorithm for differential encapsulation according to the enable signal to generate ciphertext, including: S11. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enabled Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A distributed by QKD: For the key offset Offset_B, if the quantum key offset enabled Mask_QB=1 for QKD distribution, the NIST PQC algorithm is used for encapsulation to generate the key offset ciphertext C(Offset_B). Otherwise, the key offset ciphertext C(Offset_B) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent. For the classic key Kc, if the classic key is enabled Mask_C=1, then the classic national cryptographic algorithm is used for encapsulation to generate the classic key ciphertext C(Kc); otherwise, the classic key ciphertext C(Kc) is filled with zero values ​​of a fixed length to ensure that the final ciphertext format is uniform. For the quantum key Ka, if the quantum key enable Mask_A=1, the NIST PQC algorithm is used for encapsulation to generate the quantum key ciphertext C(Ka); otherwise, the quantum key ciphertext C(Ka) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent. S12. Combining the key offset ciphertext C(Offset_B), the classical key ciphertext C(Kc), and the quantum key ciphertext C(Ka), generate ciphertext C: C=M||C(Offset_B)||C(Kc)||C(Ka); M is the pattern identifier field (the pattern identifier field is not a fixed value, but is variable, such as 0x01, 0x02, 0x03, 0x04, 0x05, etc.), which serves as the header identifier of the ciphertext C and is used to control the enabling / disabling of three different types of source keys. || represents the bit string concatenation operation.

[0069] 3) Key decryption and synthesis module The key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects the appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key, including: S21. The key decryption and synthesis module receives the ciphertext C and performs differential encapsulation using the corresponding cryptographic algorithms according to the quantum key offset enabled by QKD, enabling Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A: For the key offset C(Offset_B) in ciphertext C, if the quantum key offset enabled Mask_QB=1 in QKD distribution, then the NIST PQC algorithm is used to decapsulate and restore the key offset Offset_B; otherwise, the key offset Offset_B is zero after decapsulation. For the classical key ciphertext C(Kc) in the ciphertext C, if the classical key is enabled Mask_C=1, then the classical Chinese cryptographic algorithm is used to decapsulate and recover the classical key Kc; otherwise, the decapsulated classical key Kc is zero. For the quantum key ciphertext C(Ka) in the ciphertext C, if the quantum key enable Mask_A=1, then the NIST PQC algorithm is used to decapsulate and generate the quantum key Ka; otherwise, the decapsulated quantum key Ka is zero. S22. If the quantum key offset of QKD distribution is enabled (Mask_QB=1), then the complete QKD distributed quantum key Kb is obtained from the local QKD network according to the key offset (Offset_B). Otherwise, the QKD distributed quantum key Kb is set to zero, thereby extracting the QKD distributed quantum key Kb, classical key Kc, and quantum key Ka.

[0070] 4) Key synthesis module The key synthesis module receives keys from the key decryption and synthesis module, integrates them to generate the final business key, including: The key synthesis module receives the quantum key Kb, classical key Kc, and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operations to generate the final business key K_final, which is used by the business system for subsequent symmetric encryption (such as AES-128-GCM, SM4-GCM, etc.). K_final=Kb⊕Kc⊕Ka; Here, ⊕ represents the XOR operation. When a certain type of key is disabled, the XOR result is equivalent to using only the enabled key.

[0071] In the technical solution of this application, the working mode parameters are encoded using 8-bit unsigned integers, and the enable states of various keys are controlled through bit fields, as specifically defined in Table 1: Table 1 Working Mode Parameters and Scenario Adaptation Table

[0072]

[0073] The technical solution of this application also includes a quantum key communication link, which is established between the first QKD device and the second QKD device and interconnected by optical fiber to realize the synchronous generation of quantum keys through physical transmission.

[0074] The technical solution of this application also includes a business data communication link, which is a conventional communication network connecting the servers of the first business system and the second business system. It is used to transmit business data and ciphertext. The business data communication link can share a fiber with the quantum key communication link to achieve secure data interaction using cryptographic technology based on mathematical principles.

[0075] Based on the configurable multi-mode hybrid key negotiation system disclosed above, this invention also discloses a configurable multi-mode hybrid key negotiation method, comprising the following steps: S1. The first business system on the local end sends working mode parameters to the key encapsulation module of the first hardware cryptographic device; S2. The key encapsulation module receives and parses the working mode parameters from the first business system, generates a corresponding enable signal and sends it to the key generation module of the first hardware cryptographic device. S3. The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C and quantum key enable Mask_A distributed by the key encapsulation module via QKD, generates the corresponding key offset Offset_B, classical key Kc and quantum key Ka according to the enable signals, and sends them to the key encapsulation module. S4. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by QKD. Combining the key offset ciphertext C(Offset_B), classical key ciphertext C(Kc), and quantum key ciphertext C(Ka), it generates ciphertext C and sends it to the first business system. S5. The first business system sends the encrypted text C to the second business system on the other end through the business data communication link. S6. The key decryption and synthesis module of the second hardware cryptographic device receives the ciphertext C and selects the corresponding cryptographic algorithm for differential encapsulation according to the local QKD distributed quantum key offset enabling Mask_QB, classical key enabling Mask_C, and quantum key enabling Mask_A. At the same time, it decides whether to obtain the complete QKD distributed quantum key Kb from the local QKD network according to the quantum key offset enabling Mask_QB, and sends the quantum key Kb, classical key Kc, and quantum key Ka to the key synthesis module of the second hardware cryptographic device. S7. The key synthesis module receives the quantum key Kb, classical key Kc and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operation to generate the final business key K_final.

[0076] To better illustrate the technical solution of this application, a detailed explanation is provided below with an example.

[0077] Figure 3 This is a schematic diagram illustrating the system deployment of the present invention under direct bank connection services. In this system: 1) Deployment on the bank side: First business system: Direct connection system with financial banks, supporting manual input of parameters or automatic reporting of scenario information; The first hardware cryptographic device includes a key encapsulation module (including a key generation module), a key decryption and synthesis module (including a key synthesis module), a symmetric cryptographic operation module (classical Chinese cryptographic algorithms, AES and other international algorithms), an asymmetric cryptographic operation module (classical Chinese cryptographic algorithms, NIST PQC algorithm), and built-in hardware such as a classical random number generator and a quantum random number generator. It connects to the QKD system on the network, communicates with business systems, and provides standard SDK / RESTful interfaces to business applications. The first QKD device adopts the BB84 protocol, supports synchronous generation of quantum keys with enterprises / insurance / securities, and supports outputting quantum keys to the first hardware cryptographic device.

[0078] 2) Deployment on the enterprise / insurance / securities side: Second business system: Financial bank direct connection system, which supports manual input of parameters or automatic reporting of scenario information / synchronization of enable signal information; The second hardware cryptographic device includes a key encapsulation module (including a key generation module), a key decryption and synthesis module (including a key synthesis module), a symmetric cryptographic operation module (classical Chinese cryptographic algorithms, AES and other international algorithms), an asymmetric cryptographic operation module (classical Chinese cryptographic algorithms, NIST PQC algorithm), and built-in hardware such as a classical random number generator and a quantum random number generator. It connects to the QKD system on the network, communicates with business systems, and provides standard SDK / RESTful interfaces to business applications. The second QKD device is the same model as the first QKD device, uses the BB84 protocol, supports synchronous generation of quantum keys with the bank, and supports outputting quantum keys to the second hardware cryptographic device.

[0079] 3) Communication link deployment: Quantum Key Communication Link: When the optical fiber is directly connected or shared, a core of a specified wavelength is provided, with the first QKD device and the second QKD device at each end of the optical fiber; Business data communication link: Supports wired / wireless / 4G / 5G and other communication methods. The two ends of the communication entity are access area routers / switches, which are designed to connect the business systems at both ends to achieve secure data transmission.

[0080] Taking the fully converged mode in Table 1 as an example, the working process of this system is described in detail: 1) Enable signal parameter configuration and synchronization: The scene identifier reported by the bank's business system is: financial_core+top_secret+lan. The scene identification module of the first hardware cryptographic device is automatically mapped to working mode parameter 3 (full convergence mode). The first hardware cryptographic device at the bank generates an asymmetric encryption key pair (including national cryptographic standards and NIST PQC). The business system synchronizes parameter 3 and the asymmetric encryption public key to the peer business system, which then forwards them to the second hardware cryptographic device. The second hardware cryptographic device verifies that the local configuration (default parameter 3) is consistent with the received parameters. Proceed to the key negotiation process.

[0081] 2) Key generation and activation: The first hardware cryptographic device parses parameter 3 and generates enable signals: Mask_C=1, Mask_A=1, Mask_QB=1; A classic random number generator generates a 128-bit classic key Kc=0x1A3B5C7D9E2F4A6B8C9D0E1F2A3B4C5D; A quantum random number generator generates a 128-bit quantum key Ka=0x7F8E9D0C1B2A39485766758493021FED; Obtain the quantum key Kb from the QKD network, and obtain the currently available key offset Offset_B=0x00112233 as required, corresponding to the 128-bit quantum key Kb=0x2B4D6F8A0C2E4G6H8J0L2N4P6R8T0V2X.

[0082] 3) Differentiated packaging: Kc is encapsulated using the SM2 asymmetric encryption algorithm (the key is the hardware-built-in root key 0x00112233445566778899AABBCCDDEEFF), resulting in C(Kc)=0x3D5F7A9C2B4D6E8F0A1C3E5G7H9J1K3M5O7Q9S1U3W5Y7Z9B1D3F5H7J9; Ka is encapsulated using the CRYSTALS-Kyber-768 algorithm, resulting in C(Ka)=0x8A0C2E4G6H8J0L2N4P6R8T0V2X4Z6B8D0F2H4J6L8N0P2R4T6V8X0Z2B4D6F8H0; The Offset_B is encapsulated using the CRYSTALS-Kyber-768 algorithm, resulting in C(Offset_B)=0x0F2D4B688A0C2E4G6H8J0L2N4P6R8T0V2X4Z6B8D0F2H4J6L8N0P2R4T6V; Combine to generate ciphertext C=0x03 (pattern identifier field)||C(Kc)||C(Ka)||C(Offset_B), total length = 8bit + 128bit + 1088bit + 1088bit = 2312bit.

[0083] 4) Encrypted transmission and decryption: The bank's business system sends the encrypted text C to the peer's business system via the business network; The second hardware cryptographic device receives ciphertext C, and the parsing mode parameter identifier is 0x03 (parameter 3), confirming that it is consistent with the local configuration; Kc is recovered by decrypting C(Kc) using SM2 asymmetric decryption, and Ka is recovered by decrypting C(Ka) using the CRYSTALS-Kyber-768 algorithm. Offset_B is recovered by decrypting C(Offset_B).

[0084] 5) Business key generation: The second hardware cryptographic device obtains the complete Kb from the QKD network based on Offset_B=0x00112233; Perform an XOR operation: K_final=Kc⊕Ka⊕Kb=0x1A3B5C7D9E2F4A6B8C9D0E1F2A3B4C5D⊕0x7F8E9D0C1B2A394857667584 93021FED⊕0x2B4D6F8A0C2E4G6H8J0L2N4P6R8T0V2X=0x6C7A8B9D0E1F2A3B4C5D6E7F8A9B0C1D; K_final is 128 bits, and the key entropy value is ≥128 bits, which meets the security requirements of core financial transactions.

[0085] 6) Security Applications: Both ends of the financial system use K_final to encrypt core transaction data (such as user transfer information) using the AES-128-GCM / SM4-GCM algorithm, to achieve secure transmission and storage of transaction data, while meeting the requirements of national cryptographic compliance and resistance to quantum attacks.

[0086] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A configurable multi-mode hybrid key agreement system, characterized by: It includes a local end and a peer end, wherein the local end includes the following functional units: The first business system, the system that actually processes business, achieves secure storage and transmission of important and sensitive data by calling the first hardware cryptographic device. The first hardware cryptographic device is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms and NIST PQC algorithms, and the key management supports quantum keys, classical keys, and quantum keys distributed by QKD. The first QKD device is a quantum secure communication device that achieves quantum key synchronization based on the principles of quantum undetectability and non-copyability. The counterpart includes the following functional units: The second business system is the system that actually processes data interaction, synchronization, uploading, and downloading with the first business system. It achieves secure storage and transmission of important and sensitive data by calling the second hardware cryptographic device. The second hardware cryptographic device has the same structure and function as the first hardware cryptographic device. It is a dedicated cryptographic device that provides cryptographic algorithms and key management. The cryptographic algorithms support classical Chinese cryptographic algorithms and NIST PQC algorithms. The key management supports quantum keys, classical keys and quantum keys distributed by QKD. The second QKD device works in conjunction with the first QKD device to achieve synchronous generation of quantum keys.

2. The configurable multi-mode hybrid key agreement system of claim 1, wherein: Both the first hardware cryptographic device and the second hardware cryptographic device include the following functional modules: The key encapsulation module provides a key negotiation interface to the business system, receives and parses the working mode parameters from the business system, generates corresponding enable signals, and receives the key / key offset from the key generation module. It then selects the appropriate cryptographic algorithm according to the enable signals for differentiated encapsulation to generate ciphertext. The key generation module receives the enable signal from the key encapsulation module and generates the corresponding key / key offset according to the enable signal. The key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects the appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key. The key synthesis module receives keys from the key decryption and synthesis module and integrates them to generate the final business key.

3. The configurable multi-mode hybrid key agreement system of claim 2, wherein: The key generation module receives an enable signal from the key encapsulation module and generates a corresponding key / key offset according to the enable signal, including: The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by the key encapsulation module via QKD, and generates the corresponding key / key offset according to the enable signal: When the quantum key offset of QKD distribution is enabled (Mask_QB=1), it connects to the QKD network, obtains the quantum key Kb distributed by QKD from the QKD network, and obtains the currently available key offset Offset_B as required. When disabled, it outputs a zero value. When the classic key is enabled (Mask_C=1), the built-in WNG random source is started to generate the classic key Kc; when disabled, zero value is output. When the quantum key is enabled (Mask_A=1), the built-in QRNG random source is activated to generate the quantum key Ka; when disabled, a zero value is output.

4. The configurable multi-mode hybrid key agreement system of claim 3, wherein: The key encapsulation module receives the key / key offset from the key generation module, and selects the appropriate cryptographic algorithm according to the enable signal for differentiated encapsulation to generate ciphertext, including: S11. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enabled Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A distributed by QKD: For the key offset Offset_B, if the quantum key offset enabled Mask_QB=1 in the QKD distribution, the NISTPQC algorithm is used for encapsulation to generate the key offset ciphertext C(Offset_B). Otherwise, the key offset ciphertext C(Offset_B) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent. For the classic key Kc, if the classic key is enabled Mask_C=1, then the classic national cryptographic algorithm is used for encapsulation to generate the classic key ciphertext C(Kc); otherwise, the classic key ciphertext C(Kc) is filled with zero values ​​of a fixed length to ensure that the final ciphertext format is uniform. For the quantum key Ka, if the quantum key enable Mask_A=1, the NIST PQC algorithm is used for encapsulation to generate the quantum key ciphertext C(Ka); otherwise, the quantum key ciphertext C(Ka) is filled with a fixed length of zero values ​​to ensure that the final ciphertext format is consistent. S12. Combining the key offset ciphertext C(Offset_B), the classical key ciphertext C(Kc), and the quantum key ciphertext C(Ka), generate ciphertext C: C=M||C(Offset_B)||C(Kc)||C(Ka); Where M is the pattern identifier field, which serves as the header identifier for the ciphertext C and is used to control the enabling / disabling of three different types of source keys. || represents the bit string concatenation operation.

5. The configurable multi-mode hybrid key agreement system of claim 4, wherein: The key decryption and synthesis module provides a key decryption interface to the business system, receives ciphertext, selects the appropriate cryptographic algorithm according to the local enable signal for differential decryption and encapsulation, and extracts the key, including: S21. The key decryption and synthesis module receives the ciphertext C and performs differential encapsulation using the corresponding cryptographic algorithms according to the quantum key offset enabled by QKD, enabling Mask_QB, classical key enabled Mask_C, and quantum key enabled Mask_A: For the key offset C(Offset_B) in ciphertext C, if the quantum key offset enabled Mask_QB=1 in QKD distribution, then the NIST PQC algorithm is used to decapsulate and restore the key offset Offset_B; otherwise, the key offset Offset_B is zero after decapsulation. For the classical key ciphertext C(Kc) in the ciphertext C, if the classical key is enabled Mask_C=1, then the classical Chinese cryptographic algorithm is used to decapsulate and recover the classical key Kc; otherwise, the decapsulated classical key Kc is zero. For the quantum key ciphertext C(Ka) in the ciphertext C, if the quantum key enable Mask_A=1, the NIST PQC algorithm is used to decapsulate and generate the quantum key Ka; otherwise, the decapsulated quantum key Ka is zero. S22. If the quantum key offset of QKD distribution is enabled (Mask_QB=1), then the complete QKD distributed quantum key Kb is obtained from the local QKD network according to the key offset (Offset_B). Otherwise, the QKD distributed quantum key Kb is set to zero, thereby extracting the QKD distributed quantum key Kb, classical key Kc, and quantum key Ka.

6. The configurable multi-mode hybrid key agreement system of claim 5, wherein: The key synthesis module receives keys from the key decryption and synthesis module, integrates them to generate the final business key, including: The key synthesis module receives the quantum key Kb, classical key Kc, and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operations to generate the final business key K_final, which is used by the business system for subsequent symmetric encryption. K_final=Kb⊕Kc⊕Ka; Here, ⊕ represents the XOR operation. When a certain type of key is disabled, the XOR result is equivalent to using only the enabled key.

7. The configurable multi-mode hybrid key agreement system of any of claims 1-6, wherein: It also includes a quantum key communication link, which is established between the first QKD device and the second QKD device and interconnected by optical fiber to achieve synchronous generation of quantum keys through physical transmission.

8. The configurable multi-mode hybrid key agreement system of claim 7, wherein: It also includes a business data communication link, which is a conventional communication network connecting the servers of the first business system and the second business system. It is used to transmit business data and ciphertext. The business data communication link can share a fiber with the quantum key communication link to achieve secure data interaction using cryptographic technology based on mathematical principles.

9. A configurable multi-mode hybrid key agreement method, applicable to the configurable multi-mode hybrid key agreement system of claim 2, characterized in that: Includes the following steps: S1. The first business system on the local end sends working mode parameters to the key encapsulation module of the first hardware cryptographic device; S2. The key encapsulation module receives and parses the working mode parameters from the first business system, generates a corresponding enable signal and sends it to the key generation module of the first hardware cryptographic device. S3. The key generation module receives the quantum key offset enable Mask_QB, classical key enable Mask_C and quantum key enable Mask_A distributed by the key encapsulation module via QKD, generates the corresponding key offset Offset_B, classical key Kc and quantum key Ka according to the enable signals, and sends them to the key encapsulation module. S4. The key encapsulation module receives the key offset Offset_B, classical key Kc, and quantum key Ka from the key generation module, and selects the corresponding cryptographic algorithm for differentiated encapsulation according to the quantum key offset enable Mask_QB, classical key enable Mask_C, and quantum key enable Mask_A distributed by QKD. Combining the key offset ciphertext C(Offset_B), classical key ciphertext C(Kc), and quantum key ciphertext C(Ka), it generates ciphertext C and sends it to the first business system. S5. The first business system sends the encrypted text C to the second business system on the other end through the business data communication link. S6. The key decryption and synthesis module of the second hardware cryptographic device receives the ciphertext C and selects the corresponding cryptographic algorithm for differential encapsulation according to the local QKD distributed quantum key offset enabling Mask_QB, classical key enabling Mask_C, and quantum key enabling Mask_A. At the same time, it decides whether to obtain the complete QKD distributed quantum key Kb from the local QKD network according to the quantum key offset enabling Mask_QB, and sends the quantum key Kb, classical key Kc, and quantum key Ka to the key synthesis module of the second hardware cryptographic device. S7. The key synthesis module receives the quantum key Kb, classical key Kc and quantum key Ka distributed by the key decryption and synthesis module via QKD, and integrates them through XOR / MAC operation to generate the final business key K_final.

Images