Key generation method, device, apparatus, medium, and program product

Abstract

The application provides a key generation method, device, equipment, medium and program product, and relates to the field of financial technology and secure communication. The method generates symmetric link quantum keys based on a quantum communication device group, and stores the symmetric link quantum keys in a key resource pool after distributing them to a key management platform, thereby providing a key source with high security for a session channel and realizing centralized management of key resources, and further improving the security of key distribution, management efficiency and quantum attack resistance in link layer secure communication. By responding to a key generation request of the session channel, any symmetric link quantum key is obtained from the key resource pool, and the symmetric link quantum key is split into a connection association key and a security association key by the key management platform, thereby forming a key result that meets the use requirements of link secure communication, reducing the operation and maintenance burden caused by traditional key configuration and update, and improving the security protection capability of link communication.

Description

Technical Field

[0001] This application relates to the fields of financial technology and secure communications, and in particular to a key generation method, apparatus, device, medium, and program product. Background Technology

[0002] With the continued deepening of the digitalization of critical information infrastructure, core industries with high security levels, such as finance, government affairs, and energy, have increasingly stringent and urgent requirements for secure Ethernet link-layer communication. In particular, interbank settlement networks in financial data centers must strictly guarantee the confidentiality and integrity of transaction data transmission, preventing financial risks caused by the leakage or tampering of transaction information. These high-security scenarios place high standards on Ethernet secure communication systems, requiring resistance to quantum attacks, highly secure key distribution, and compatibility across all scenarios. Link-layer security has become a core cornerstone supporting the stable and secure operation of critical infrastructure.

[0003] Currently, the mainstream industry relies on the MACsec protocol for Ethernet link-layer security. This protocol, through pre-shared CAK connectivity association keys, can fundamentally achieve secure data transmission over the link. However, existing pre-shared CAK key distribution methods lack sufficient resistance to attacks from quantum computing threats and struggle to detect link eavesdropping or man-in-the-middle attacks in a timely manner, failing to meet the high-security key management requirements of scenarios such as finance and government. Therefore, existing key generation schemes cannot guarantee the security of key generation.

[0004] Therefore, a highly secure key generation scheme is urgently needed. Summary of the Invention

[0005] This application provides a key generation method, apparatus, device, medium, and program product to solve the technical problem of low security in key generation during session channel establishment.

[0006] Firstly, this application provides a method for generating a key, comprising:

[0007] Generate symmetric link quantum keys based on a group of quantum communication devices;

[0008] The symmetric linked quantum key is distributed to the key management platform, which then stores the symmetric linked quantum key in the key resource pool.

[0009] In response to a key generation request from a session channel, obtain any symmetric link quantum key from the key resource pool;

[0010] By splitting any symmetric link quantum key through a key management platform, a connection association key and a security association key can be obtained.

[0011] In one possible implementation, the quantum communication device group includes a first quantum communication device and a second quantum communication device, and the generation of a symmetric link quantum key based on the quantum communication device group includes:

[0012] Establish a quantum channel between the first quantum communication device and the second quantum communication device;

[0013] In quantum channels, a symmetric link quantum key is generated based on a quantum protocol process of qubit transmission and basis vector comparison.

[0014] In one possible implementation, the method further includes:

[0015] In response to a session channel establishment request, obtain the connection association key and security association key;

[0016] Determine the connection association key name corresponding to the connection association key;

[0017] Based on the connection association key, the security association key, and the connection association key name, the encrypted security association key is obtained;

[0018] A session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0019] In one possible implementation, the encrypted security association key is obtained based on the connection association key, the security association key, and the connection association key name, including:

[0020] Using a quantum-resistant key derivation function, a key encryption key and a key verification key are generated based on the connection association key name and the connection association key.

[0021] The security association key is encrypted based on the key encryption key to generate an encrypted security association key.

[0022] The verification key is used to generate an integrity verification value for the data sent by the communication initiator, so that the communication receiver can verify the integrity of the data based on the integrity verification value.

[0023] In one possible implementation, a session channel is established between the communication initiator and the communication receiver based on an encrypted security association key, including:

[0024] The encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator respectively, so that the communication receiver and the communication initiator can perform key negotiation.

[0025] Receive negotiation information, and if the negotiation information indicates that the key negotiation between the communication receiver and the communication initiator is successful;

[0026] An initial session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0027] The data in the initial session channel is encrypted using a symmetric encryption algorithm to obtain the session channel.

[0028] In one possible implementation, the encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator, respectively, including:

[0029] The encrypted security association key and integrity verification value are encapsulated into a key negotiation message;

[0030] The key negotiation data frame sends the key negotiation message to both the receiving end and the initiating end of the communication.

[0031] Secondly, this application provides a key generation apparatus, comprising:

[0032] A generation module for generating symmetric link quantum keys based on a group of quantum communication devices;

[0033] The sending module is used to distribute the symmetric link quantum key to the key management platform, so that the key management platform can store the symmetric link quantum key to the key resource pool.

[0034] The response module is used to obtain any symmetric link quantum key from the key resource pool in response to a key generation request from the session channel.

[0035] The processing module is used to split any symmetric link quantum key through the key management platform to obtain the connection association key and the security association key.

[0036] In one possible implementation, the generation module is further configured to:

[0037] Establish a quantum channel between the first quantum communication device and the second quantum communication device;

[0038] In quantum channels, a symmetric link quantum key is generated based on a quantum protocol process of qubit transmission and basis vector comparison.

[0039] In one possible implementation, the processing module is further configured to:

[0040] In response to a session channel establishment request, obtain the connection association key and security association key;

[0041] Determine the connection association key name corresponding to the connection association key;

[0042] Based on the connection association key, the security association key, and the connection association key name, the encrypted security association key is obtained;

[0043] A session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0044] In one possible implementation, the processing module is further configured to:

[0045] Using a quantum-resistant key derivation function, a key encryption key and a key verification key are generated based on the connection association key name and the connection association key.

[0046] The security association key is encrypted based on the key encryption key to generate an encrypted security association key.

[0047] The verification key is used to generate an integrity verification value for the data sent by the communication initiator, so that the communication receiver can verify the integrity of the data based on the integrity verification value.

[0048] In one possible implementation, the processing module is further configured to:

[0049] The encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator respectively, so that the communication receiver and the communication initiator can perform key negotiation.

[0050] Receive negotiation information, and if the negotiation information indicates that the key negotiation between the communication receiver and the communication initiator is successful;

[0051] An initial session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0052] The data in the initial session channel is encrypted using a symmetric encryption algorithm to obtain the session channel.

[0053] In one possible implementation, the processing module is further configured to:

[0054] The encrypted security association key and integrity verification value are encapsulated into a key negotiation message;

[0055] The key negotiation data frame sends the key negotiation message to both the receiving end and the initiating end of the communication.

[0056] Thirdly, this application provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the aforementioned method.

[0057] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the aforementioned method.

[0058] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0059] The key generation method, apparatus, device, medium, and program product provided in this application generate symmetric link quantum keys based on a quantum communication device group, distribute the symmetric link quantum keys to a key management platform, and store them in a key resource pool. This provides a highly secure key source for the session channel and enables centralized management of key resources, thereby improving the security of key distribution, management efficiency, and resistance to quantum attacks in link-layer secure communication. By responding to a key generation request from the session channel, any symmetric link quantum key is obtained from the key resource pool, and the symmetric link quantum key is split into a connection association key and a security association key through the key management platform. This generates a key result that adapts to the needs of secure link communication, reduces the maintenance burden caused by traditional key configuration and updates, and enhances the security of link communication. Attached Figure Description

[0060] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0061] Figure 1 A flowchart illustrating a key generation method provided in this application;

[0062] Figure 2 A flowchart illustrating a method for establishing a session channel provided in this application;

[0063] Figure 3 A schematic diagram of a key generation device provided in this application;

[0064] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application.

[0065] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0066] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0067] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0068] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0069] It should be noted that the key generation method, apparatus, device, medium, and program product provided in this application can be used in the fields of financial technology and secure communication, as well as in any other field. The application fields of the key generation method, apparatus, device, medium, and program product in this application are not limited.

[0070] With the continued deepening of the digitalization of critical information infrastructure, core industries with high security levels, such as finance, government affairs, and energy, have increasingly stringent and urgent requirements for secure Ethernet link-layer communication. In particular, interbank settlement networks in financial data centers must strictly guarantee the confidentiality and integrity of transaction data transmission, preventing financial risks caused by the leakage or tampering of transaction information. These high-security scenarios place high standards on Ethernet secure communication systems, requiring resistance to quantum attacks, highly secure key distribution, and compatibility across all scenarios. Link-layer security has become a core cornerstone supporting the stable and secure operation of critical infrastructure.

[0071] Currently, the mainstream industry relies on the MACsec protocol for Ethernet link-layer security. This protocol, through pre-shared CAK connectivity association keys, can fundamentally achieve secure data transmission over the link. However, existing pre-shared CAK key distribution methods lack sufficient resistance to attacks from quantum computing threats and struggle to detect link eavesdropping or man-in-the-middle attacks in a timely manner, failing to meet the high-security key management requirements of scenarios such as finance and government. Therefore, existing key generation schemes cannot guarantee the security of key generation.

[0072] Therefore, a highly secure key generation scheme is urgently needed.

[0073] The key generation method, apparatus, device, medium, and program product provided in this application generate symmetric link quantum keys based on a quantum communication device group, and then distribute the symmetric link quantum keys to a key management platform and store them in a key resource pool. This provides a highly secure key source for the session channel and enables centralized management of key resources, thereby improving the security of key distribution, management efficiency, and resistance to quantum attacks in link-layer secure communication. By responding to a key generation request from the session channel, any symmetric link quantum key is obtained from the key resource pool, and the symmetric link quantum key is split into a connection association key and a security association key through the key management platform. This generates a key result that adapts to the needs of secure link communication, thereby reducing the maintenance burden caused by traditional key configuration and updates and improving the security of link communication.

[0074] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0075] Figure 1 A flowchart illustrating a key generation method provided in this application is shown below. Figure 1 As shown in the embodiments of this application, the key generation method includes:

[0076] S101. Generate symmetric link quantum keys based on a group of quantum communication devices.

[0077] Quantum communication equipment refers to hardware devices used for quantum key distribution, such as quantum key distribution terminals (QKD). A symmetric link quantum key refers to identical key material at both ends of a link. This material serves as the original input for subsequent splitting into connection association keys and security association keys. It must meet the following conditions: identical content on both ends, sufficient length for subsequent splitting, and unique identification.

[0078] For example, a single-photon quantum state is transmitted in a quantum channel via a group of quantum communication devices, and a symmetric link quantum key is generated based on basis vector alignment and error correction processing.

[0079] In one possible implementation, the quantum communication device group includes a first quantum communication device and a second quantum communication device. A symmetric link quantum key is generated based on the quantum communication device group, and the specific process is as follows:

[0080] Establish a quantum channel between the first quantum communication device and the second quantum communication device;

[0081] In quantum channels, a symmetric link quantum key is generated based on a quantum protocol process of qubit transmission and basis vector comparison.

[0082] The first quantum communication device is used to send or receive qubits at one end of the quantum channel, and the second quantum communication device is used to perform corresponding quantum state measurement and negotiation at the other end of the quantum channel. The two devices form a communication pair for quantum key distribution.

[0083] Quantum channels can be constructed from fiber optic quantum links or free-space quantum links, carrying single-photon pulses or weakly coherent optical pulses to transmit qubits. Qubit transmission can employ any of the following encoding methods: polarization coding, phase coding, or time-binding coding, working in conjunction with a quantum state transmitter and receiver to complete quantum state transmission and measurement. Basis vector alignment refers to the process in the QKD protocol used to determine the consistency of the basis vectors between the transmitter and receiver.

[0084] For example, a quantum channel is established between a first quantum communication device and a second quantum communication device. Then, in the quantum protocol process, the first quantum communication device prepares and transmits qubits according to a preset set of basis vectors. After receiving the qubits, the second quantum communication device detects them based on its own measured basis vectors. Both parties then publicly compare the basis vector selection results and retain the data corresponding to consistent basis vectors, discarding the data corresponding to inconsistent basis vectors. Based on the retained relevant data, both parties perform error estimation, error correction, and privacy amplification processing to obtain a consistent symmetric link quantum key. The quantum protocol process can adopt a BB84 (Bennett and Brassard 1984) type protocol, or other protocols that meet the requirements of quantum key distribution. The specific protocol selection does not affect the generation result of the symmetric link quantum key; this application does not limit the choice of protocol.

[0085] In addition, after generating the symmetric link quantum key, the quantum communication device continuously monitors the bit error rate during the transmission of quantum bits; when the bit error rate exceeds a preset threshold (e.g., 1%), the system determines that there is eavesdropping or environmental interference in the link and triggers the key regeneration process.

[0086] By completing qubit transmission and basis vector comparison within a quantum channel, and combining this with subsequent filtering and consistency processing, the first and second quantum communication devices can form a completely identical symmetric link quantum key. This key can be directly used in link-layer key management processes, providing a secure key source for subsequent key splitting, encryption protection, and session channel establishment, and making the key generation process quantum-safe.

[0087] S102. Distribute the symmetric link quantum key to the key management platform so that the symmetric link quantum key can be stored in the key resource pool through the key management platform.

[0088] A key management platform is a central processing entity used to receive, manage, call, and split keys. It establishes a controlled management and transmission channel with the quantum communication device group to receive the symmetric link quantum keys output by the quantum communication device group.

[0089] The key resource pool is a logical storage space for centrally storing multiple symmetric link quantum keys. It can be mapped to a secure database, a key area in a hardware security module, or a combined memory and persistent storage area subject to access control.

[0090] For example, after the quantum communication equipment group completes key generation, it sends the key to the key management platform. Upon receiving the key, the key management platform first verifies its integrity and source legitimacy. Verification includes checking if the link identifier is registered, if the batch number is duplicated, if the key length meets the splitting requirements, and if the record digest is correct. After successful verification, the key management platform allocates a resource pool index for the symmetric link quantum key and writes it into the key resource pool. Simultaneously, it establishes a status field, occupancy flag, and lifecycle information corresponding to the key. The status field at least indicates unused, reserved, split, and expired states; the occupancy flag prevents concurrent calls to the same key; and the lifecycle information includes at least the write time, expiration time, and cleanup policy. After the symmetric link quantum key enters the key resource pool, it is not directly exposed to the business session processing side. Instead, it is uniformly scheduled by the key management platform, allowing subsequent session channels to obtain the splitting result indirectly only through key generation requests.

[0091] This step transforms the symmetric link quantum key generated by quantum generation into a resource object that can be centrally managed, retrieved, and scheduled, decoupling the key generation process from the subsequent session usage process, and establishing a unified entry point for retrieving any symmetric link quantum key upon request.

[0092] S103. In response to a key generation request from the session channel, obtain any symmetric link quantum key from the key resource pool.

[0093] In this context, a session channel refers to a communication channel used to carry out subsequent communication negotiations and data transmission, and can correspond to a session context that is to be established or has already been established between the two parties in secure communication. Any symmetric link quantum key refers to any stack of link quantum keys in the key resource pool that is either in an unused state or in a reserveable state.

[0094] For example, a key generation request includes at least the session channel identifier, the identifiers of the communicating parties, the service link identifier, and the required key length information. Upon receiving the key generation request, the key management platform first determines the target key resource pool partition based on the identifiers of the communicating parties and the service link identifier. Then, based on the invocation conditions of the request, it selects any available symmetric link quantum key from the corresponding partition. Specifically, after receiving the key generation request, the key management platform can first verify whether the request source belongs to a registered communication device, and then determine whether there is an available key associated with the link identifier of the current request. If it exists, it reads the first available key record in the corresponding index queue, locks the record, and marks it as exclusive to the current session. If it does not exist, it returns a key shortage status and waits for the quantum communication device group to supplement the newly generated quantum key.

[0095] S104. The key management platform is used to split any symmetric link quantum key to obtain the connection association key and the security association key.

[0096] After obtaining the symmetric link quantum key, the key management platform executes a splitting logic within its protected processing environment. This splits the symmetric link quantum key into two parts with different uses: a connection association key and a security association key. Specifically, the key management platform can read the length of the symmetric link quantum key to be processed and split it into a connection association key and a security association key according to a preset splitting rule.

[0097] The preset splitting rule can be based on different parts of the quantum key, or it can generate two distinct key results according to a unified rule, as long as the connection association key and the security association key can be obtained. This application does not limit the setting of the preset splitting rule.

[0098] After the symmetric link quantum key is split, the key management platform can generate a result record corresponding to the splitting result and update the status of the symmetric link quantum key record to split or consumed, so as to avoid the same symmetric link quantum key being used repeatedly for splitting.

[0099] This embodiment provides a key generation method, including generating a symmetric link quantum key based on a quantum communication device group, distributing the symmetric link quantum key to a key management platform, storing the symmetric link quantum key in a key resource pool through the key management platform, retrieving any symmetric link quantum key from the key resource pool in response to a key generation request from a session channel, and splitting any symmetric link quantum key through the key management platform to obtain a connection association key and a security association key. This application uses a quantum communication device group to form a consistent original shared key between the communicating parties, replacing the pre-shared CAK mechanism in the traditional MACsec protocol, thus solving the risks of pre-shared key leakage and man-in-the-middle attacks. Furthermore, the key management platform's distribution, management, and key resource pool storage further reduce the vulnerability of manual configuration, improve the efficiency and security of key management, and ensure consistency in key source, management path, and usage allocation.

[0100] Figure 2 A flowchart illustrating a method for establishing a session channel provided in this application is shown below. Figure 2 As shown, the method includes:

[0101] S201. In response to the session channel establishment request, obtain the connection association key and the security association key.

[0102] In summary, in response to a session channel establishment request, a key generation request is generated and sent to the key management platform. The key management platform then uses this request to retrieve a symmetric link quantum key from the key resource pool, splits it, and obtains the connection association key and security association key required to establish the session channel. The obtained connection association key and security association key can then be transmitted to the communication initiator and receiver via a Virtual Private Network (VPN) tunnel.

[0103] S202. Determine the connection association key name corresponding to the connection association key.

[0104] The Connectivity Association Key Name (CKN) is a random string used to identify the connectivity association key obtained based on the master session key.

[0105] S203. Based on the connection association key, security association key, and connection association key name, an encrypted security association key is obtained. The connection association key name accurately binds the key source, the encrypted security association key serves as a unified basis for negotiation and data encryption between the two parties, and the established session channel enables protected data transmission at the link layer, maintaining consistency and verifiability of key usage by both communicating parties.

[0106] In one possible implementation, the encrypted security association key is obtained based on the connection association key, the security association key, and the connection association key name, including:

[0107] Using a quantum-resistant key derivation function, a key encryption key and a key verification key are generated based on the connection association key name and the connection association key.

[0108] The security association key is encrypted based on the key encryption key to generate an encrypted security association key.

[0109] The verification key is used to generate an integrity verification value for the data sent by the communication initiator, so that the communication receiver can verify the integrity of the data based on the integrity verification value.

[0110] For example, the obtained connection association key and connection association key name are input into the quantum-resistant key derivation function. Internally, this function can employ a hash-based key derivation mechanism to combine and map the connection association key and connection association key name, thereby obtaining a key encryption key and a verification key whose length meets the requirements of the encryption algorithm. Further, the key encryption key is used to perform encryption operations on the security association key to generate an encrypted security association key, which is then used for subsequent session channel establishment. The verification key is synchronously configured at the communication initiator to calculate an integrity check value for the sent business data. After receiving the data, the communication receiver compares this integrity check value using the corresponding verification rules to confirm the integrity of the data during transmission.

[0111] By using a quantum-resistant key derivation function, the key material used for encryption and the key material used for integrity verification are derived separately. This allows the encrypted secure associated key to independently carry the security information required for establishing subsequent sessions, while the integrity verification value can be generated by a separate verification key and used for verification at the communication receiver. This makes the key usage relationship clear and has a consistent verification basis.

[0112] S204. Based on the encrypted security association key, establish a session channel between the communication initiator and the communication receiver.

[0113] The encrypted security association key is the direct input basis for establishing a session channel. Its role is not to directly participate in the processing of business messages, but to restore a consistent security association key after both parties have completed the corresponding processing, and to create corresponding sending security association and receiving security association based on it.

[0114] In one possible implementation, a session channel is established between the communication initiator and the communication receiver based on an encrypted security association key, including:

[0115] The encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator respectively, so that the communication receiver and the communication initiator can perform key negotiation.

[0116] Receive negotiation information, and if the negotiation information indicates that the key negotiation between the communication receiver and the communication initiator is successful;

[0117] An initial session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0118] The data in the initial session channel is encrypted using a symmetric encryption algorithm to obtain the session channel.

[0119] For example, the key management platform sends the encrypted security association key and its corresponding integrity verification value to the communication receiver and the communication initiator, respectively. After receiving the corresponding information, both parties complete key consistency confirmation and negotiation verification. When the negotiation information indicates that the negotiation between the two parties is successful, the communication initiator and the communication receiver decrypt the encrypted security association key to generate a sending security association and a receiving security association. Based on the sending security association and the receiving security association, an initial session channel (MACsec channel) is obtained between the communication receiver and the communication initiator. Then, the data in the MACsec channel is encrypted using a symmetric encryption algorithm to establish the final session channel.

[0120] Data encryption is achieved through symmetric encryption algorithms, preserving the low-latency characteristics of the MACsec protocol while ensuring long-term data security.

[0121] This step involves first sending the encrypted security association key and integrity verification value to the communication receiver and communication initiator respectively for negotiation. After successful negotiation, the encrypted security association key drives symmetric encryption and link protocol carrying, thereby ensuring that the session channel establishment process is consistent with the key state and that both parties complete the session channel establishment based on protected data transmission. This combines key confirmation, integrity verification, and encrypted link transmission, improving the security and consistency of the session channel establishment process.

[0122] In one possible implementation, the encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator, respectively, including:

[0123] The encrypted security association key and integrity verification value are encapsulated into a key negotiation message;

[0124] The key negotiation data frame sends the key negotiation message to both the receiving end and the initiating end of the communication.

[0125] The key negotiation message carries the encrypted security association key and integrity verification value. The key negotiation message may include a message type identifier, a message length field, and a payload field. The payload field contains the encrypted security association key and integrity verification value, which facilitates the identification and parsing of the message content by both communicating parties.

[0126] A key negotiation data frame is a MACsec protocol data frame that carries key negotiation information, such as an MKPDU frame. A key negotiation data frame may contain a frame header, a destination address field, a source address field, a control field, and a payload field. The payload field carries the key negotiation message, enabling the message to be transmitted between the receiving end and the initiating end of the communication.

[0127] For example, the encrypted security association key and integrity verification value are uniformly encapsulated to generate a key negotiation message, and then the key negotiation data frame is used to complete the dual-end transmission, so that the communication receiving end and the communication initiating end can receive the same source negotiation information and complete the consistency verification and key negotiation.

[0128] The above transmission method enables the key negotiation information to be stably encapsulated and delivered to both communicating parties, thereby improving the resolvability and consistency of the negotiation transmission and providing reliable input for the subsequent establishment of a session channel based on the negotiation results.

[0129] In another example, building upon the foregoing, the key management platform employs an automated policy engine. This engine configures corresponding validity period rules for received symmetric link quantum keys, such as setting a maximum key usage count of 100 times or a key lifespan of 72 hours. When the key usage count or time reaches the threshold, a key destruction process is automatically triggered, clearing keys from the key resource pool that meet the validity period rules. When a session channel needs to be established, the key management platform retrieves the symmetric link quantum key "Key A" from the key management pool, executes the subsequent session channel establishment steps, and updates the status field of the symmetric link quantum key to "split" and the occupancy flag to "occupied." After data exchange based on the established session channel concludes at both the communication initiator and receiver, appropriate processing is performed on Key A based on its validity period rules.

[0130] Figure 3 This application provides a schematic diagram of the structure of a key generation device, as shown below. Figure 3 As shown, the key generation apparatus 300 provided in this application embodiment includes:

[0131] The generation module 301 is used to generate symmetric link quantum keys based on a group of quantum communication devices;

[0132] The sending module 302 is used to distribute the symmetric link quantum key to the key management platform, so that the symmetric link quantum key can be stored in the key resource pool through the key management platform;

[0133] The response module 303 is used to obtain any symmetric link quantum key from the key resource pool in response to a key generation request from the session channel.

[0134] The processing module 304 is used to split any symmetric link quantum key through the key management platform to obtain the connection association key and the security association key.

[0135] In one possible implementation, the generation module 301 is further configured to:

[0136] Establish a quantum channel between the first quantum communication device and the second quantum communication device;

[0137] In quantum channels, a symmetric link quantum key is generated based on a quantum protocol process of qubit transmission and basis vector comparison.

[0138] In one possible implementation, the processing module 304 is further configured to:

[0139] In response to a session channel establishment request, obtain the connection association key and security association key;

[0140] Determine the connection association key name corresponding to the connection association key;

[0141] Based on the connection association key, the security association key, and the connection association key name, the encrypted security association key is obtained;

[0142] A session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0143] In one possible implementation, the processing module 304 is further configured to:

[0144] Using a quantum-resistant key derivation function, a key encryption key and a key verification key are generated based on the connection association key name and the connection association key.

[0145] The security association key is encrypted based on the key encryption key to generate an encrypted security association key.

[0146] The verification key is used to generate an integrity verification value for the data sent by the communication initiator, so that the communication receiver can verify the integrity of the data based on the integrity verification value.

[0147] In one possible implementation, the processing module 304 is further configured to:

[0148] The encrypted security association key and integrity verification value are sent to the communication receiver and the communication initiator respectively, so that the communication receiver and the communication initiator can perform key negotiation.

[0149] Receive negotiation information, and if the negotiation information indicates that the key negotiation between the communication receiver and the communication initiator is successful;

[0150] An initial session channel is established between the communication initiator and the communication receiver based on the encrypted security association key.

[0151] The data in the initial session channel is encrypted using a symmetric encryption algorithm to obtain the session channel.

[0152] In one possible implementation, the processing module 304 is further configured to:

[0153] The encrypted security association key and integrity verification value are encapsulated into a key negotiation message;

[0154] The key negotiation data frame sends the key negotiation message to both the receiving end and the initiating end of the communication.

[0155] The key generation device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0156] Figure 4 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0157] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0158] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0159] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method; its implementation principle and technical effect are similar and will not be described in detail here.

[0160] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the technical solution of the above method embodiments. Its implementation principle and technical effects are similar, and will not be repeated here.

[0161] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0162] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0163] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0164] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0165] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0166] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0167] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0168] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only.

[0169] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for generating a key, characterized in that, include: Generate symmetric link quantum keys based on a group of quantum communication devices; The symmetric link quantum key is distributed to a key management platform, which then stores the symmetric link quantum key in a key resource pool. In response to a key generation request from the session channel, any symmetric link quantum key is obtained from the key resource pool; The key management platform splits any symmetric link quantum key to obtain a connection association key and a security association key.

2. The method according to claim 1, characterized in that, The quantum communication device group includes a first quantum communication device and a second quantum communication device. The generation of a symmetric link quantum key based on the quantum communication device group includes: Establish a quantum channel between the first quantum communication device and the second quantum communication device; In the quantum channel, the symmetric link quantum key is generated based on a quantum protocol process of qubit transmission and basis vector comparison.

3. The method according to any one of claims 1-2, characterized in that, The method further includes: In response to a session channel establishment request, obtain the connection association key and security association key; Determine the connection association key name corresponding to the connection association key; Based on the connection association key, the security association key, and the connection association key name, the encrypted security association key is obtained; Based on the encrypted security association key, a session channel is established between the communication initiator and the communication receiver.

4. The method according to claim 3, characterized in that, The process of obtaining the encrypted security association key based on the connection association key, the security association key, and the connection association key name includes: Using a quantum-resistant key derivation function, a key encryption key and a key verification key are generated based on the connection association key name and the connection association key; The security association key is encrypted based on the key encryption key to generate the encrypted security association key; The verification key is used to generate an integrity verification value for the data sent by the communication initiator, so that the communication receiver can verify the integrity of the data based on the integrity verification value.

5. The method according to claim 4, characterized in that, The establishment of a session channel between the communication initiator and the communication receiver based on the encrypted security association key includes: The encrypted security association key and the integrity verification value are sent to the communication receiving end and the communication initiating end respectively, so that the communication receiving end and the communication initiating end can perform key negotiation; Receive negotiation information, in the case where the negotiation information indicates that key negotiation between the communication receiving end and the communication initiating end is successful; Based on the encrypted security association key, an initial session channel is established between the communication initiator and the communication receiver. The data in the initial session channel is encrypted using a symmetric encryption algorithm to obtain the session channel.

6. The method according to claim 5, characterized in that, The step of sending the encrypted security association key and the integrity verification value to the communication receiving end and the communication initiating end respectively includes: The encrypted security association key and the integrity verification value are encapsulated into a key negotiation message; The key negotiation message is sent to the communication receiving end and the communication initiating end respectively through the key negotiation data frame.

7. A key generation apparatus, characterized in that, include: A generation module for generating symmetric link quantum keys based on a group of quantum communication devices; The sending module is used to distribute the symmetric link quantum key to the key management platform, so that the key management platform can store the symmetric link quantum key in the key resource pool; A response module is used to obtain any symmetric link quantum key from the key resource pool in response to a key generation request from the session channel. The processing module is used to split any symmetric link quantum key through the key management platform to obtain a connection association key and a security association key.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images