1732 results about "Session key" patented technology

The invention relates to the technical field of firmware protection, in particular to a firmware protection method and system based on a security coprocessor. The method comprises the following steps: acquiring characteristic data of the coprocessor; extracting hardware entropy source data according to the coprocessor feature data; generating a hardware trust root key based on the hardware entropy source data; performing partition processing on the firmware based on the hardware trust root key to obtain firmware partition data; constructing hierarchical verification structure data according to the firmware partition data; implementing firmware starting security verification based on the hierarchical verification structure data to obtain integrity verification data; establishing a secure communication channel between the processors according to the integrity verification data; executing a bidirectional authentication process based on the secure communication channel, and generating session key data; a firmware runtime environment is monitored based on the session key data. According to the method, the hardware entropy source is extracted by measuring the physical characteristics of the coprocessor, and an unforgeable hardware trust root is established, so that the security is improved fundamentally.

A distributed intelligent authentication method based on dynamic multi-modal fusion relates to the field of network security, and adopts an alliance chain + DAG hybrid block chain architecture, combines a threshold signature to realize secret key fragment management, and switches among PBFT, Raft and probabilistic algorithms through a dynamic consensus mechanism to improve authentication efficiency. The multi-mode authentication module is based on a dynamic weight distribution algorithm, integrates biological characteristics, behavior analysis, equipment fingerprints and environmental factors, and combines an LSTM-GAN model and a quantum random number driven challenge-response mechanism to realize zero-trust verification under environmental perception. The session management module generates a session key by using a chaotic mapping algorithm. In the aspect of privacy protection, CKKS homomorphic encryption, zero-knowledge proof and attribute-based encryption are fused. According to the method, the block chain technology, the secure multi-party computing technology, the machine learning technology and the quantum cryptography technology are fused, and a high-performance, high-security and strong-privacy-protection distributed authentication solution is provided.

The invention relates to the technical field of information security, and discloses an authentication method and system based on a Ksession shared session key MAC, and the method comprises the steps: obtaining to-be-encrypted data in a power monitoring system, dividing the to-be-encrypted data into key data and real-time data, and encrypting the key data and the real-time data; the method comprises the following steps: dynamically generating a Ksession key by using an ECDH protocol and an identity-based IBC technology, generating a message authentication code by using the Ksession key, carrying out integrity and authenticity verification on data in transmission through the message authentication code, transmitting encrypted data through a TLS / SSL protocol, and destroying the Ksession key at the end of a session; a quantum security digital certificate is generated by fusing quantum key distribution and a quantum security signature algorithm, and verification of the digital certificate is realized through a multi-party verification mechanism. The quantum security technology and the advanced encryption theory are integrated, and qualitative leap is achieved in the aspects of identity authentication, data encryption, integrity verification and access control.

The invention relates to the technical field of commercial password detection methods, and discloses a high-security method for negotiating a temporary session key based on a national secret algorithm, and the commercial password detection method comprises the following steps: initialization and identity authentication: two communication parties generate an SM2 public and private key pair, and the identity is verified through a digital certificate and an SM2 signature; temporary key negotiation: generating a shared key point based on an SM2 key exchange protocol; session key derivation: generating a temporary session key by using an SM3 hash algorithm; key confirmation and encrypted communication: verifying the key through an SM4 algorithm and encrypting communication data; according to the high-security method for negotiating the temporary session key based on the national secret algorithm, efficient key negotiation of both communication parties in an unsecure channel is realized through an SM2 key exchange protocol, an SM3 hash algorithm and an SM4 symmetric encryption algorithm. The method combines digital certificate authentication, dynamic random numbers and timestamps, has forward security, replay attack resistance and man-in-the-middle attack resistance, and is suitable for high-security scenes such as finance and government affairs.

The invention relates to a secure communication method between an edge server and terminal equipment. The secure communication method comprises the following steps: establishing a physical layer channel state information database, generating a multi-dimensional feature vector and encoding the multi-dimensional feature vector into a terminal equipment identifier, generating an identity authentication request by the terminal equipment, and performing hash operation to obtain a first hash value; the identity authentication request and the first hash value are sent to the edge server, the edge server verifies the identity authentication request and queries a corresponding device key, performs hash operation to obtain a second hash value, generates an authentication response message after successfully comparing the second hash value with the first hash value, encrypts the authentication response message by using the device key, and sends the encrypted authentication response message to the edge server; and sending the encrypted authentication response message to the terminal equipment. And the terminal equipment decrypts by using the equipment key to obtain the session key, and communicates with the edge server based on the session key. By using the physical layer channel information and the equipment hardware characteristics, the security communication method fusing dynamic identity authentication and efficient key management improves the security, reliability and anti-attack ability of communication between the edge server and the terminal equipment.

A method for data processing, a readable medium, and an electronic device are provided. The method for data processing includes: receiving a data processing task; determining target data corresponding to the data processing task and a target first key corresponding to the target data; decrypting the target first key according to the first session key via a target computing node to obtain the first key, and decrypting the target data based on the first key to obtain the data to be processed; and determining a data processing result according to a target model and the data to be processed. The target computing node is executed in a trusted execution environment. The target model is obtained by decrypting an encrypted target model based on a model key, the model key is stored in a key management service, and the key management service is executed in the trusted execution environment.

The invention discloses an RFID anti-tracking bidirectional authentication method and system based on a lightweight hash chain, and relates to the technical field of wireless radio frequency identification security. The system comprises a label initialization module, a bidirectional authentication module, an anti-tracking mechanism module, a hash chain updating module, a secure communication module and a system feedback optimization module. The label initialization module generates initial hash chain data; the bidirectional authentication module adopts a bidirectional challenge-response mechanism to generate a dynamic authentication certificate; the anti-tracking mechanism module generates an untraceable session key through Hash chain value dynamic rotation and randomization mask technology; the Hash chain updating module iteratively updates the Hash chain value; the secure communication module adopts a lightweight encryption algorithm to protect communication data; and the system feedback optimization module dynamically adjusts the hash chain length and the key strength. The real-time performance and the anti-attack capability of the RFID system are remarkably improved, and a high-safety and low-power-consumption bidirectional authentication solution is provided for Internet of Things equipment.

The invention discloses a session key capture and security event analysis method, device, equipment and medium, and relates to the technical field of network communication and information security, a data security protection system is established, a probe service is deployed at a security event monitoring end, and an eBPF technology is utilized to capture a TLS session key in a network stack of an operating system according to analysis of a TLS handshake message; and the probe service combines time features, session features and the captured secret key to generate a mapping relation, and the mapping relation is stored into a persistent file. According to the method, the HASH structure is used for storing the secret key file, the mapping relation between the quintuple and the session time point and the mapping relation between the quintuple and the session secret key are increased, searching and symmetric decryption of the mapping relation between the encrypted traffic and the session secret key can be efficiently completed at the decryption server end, the decryption performance is greatly improved, meanwhile, the session generation time and the session secret key are stored in the HASH value, and the decryption efficiency is improved. The method can solve the problem that the old connection is released and the quintuple of the new connection and the old connection is consistent in a high-concurrency scene, and can improve the decryption accuracy.

The invention relates to a control method for a multi-protocol switching anti-quantum security gateway, and the method comprises the steps: carrying out the safety self-inspection of a hardware environment after the security gateway is powered on, generating a unique root key of equipment based on a physical unclonable function, continuously collecting and analyzing the network traffic characteristics, and carrying out the self-inspection of the hardware environment. Based on a machine learning model, a quantum attack mode is identified and an encryption algorithm mode is dynamically decided, protocol analysis is carried out on a communication data packet, dynamic conversion and adaptation are carried out between a traditional protocol and an anti-quantum cryptography protocol according to an instruction and a preset rule, and an anti-quantum cryptography engine is called to carry out encryption or signature operation. And dynamically deriving and managing a session key in a complete period based on a root key, switching an algorithm mode, a communication protocol and a key in a linkage manner according to a quantum attack detection result, and starting anti-side channel attack protection and hardware security response. According to the method, active protection of the security gateway on quantum attacks, multi-protocol seamless compatibility and full-life-cycle security management of keys are realized.

The invention relates to the technical field of Internet of Things security, and provides a security authentication method and system for an Internet of Things device, a medium and a device, and the method comprises the steps: responding to an authentication request of the Internet of Things device, the authentication request comprising a unique identifier, a current timestamp and a comprehensive feature vector of the Internet of Things device; after the current timestamp and the comprehensive feature vector are connected, generating a random challenge value through a random function and sending the random challenge value to obtain a returned Internet of Things equipment response value; after the authentication key, the comprehensive feature vector and the random challenge value are connected, an expected response value is generated through a secure hash function, and whether the Internet of Things equipment is successfully authenticated or not is judged through comparison; and if the authentication is successful, generating a session key, connecting the authentication key with the session key, and updating the authentication key through a secure hash function. The common security threats such as replay attack and man-in-the-middle attack are effectively prevented, and the uniqueness and security of each authentication are ensured.

The invention relates to an intelligent device safe networking method and system based on a dynamic secret key, and the method comprises the steps: obtaining a device identifier and an initial secret key of an intelligent device, recording a current timestamp when the intelligent device is started, and generating a dynamic secret key through a Hash algorithm in combination with the device identifier and the initial secret key; generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway; verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the intelligent device; and generating a corresponding session key through the intelligent device according to a preset Diffie-Hellman algorithm in combination with the verification result, performing encrypted communication with the gateway based on the session key, and sending corresponding encrypted data to the gateway. According to the invention, flexible key management and efficient encryption communication can be realized.

The invention discloses an interface authentication method, system and device based on a national cryptographic algorithm and a medium, belongs to the technical field of computer security, and aims to solve the technical problem of how to realize identity authentication, data encryption, integrity verification and replay attack protection of interface interaction and meet the security requirement of a key information system. According to the technical scheme, the method comprises the following steps: system initialization: a server and a client respectively generate SM2 key pairs, the client and the server exchange public keys through a secure channel, and a mapping relation between the public key of the opposite side and an identity label is stored; session key negotiation: exchanging a temporary public key based on an SM2-ECDH algorithm, calculating a shared secret value, and deriving an SM4 session key through a KDF; the client side carries out SM3 hash and SM2 signature on request parameters, and the server side verifies the signature and verifies a timestamp and a random number to resist replay attacks; and session key updating: triggering key updating according to a preset condition, and encrypting the new key negotiation message by using the original session key.

A method performed by a user equipment to establish a secured connection with an application entity in an enterprise network. The method comprises sending an establishment request to a secure access secure edge (SASE) entity: receiving an establishment response from the application entity if the SASE entity determines to allow the establishment request and authorizes Generic Bootstrapping Architecture / Authenticated Key Management for Application (GBA / AKMA) platform to share a session key with the application entity; and establishing a connection with the application entity based on the session key.

The invention relates to a secure communication method for an edge node and terminal equipment based on dynamic key negotiation. The method comprises the following steps: the terminal equipment sends an initial signal when initiating a communication request; the edge node generates a scenarized first key negotiation parameter and feeds back the scenarized first key negotiation parameter after passing dual identity and state verification; after the terminal device decrypts the parameter, a dynamic entropy value is collected by combining a network adaptive sensor, and a second key negotiation parameter associated with the first parameter feature is generated; the two parties calculate session keys based on an ECDH algorithm, and the consistency of the keys is ensured through dynamic entropy verification and Hash comparison; and after the key negotiation succeeds, entering a hierarchical encrypted data transmission stage, and dynamically updating a session key based on a multi-dimensional trigger mechanism. According to the method, through hardware credibility verification, a scenarized key strategy, dynamic entropy enhancement and national secret algorithm adaptation, dynamic management of keys and adaptive matching of terminal resources are achieved, attacks such as equipment counterfeiting and parameter tampering are effectively resisted, and the high-security and compliance requirements in the fields of industrial control and the like are met.

The invention discloses an archive digitization full-life-cycle encryption integrity verification method and system, relates to the field of digital archive safety management, and is used for solving the problem of integrity and safety guarantee in archive digitization management. Logic units are divided through a semantic analysis engine, non-uniform blocks are generated based on sensitivity dynamic partitioning, local hash values are calculated, and a multi-level verification tree is constructed to generate root hash and a hash path mapping table; acquiring visitor identities, terminal environments and timestamps in each stage of an archive life cycle, generating state snapshots in combination with a hash path, and constructing a life cycle state snapshot chain; reconstructing a target logic unit verification path according to the access request, analyzing the structural difference between a current path and a historical snapshot chain through a path reconstruction type difference verification algorithm, and identifying structural offset, node tampering or path loss; and response control is triggered for abnormal verification, including session key updating and permission freezing, so that the security integrity guarantee of the digital archive in the full life cycle is improved.

The invention belongs to the technical field of network security, and discloses an encrypted enterprise network data security access method and system, and the method comprises the steps: constructing a biological recognition unit and an equipment binding unit, recognizing multi-dimensional biological data through the biological recognition unit, and carrying out the identity authentication of a user through the combination of a dynamic token generation time binding mechanism; the equipment binding unit associates the identity authentication result with the hardware fingerprint of the security access terminal to generate a digital identity certificate; a basic key is generated and updated in a rolling mode through a quantum random number generator; dual protection is carried out on the multi-dimensional biological data through a hierarchical encryption unit, the hierarchical encryption unit comprises an application layer and a transmission layer, the application layer adopts an SM4 algorithm to encrypt service content data in the multi-dimensional biological data, and the transmission layer adopts an SM2 algorithm to generate a session key to carry out forward secrecy; the security access of enterprise network data is ensured, and the security protection capability of the enterprise network is comprehensively enhanced.

The invention relates to a QUIC protocol-based distributed node unified identity authentication method and system, belongs to the technical field of network security, is applied to a client, and comprises the following steps: registering a client domain name identity through a certificate authority, obtaining a client certificate, and pre-storing a server certificate chain; generating a QUIC initial data packet according to the target server domain name identifier and the client certificate, and sending the QUIC initial data packet to the server; receiving a QUIC handshake data packet returned by the server; verifying the legality of the server certificate based on the server certificate chain, and if the server certificate is legal, calculating a pre-master key according to the client DH private key and the server DH public key; deriving a 1-RTT session key based on the pre-master key; generating a signature verification message, and sending the client certificate and the signature verification message to a server; and synchronously using the 1-RTT session key to encrypt the application layer data with the server, and transmitting the data to the server in the 1-RTT encryption space of the QUIC protocol. According to the invention, the reliability of node identities and the confidentiality of data are ensured.

The invention provides a real estate full life cycle intelligent management method and system based on Internet of Things perception, and the method comprises the steps: distributing a unique hardware identifier of equipment, combining a lightweight digital certificate with a pre-shared key to achieve two-factor authentication, and storing a root certificate in a cloud end; an access authentication process is optimized, an identity label and a certificate signature request need to be submitted when a node accesses for the first time, a temporary session key is generated after the gateway verifies, and abnormal access is immediately isolated and reported; data integrity verification is implemented, and after a sensor collects data, an abstract is generated and data encryption transmission is carried out; after decryption, the receiving end recalculates the abstract for comparison, and if not, the abstract is discarded and nodes are marked to be abnormal; a data anomaly detection model is constructed, energy consumption fluctuation is determined based on historical data, a frequency baseline is collected, data reasonability is monitored in real time, secondary authentication is triggered when the data is abnormal, and node data access is suspended if the data fails; a hierarchical key system is established, hardware is solidified by a root key, session keys are alternated for 24 hours, and data encryption keys are dynamically derived and distributed through encryption channels.

The invention relates to the technical field of information security, in particular to a hybrid key packaging method and system, and the method comprises the steps: determining a first encryption key, a sub-key and a second encryption key according to a public key of an anti-quantum key pair and a public key of a national secret key pair corresponding to an obtained to-be-encrypted information request; generating a first symmetric encryption session key according to the sub-key, the first random number and a second cryptographic algorithm; encrypting a message plaintext corresponding to the to-be-encrypted message request by using the first symmetric encryption session key; a receiving end carries out decryption based on the same mode, and an anti-quantum key packaging technology is added to a traditional national secret key packaging scheme, so that the key has an anti-quantum attack function after being packaged; when the anti-quantum key packaging technical scheme loses efficacy on a classical computer, the security of the session key can still be protected by using a national cryptographic algorithm in hardware, the semantic security required by a current public key encryption algorithm is met, and the security of data is improved.

The invention relates to the technical field of unmanned aerial vehicle network information security, in particular to an expandable unmanned aerial vehicle Internet of Things authentication key negotiation method, which comprises the following steps: initializing system parameters, and completing base station authorization and user registration; responding to successful user login and sending a request message, and sending the first encrypted request message to the key base station; the key base station sends the connection request to a base station corresponding to each unmanned aerial vehicle; each base station sends the second encryption request message to the target unmanned aerial vehicle; each target unmanned aerial vehicle determines a secret message and sends the secret message to the key base station; the key base station determines a target session message and a target secret message, sends the target session message to each target unmanned aerial vehicle, and sends the target secret message to the user; and each target unmanned aerial vehicle determines a target session key based on the target session message, and the user determines the target session key based on the target secret message. According to the invention, security negotiation of the session key between the user and the unmanned aerial vehicle can be realized, and the base station is effectively kept secret.

The invention provides a communication authentication method and system for a train-mounted network, a storage medium and equipment, and the method only completes the key negotiation operation in the process of executing the communication authentication of the train-mounted network, enables the subsequent communication process to be executed based on a session key obtained through the negotiation of a first verification party and a second verification party, and improves the communication authentication efficiency. According to the method and the device, identity information of two communication parties is mutually verified, only a request carrying identity information of a verification party needs to be sent once in a primary communication process, only a session key generated by negotiation needs to be carried in a subsequent communication process, lightweight processing is performed on a communication authentication protocol, and the communication authentication protocol can be obtained by introducing a pairing-free password system based on an identity label. According to the method, a complex pairing process does not need to be executed, the number of calling times of Hash is reduced, the protocol calculation overhead is reduced, the communication efficiency is improved on the basis of ensuring the credible access authentication of a train-mounted network and the credible transmission of a control message, and the influence on the real-time performance of a train network monitoring management system is avoided.

The invention discloses an OBD tamper-proof two-way verification method, which comprises the steps of obtaining OBD equipment data and vehicle sensor data, registering to a cloud end based on the OBD equipment data, obtaining registration data, obtaining key data and non-key data according to the vehicle sensor data, symmetrically encrypting the key data by using a session key in the registration data, and verifying the key data and the non-key data. Performing approximate homomorphic encryption on the non-key data, obtaining a double-entropy source dynamic salt value according to the time entropy of the ciphertext and the OBD equipment operation entropy, reversely reconstructing the dynamic salt value by the cloud according to the timestamp and the registration data, verifying the ciphertext structure by using the dynamic salt value and generating a random challenge containing a salt value check code, and sending the random challenge to the cloud; the equipment verification result and the challenge value are signed and then transmitted back, the OBD equipment carries out reverse verification on the salt value according to the signature and the equipment verification result, and the cloud generates an authority token based on the reverse verification result. According to the method, the data authenticity and integrity of the diagnostic equipment are guaranteed through packet encryption, dynamic salt value generation and bidirectional identity verification of transmission data.

The invention relates to the technical field of network security and edge computing, in particular to a trusted asymmetric encryption communication protocol of an edge computing gateway driven by a certificate chain, which comprises the following steps of: generating node characteristic data based on edge node hardware characteristics, generating dynamic certificate chain data through edge node cooperation, and recording the dynamic certificate chain data to a block chain to form global trust data; generating global random number data in combination with the dynamic certificate chain data and a chaotic mapping algorithm, and verifying the integrity of the global random number data; generating quantum initialization vector data in combination with the global random number data and the hardware noise data, and performing block encryption on the original communication data to generate block encrypted data; a secret sharing algorithm is used to distribute a dynamic session key to a highly trusted node to ensure the security of the key; and dynamically optimizing subsequent communication parameters according to a result of decrypting the communication data. According to the method, the security, robustness and adaptability of data transmission in an edge computing scene are improved by introducing a dynamic certificate chain, a chaotic mapping algorithm, block encryption and a feedback optimization mechanism.

The invention discloses an anti-quantum security data transmission authentication method based on an SLH-DSA, and aims to cope with communication security challenges in a quantum computing environment. The device generates a key pair locally in a registration phase and applies for an anti-quantum identity certificate from a certificate agent. In the authentication stage, a user exchanges an identity certificate and a key parameter to realize identity authentication and negotiate a shared key. In the data transmission stage, a session key is dynamically derived by using a shared key, data is encrypted in combination with a national secret symmetric encryption algorithm SM4, and integrity verification is performed by using an anti-quantum signature algorithm. The method gives consideration to security, lightweight and performance, has quantum attack resistance and forward security, is suitable for application scenarios with high data security requirements, such as industrial Internet of Things and smart power grids, and has good application prospects and popularization values.

The invention discloses a file transmission protection method, system and device based on multiple encryption algorithms, and relates to the technical field of information, and the method comprises the steps: selecting a target file needing to be transmitted, carrying out the preprocessing, and generating file fragments; analyzing the sensitivity of each file fragment, and performing hierarchical encryption processing to obtain an encrypted fragment set; selecting a steganography carrier file, and embedding the encrypted fragments into the carrier file to generate a steganography index table; generating a dynamic session key based on the confusion key pool, encrypting the steganographic file transmission layer and embedding a dynamic key generation parameter; the receiving end generates a session key according to the transmission message header, decrypts the transmission layer data, extracts the steganographic file and decrypts the steganographic file; recombining the decrypted and recovered fragmented data into a complete file according to an identifier sequence; by dynamically matching the steganography carrier file, the efficient embedding of the fragmented data and the generation of the steganography index table are realized, and the concealment and the adaptability in the transmission process are ensured.

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

Provided in the present application are a server, a terminal and a security system. The server comprises an authentication and key management module, a secure multi-party computation engine and a secure-channel management module, wherein the authentication and key management module is used for performing identity verification on a terminal, generating a first private key corresponding to the terminal and a first public key corresponding to the first private key, and generating a first session key on the basis of a second public key of the terminal and the first private key; the secure multi-party computation engine is used for verifying fingerprint information of the terminal and cooperating with a plurality of terminals to perform identity verification on a server; and the secure-channel management module is used for establishing a secure channel with the terminal, encrypting communication data on the basis of the first session key, and using the secure channel to send the encrypted communication data to the terminal. The solution of the present application can effectively solve the security problem of communication between a terminal and a server, and has the advantages of high flexibility and a low cost.

The invention discloses a data protection method for fusing a quantum key in a TLS, and relates to the technical field of quantum secret communication. According to the method, a quantum key is combined with a pre-shared key to perform identity authentication, and a pre-shared key database is continuously updated, so that the problem that a public key identity authentication system is easily attacked by quantum computing and the problem that the security is reduced due to repeated use of the pre-shared key in the existing method are solved; meanwhile, according to the method, a session key used in the communication process is generated by taking the quantum key as a key material through a preset key generation algorithm, so that the use of an unsafe traditional key exchange algorithm is avoided, and the security of data transmission is enhanced.

The browser tab page data storage method supporting data encryption comprises the steps that browser tab page interaction behaviors are monitored in real time to generate a dynamic factor, and a session key dynamically changing along with the life cycle of a tab page is generated in combination with a process ID of the tab page; based on a self-adaptive encryption strategy, respectively encrypting structured data and unstructured data of the label page; wherein the structured data are encrypted according to field sensitivity levels, and the unstructured data are encrypted through mapping binding of a secret key and the data; the encrypted data and a timestamp voucher of the session key are stored in an associated mode, decryption operation is only allowed to be completed in a label page process memory generating the session key, and the session key is not stored in a landing mode; and when the label page is closed, synchronously clearing the decryption data in the session key and the process memory. According to the method and the device, the defects that the dynamic generation of the key cannot be realized and the key cannot fall to the ground at present are overcome.

Disclosed in the present invention are a quantum key distribution-based OTN encryption communication method and a system. The method comprises: applying to a quantum key distribution network for a session key, and establishing the association between the session key and a corresponding encryption policy; dividing the frame structure of any layer in an optical channel layer into an overhead area and a payload area; when a current sender OTN device supports adding information in the overhead area, adding in the overhead area a session key sequence number used for encrypting the present frame of a current port, using the session key to encrypt the payload area of the current frame on the basis of the encryption policy, and then sending the entire frame to a peer end OTN device; and when the current sender OTN device does not support adding information in the overhead area, using the session key to encrypt the payload area of the current frame on the basis of the encryption policy, then sending the frame to the peer end OTN device, and periodically sending a session key synchronization packet to the peer end OTN device. The present invention improves the reliability by using two key synchronization modes, i.e., a mode of supporting adding information in a frame and a mode of notifying by means of a management channel.