CN115361129A - A method and system for securely distributing quantum keys based on the Internet of Things - Google Patents

Abstract

The invention relates to a quantum key security distribution system based on the Internet of Things, including a quantum random generator, a terminal layer, an access layer and a platform layer; the platform layer includes a quantum key service module, a resource and information management module, a security interface Incoming management module, secure encoding and decoding management module; the secure distribution method of quantum keys based on the Internet of Things applied to this system starts from the perspective of protecting key security, and designs a group key based on quantum random numbers and a global key that conforms to the characteristics of the Internet of Things The secret key is distributed to the terminal through public key encryption, and the terminal decrypts to obtain the session key, so that the session key can be used to decrypt and obtain instructions. This method deploys each module at the platform layer, so that the Internet of Things system changes from a traditional hierarchical encryption strategy to a security encryption focused on the business level, and the cost of building a security system with the same security level is lower, and the transmission delay is lower. .

Description

A method and system for securely distributing quantum keys based on the Internet of Things

technical field

The present invention relates to the technical field of quantum key distribution, in particular to a method and system for secure distribution of quantum keys based on the Internet of Things.

Background technique

The core functions of the current IoT platform are the connection of massive devices, end-to-side fragmentation, secure management services, and credible secure access. At present, massive device connections mainly use load balancing technology to realize distributed connection, collection, and storage of massive data, and there are few complete solutions for massive security keys; the main means to solve end-side fragmentation is to implement multiple interfaces, Multi-homing access, adapting to different device scenarios through different access methods; secure management services mainly perform slice management from cloud services, cloud computing, etc., and integrate security features in slices and segments; in terms of secure access , mainly from the trustworthiness of the terminal, the trustworthiness of the network, and the stability of the connection to empower the security system, and use layered isolation protection for each level and technology, and use different technologies for different scenarios to ensure the security features of the platform .

The current Internet of Things platform focuses on anti-virus and anti-attack, with weak vertical protection, lack of security management of keys and distribution mechanism for Internet of Things scenarios. The traditional IoT security technology mainly performs encryption at the transport layer, less encryption at the business layer, fails to achieve security management for massive access, and lacks a vertically integrated security protection system. For safety, safety protection devices can only be superimposed on all levels, resulting in high overall cost and high delay. In the traditional IoT network system, its security strategy is hierarchical and layered protection, mainly to build a VPN channel from the perspective of establishing a trusted network. For the business layer, it is impossible to implement a secure encryption strategy.

Quantum communication is an important branch of quantum information science. Quantum key distribution in the prior art mainly completes the corresponding key transmission with the functions of the quantum key generation module and the quantum key receiving module that cooperate with each other and relies on a separate channel to transmit key information, which requires dedicated line management and costs higher.

Contents of the invention

For this reason, the technical problem to be solved by the present invention is to overcome the problem of hierarchical and layered encryption during secure transmission and high cost in the prior art.

In order to solve the above technical problems, the present invention provides a quantum key security distribution method based on the Internet of Things, which is applied to the platform layer, including:

Obtaining the initial terminal number of the target terminal, encrypting the initial terminal number to generate an encrypted terminal number;

Obtain the encrypted terminal number and private key certificate and package it into an initial SDK;

Obtain the routing information of the target terminal, and build a set of initial SDKs for all terminals under the same routing group according to the routing information;

Obtain a decrypted terminal number set according to the initial SDK set, compare the initial terminal number with the decrypted terminal number set, if there is a number in the decrypted terminal number set that is consistent with the initial terminal number, it is the target The terminal randomly selects the first key;

Encrypting and distributing the first key to the target terminal with a public key according to the routing information of the target terminal, so that the target terminal can obtain a session key by decrypting with the private key certificate;

Wherein, the public key, the private key certificate and the first key all come from a quantum key generated by a quantum random generator.

In an embodiment of the present invention, the encryption of the initial terminal number to generate the encrypted terminal number adopts a symmetric encryption algorithm.

In one embodiment of the present invention, the acquiring the routing information of the target terminal includes acquiring the routing information during the routing aggregation process when the target terminal carries its initial SDK for network access application and routing aggregation;

Among them, the route collection is to use the Dijkstra algorithm to select and collect the shortest path under the global route.

In an embodiment of the present invention, the obtaining the decrypted terminal number set according to the initial SDK set includes: using a symmetric encryption algorithm to decrypt the encrypted terminal numbers in the initial SDK set to obtain the decrypted terminal number set.

In an embodiment of the present invention, the comparing the initial terminal number and the decrypted terminal number set further includes, if there is no number consistent with the initial terminal number in the decrypted terminal number set, feeding back the network access fails, and discards the terminal.

In an embodiment of the present invention, the randomly selecting the first key for the target terminal includes:

When the target terminal is an end terminal, randomly select a first key for the end terminal as a group key, and the group key is used to encrypt a single instruction distributed to the end terminal;

When the target terminal is a trusted network terminal, randomly selecting a first key for the trusted network terminal as a global key, the global key is used to encrypt and distribute combined instructions to the trusted network terminal;

Wherein, the end terminal is the last terminal in each routing group, and the trusted network terminals are all terminals in each routing group except the end terminal.

The present invention also provides a quantum key security distribution system based on the Internet of Things, including:

Quantum random generator for generating true random numbers as quantum keys;

The terminal layer, including terminal terminals and trusted network terminals, all carry the initial SDK;

The access layer, including a gateway, communicates with the terminal layer;

The platform layer, applying the Internet of Things-based quantum key security distribution method according to any one of claims 1 to 6, is used to securely transmit the session key with the target terminal for data transmission, which includes:

The quantum key service module is used to obtain and store the quantum key pushed by the quantum random generator, obtain and encrypt the initial terminal number to generate an encrypted terminal number, and randomly select the first key for the target terminal that has passed the verification;

The resource and information management module is used to obtain and store the private key certificate of the terminal, the initial terminal number and the decrypted terminal number, encapsulate the initial SDK, and compare the initial terminal number and the decrypted terminal number to verify whether the target terminal is safe;

The security codec management module is used to obtain and decrypt the set of initial SDK to obtain the set of decrypted terminal numbers;

The secure access management module is used to obtain the routing information of the target terminal, construct the initial SDK set of all terminals under the same routing group, encrypt the first key and distribute it to the target terminal according to the routing information.

In one embodiment of the present invention, the quantum key service module obtains the quantum key pushed by the quantum random generator, and securely stores it as a key pool in the form of a queue.

In an embodiment of the present invention, the end terminal receives the ciphertext of a single instruction encrypted by the group key from the platform layer, and uses the session key to decrypt and obtain the single instruction.

In one embodiment of the present invention, the trusted network terminal receives the combination instruction ciphertext from the platform layer forwarded by the gateway, and uses the session key to decrypt and obtain the combination instruction;

Among them, the forwarding of the gateway includes that after the gateway obtains the combination instruction encrypted by the global key issued by the platform layer, it uses the global key to decrypt and obtain a new combination instruction, and uses the global key to encrypt and forward the new combination instruction to the trusted network terminal again. .

The above technical solution of the present invention has the following advantages compared with the prior art:

The quantum key security distribution method based on the Internet of Things described in the present invention concentrates the encryption strategy on the platform layer, and by deploying each module on the platform layer, the Internet of Things system is changed from the traditional hierarchical encryption strategy to focus on the business layer security encryption, lower cost and lower transmission delay when building a security system with the same security level; through the first key, the design of global key and group key is realized, and the group key is reduced under the premise of ensuring security The frequency of key interaction is improved, and the efficiency is improved; the global key is broadcast by a centralized gateway, which solves the problem of difficult key interaction of platform downlink instructions; the distribution of quantum keys through the Internet of Things breaks away from the traditional network media attributes, It can be distributed in a transparent transmission pipeline without modifying the transmitted business message body, which ensures the security of key transmission.

Description of drawings

In order to make the content of the present invention more easily understood, the present invention will be described in further detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein

Fig. 1 is the flow chart of steps of the method for securely distributing quantum keys based on the Internet of Things provided by the embodiment of the present invention;

Fig. 2 is a schematic diagram of the composition of the quantum key security distribution system based on the Internet of Things provided by the embodiment of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, so that those skilled in the art can better understand the present invention and implement it, but the examples given are not intended to limit the present invention.

Referring to Fig. 1, the quantum key security distribution method based on the Internet of Things provided by the embodiment of the present invention includes:

S1. Obtain an initial terminal number of a target terminal, and encrypt the initial terminal number to generate an encrypted terminal number.

S2. Obtain the encrypted terminal number and the private key certificate and package them into an initial SDK.

S3. The target terminal carries its initial SDK to apply for network access and route collection, obtain routing information in the process of route collection, and construct a set of initial SDKs of all terminals under the same routing group according to the routing information;

Among them, the route collection is to use the Dijkstra algorithm to select and collect the shortest path under the global route.

S4. Use a symmetric encryption algorithm to decrypt the set of initial SDKs to obtain a set of decrypted terminal numbers, compare the set of initial terminal numbers with the set of decrypted terminal numbers, if there is a set of decrypted terminal numbers consistent with the set of initial terminal numbers number, randomly selecting a first key for the target terminal;

If there is no number consistent with the initial terminal number in the set of decrypted terminal numbers, it is fed back that network access fails, and the terminal is discarded.

S5. According to the routing information of the target terminal, encrypt and distribute the first key to the target terminal using a public key, so that the target terminal can decrypt using the private key certificate to obtain a session key.

Wherein, the public key, the private key certificate and the first key all come from a quantum key generated by a quantum random generator. The first key includes a group key and a global key; the group key is used to encrypt a single instruction distributed to an end terminal; the global key is used to encrypt a combined instruction distributed to a trusted network terminal; the end terminal is The last terminal in each routing group, the trusted network terminal is the remaining terminals in each routing group except the last terminal. The end terminal receives the ciphertext of a single instruction encrypted by the group key from the platform layer, and uses the session key to decrypt it to obtain a single instruction; the trusted network terminal receives the ciphertext of the combined instruction forwarded by the gateway from the platform layer, and uses the session key to decrypt it to obtain the combined instruction. Instructions; the gateway forwards the combined instructions including the gateway’s acquisition of the global key encryption issued by the platform layer, uses the global key to decrypt the new combined instructions, and uses the global key to encrypt and forward the new combined instructions to the trusted network terminal .

The global key and the group key are designed by randomly selecting the first key according to the routing information; the group key is used to transmit a single instruction, and the global key is used to issue a combined instruction; the group key solves the problem of a route The security issue of the keys required for collecting the uplink information of the downlink terminal reduces the frequency of key interaction and improves the efficiency under the premise of ensuring security; the traditional strategy does not carry out unified management of keys, and adopts point-to-point asymmetric Encryption and key interaction usually use a more complex grouping algorithm for key synchronization, and the global key solves the problem of difficult key interaction for downlink commands on the platform.

Referring to Fig. 2, the composition of the quantum key security distribution system based on the Internet of Things provided by the embodiment of the present invention includes: a quantum random generator, which is used to generate a true random number as a quantum key; a terminal, including an end terminal and The trusted network terminals all carry the initial SDK; the platform layer applies the above-mentioned quantum key security distribution method based on the Internet of Things, and is used to securely transmit the session key with the terminal for data transmission.

Among them, the platform layer includes: the service module of the quantum key, which is used to obtain the quantum key pushed by the quantum random generator and securely store it as a key pool in the form of a queue, and obtain and encrypt the initial terminal number to generate an encrypted terminal number for verification. The terminal that passes through randomly selects the first key; the resource and information management module is used to obtain and store the private key certificate of the terminal, the initial terminal number and the decrypted terminal number, encapsulate the initial SDK, and verify the terminal by comparing the initial terminal number and the decrypted terminal number Whether it is safe or not; the security codec management module is used to obtain and decrypt the initial SDK set to obtain the decrypted terminal number set; the secure access management module is used to obtain the routing information of the terminal and build the initial SDK set of all terminals under the same routing group , encrypting the first key and distributing it to the terminal according to the routing information.

Specifically, based on the above-mentioned embodiments, the specific steps of applying the Internet of Things-based quantum key security distribution method provided by the embodiment of the present invention to the Internet of Things-based quantum key security distribution system include:

Before the device enters the network, a trusted network is built based on the platform layer, and the key is distributed by the quantum random generator to generate Qkey(n), and the service module of the quantum key is safely stored in the form of a queue to form a key queue: Qkey(n )...Qkey(n+n).

The resource and information management module obtains the initial terminal number and applies for encryption to the service module of the quantum key, so that the service module of the quantum key uses a symmetric encryption algorithm to encrypt the initial terminal number to generate an encrypted terminal number; the service module that obtains the quantum key is distributed to The private key certificate of the terminal; packaging the encrypted terminal number and the private key certificate into an initial SDK, and reporting to the security access management module.

The terminal carries its own initial SDK and reports layer by layer at the network layer to apply for network access and route collection. The security access management module records the routing information and reports it to the quantum key service module synchronously to realize the sharing of routing sets between the two modules. , and construct a set code set K ₁ ...K _n of initial SDKs of all terminals under the routing group, and report it to the security codec management module. Wherein, the routing aggregation refers to the shortest path selection aggregation using the Dijkstra algorithm under the global routing.

The secure codec management module uses a symmetric encryption algorithm to decrypt the encrypted terminal number in the initial SDK set to obtain the decrypted terminal number, and reports it to the resource and information management module.

If the comparison between the initial terminal number and the decryption terminal number in the resource and information management module is consistent, report the initial terminal number to the quantum key service module; if the comparison is inconsistent, feed back to the security access management module, Feedback the network access failure information to the terminal, and discard the terminal.

The quantum key service module matches the routing information according to the initial terminal number, randomly selects the first key from the key pool Qkey(n)...Qkey(n+n), and the first key includes a single The group key of the instruction to the end terminal and the global key used to encrypt and distribute the combined instruction to the trusted network terminal; that is, each group randomly generates a new group key Qkey(p ₁ )...Qkey(p _n ), and in Qkey In (n), randomly select a key to generate a global key Qkey(q), and report it to the security access management module. Wherein, the last terminal is the last terminal in each routing group, and the trusted network terminal is the remaining terminals in each routing group except the last terminal.

The secure access management module encrypts the group keys Qkey(p ₁ )...Qkey(p _n ) with the public key, distributes them to the end terminals of each routing set according to the original route, and at the same time sends the global key Qkey(q) After being encrypted with the public key, it is distributed to all trusted network terminals step by step.

After receiving the key information, the terminal decrypts it with the private key certificate to extract the symmetric key Qkey(p), which is the session key. After deciphering the session key, the end terminal receives the single instruction ciphertext from the platform layer, and uses the session key to decrypt to obtain a single instruction; the trusted network terminal receives the combined instruction ciphertext from the platform layer forwarded by the gateway, and uses the session key to decrypt Get combined instructions.

In this embodiment, the encryption algorithm used by the Internet of Things-based quantum key security distribution system during the session is a symmetric algorithm, that is, the platform layer and the terminal use the same key for encryption and decryption; the public key, private Both the key certificate and the session key are truly random numbers generated by a quantum random generator.

Specifically, based on the above embodiment, in the scenario of a single command, the terminal encrypts the communication data data1 using the session key Qkey(p), obtains the encrypted data data2, and encrypts the encrypted data according to the routing information stored in the security access management module. The final data data2 is sent to the platform layer, and the corresponding session key is selected for safe decryption, and the communication data data1 is extracted and restored and submitted to the platform layer; The session key Qkey(p) encrypts the sent data data3 to obtain the encrypted data data4, and the terminal uses the session key Qkey(p) obtained by decrypting the private key certificate to decrypt the data data4 to obtain the sent data data3.

On the service flow of single instruction interaction, the encryption and decryption keys used are all session keys Qkey(p ₁ )...Qkey(p _n ) selected according to the routing information of the security access management module. The session key in the single command scenario is obtained by the terminal by decrypting the received group key with the private key certificate. The group key solves the security problem of the key required for the uplink information of all terminals under a routing set. Under the premise of security, the frequency of key interaction between the terminal and the platform is reduced, the communication efficiency is improved, and the communication overhead is reduced.

Specifically, based on the above-mentioned embodiments, in the scenario where the platform issues a combined command, the platform sends the combined command encrypted with the global key to the gateway, and the gateway uses the global key to decrypt the combined command and perform command analysis. The final combined command is encrypted again with the global key and sent to the trusted network terminal. After receiving the encrypted combined command, the trusted network terminal decrypts it with the global key to obtain the combined command issued by the platform.

The global key manages the keys under the same gateway in a unified way, and uses the centralized gateway to interact between the platform and each terminal, which reduces the network pressure of large-scale key forwarding and solves the problem of difficult exchange of platform downlink command keys.

In this embodiment, the distribution of quantum keys is based on the Internet of Things, which is separated from the properties of the network medium and does not depend on the network channel. Instead, it uses transparent transmission network channels for distribution, and does not perform any processing on the transmitted business message body during the transmission process. To a certain extent, the transmission security of the business message body is guaranteed.

Apparently, the above-mentioned embodiments are only examples for clear description, and are not intended to limit the implementation. For those of ordinary skill in the art, on the basis of the above description, other changes or changes in various forms can also be made. It is not necessary and impossible to exhaustively list all the implementation manners here. And the obvious changes or changes derived therefrom are still within the scope of protection of the present invention.

Claims (10)

1. A quantum key secure distribution method based on the Internet of things is applied to a platform layer and comprises the following steps:

acquiring an initial terminal number of a target terminal, and encrypting the initial terminal number to generate an encrypted terminal number;

acquiring the encryption terminal number and a private key certificate and packaging the encryption terminal number and the private key certificate into an initial SDK;

acquiring the routing information of the target terminal, and constructing a set of initial SDKs of all terminals in the same routing group according to the routing information;

acquiring a decryption terminal number set according to the initial SDK set, comparing the initial terminal number with the decryption terminal number set, and randomly selecting a first key for the target terminal if a number consistent with the initial terminal number exists in the decryption terminal number set;

according to the routing information of the target terminal, the first secret key is encrypted and distributed to the target terminal by using a public key, so that the target terminal can decrypt by using the private key certificate to obtain a session secret key;

the private key certificate, the first secret key and the public key are all from quantum secret keys generated by a quantum random generator.

2. The quantum key secure distribution method based on the internet of things as claimed in claim 1, wherein the encryption of the initial terminal number to generate the encrypted terminal number employs a symmetric encryption algorithm.

3. The method for securely distributing the quantum key based on the internet of things according to claim 1, wherein the obtaining the routing information of the target terminal comprises:

when the target terminal carries the initial SDK to carry out network access application and route collection, acquiring route information in the route collection process;

the route collection is the shortest path selection collection by utilizing Dijkstra algorithm under the global route.

4. The internet-of-things-based quantum key secure distribution method according to claim 1, wherein the obtaining a decryption terminal number set according to the initial SDK set comprises: and decrypting the encrypted terminal numbers in the initial SDK set by using a symmetric encryption algorithm to obtain a decrypted terminal number set.

5. The secure quantum key distribution method based on the internet of things of claim 1, wherein the comparing the initial terminal number with the set of decryption terminal numbers further comprises:

and if the number consistent with the initial terminal number does not exist in the decryption terminal number set, feeding back the network access failure, and abandoning the terminal.

6. The internet-of-things-based quantum key secure distribution method of claim 1, wherein the randomly selecting the first key for the target terminal comprises:

when the target terminal is a terminal, randomly selecting a first key as a group key for the terminal, wherein the group key is used for encrypting a single instruction distributed to the terminal;

when the target terminal is a trusted network terminal, randomly selecting a first key for the trusted network terminal as a global key, wherein the global key is used for encrypting a combined instruction distributed to the trusted network terminal;

the end terminal is the terminal at the last position in each routing group, and the trusted network terminals are the other terminals except the end terminal in each routing group.

7. The utility model provides a quantum key safety distribution system based on thing networking which characterized in that includes:

the quantum random generator is used for generating a true random number as a quantum key;

the terminal layer comprises a terminal and a trusted network terminal, and both carry the initial SDK;

the access layer comprises a gateway and is in communication connection with the terminal layer;

the platform layer, which applies the quantum key secure distribution method based on the internet of things as claimed in any one of claims 1 to 6, for data transmission with a target terminal secure transmission session key, and includes:

the quantum key service module is used for acquiring and storing the quantum key pushed by the quantum random generator, acquiring and encrypting the initial terminal number to generate an encrypted terminal number, and randomly selecting a first key for the target terminal passing the verification;

the resource and information management module is used for acquiring and storing a private key certificate of the terminal, an initial terminal number and a decryption terminal number, packaging an initial SDK, and comparing the initial terminal number with the decryption terminal number to verify whether a target terminal is safe or not;

the safety coding and decoding management module is used for acquiring and decrypting the set of the initial SDK to acquire a decryption terminal number set;

and the safety access management module is used for acquiring the routing information of the target terminal, constructing an initial SDK set of all terminals in the same routing group, encrypting the first key and distributing the first key to the target terminal according to the routing information.

8. The Internet of things-based quantum key secure distribution system of claim 7, wherein the quantum key service module obtains a quantum key pushed by a quantum random generator and securely stores the quantum key in a queue form as a key pool.

9. The quantum key secure distribution system based on the internet of things as claimed in claim 7, wherein the end terminal receives a single instruction ciphertext encrypted by a group key from a platform layer, and decrypts by using a session key to obtain the single instruction.

10. The quantum key secure distribution method based on the internet of things of claim 7, wherein the trusted network terminal receives a combined instruction ciphertext from a platform layer, which is forwarded by a gateway, and decrypts by using a session key to obtain a combined instruction;

after the gateway forwards the combined instruction which comprises the global key encryption and is issued by the gateway acquisition platform layer, the gateway decrypts the combined instruction by using the global key to acquire a new combined instruction, and the new combined instruction is forwarded to the trusted network terminal by using the global key encryption again.

Images